{ "Event": { "published": true, "date": "2026-04-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-18", "timestamp": 1776556981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ba09a646-4863-4838-8ad9-386869bc9c58", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0952ca31-3af1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494234, "uuid": "8fd3fe85-5dba-481d-81cb-d8096055210d", "comment": "Malware payload (Mirai)", "value": "49aef3bd428a656efd586c95d5425052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494234, "uuid": "a1575de7-66a8-4d5d-9796-197de2733761", "comment": "Malware payload (Mirai)", "value": "009abdfadd83ade67d7af84d3b4527695975140f1f1d631fdd0897133188fbbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494234, "uuid": "e0a1f886-4427-492f-8680-c9683f456d1c", "comment": "Malware payload (Mirai)", "value": "2e5a7165918c17d6b966bddb423500043dc31a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494234, "uuid": "9e57617b-bb88-4c9d-8ae1-389d2fada69d", "comment": "Malware payload (Mirai)", "value": "501fe61a07a0268dcc010b94ee2f3be25a0af2f907432679f1d6ccf5e9aa68fd055a96874f5b4a4928cfabf0f4949fa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494234, "uuid": "8626bdb9-ec3d-4a4c-85ee-384b7dfc61d6", "value": "T1A3E32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494234, "uuid": "3e2a83ba-1f1d-4f6c-b593-cd5e42f8753d", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzDX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduG0X0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494234, "uuid": "7e72a1b5-b0b5-48f6-929a-8b70400def73", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494234, "uuid": "f58ae6b1-d2a2-43e2-bf11-779c94578f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494234, "uuid": "f2d8d5b0-13c3-4b7f-8e20-4558bdcaa4f9", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff6e005-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477038, "uuid": "998b1abe-957a-4849-988c-cad35f070ebc", "comment": "Malware payload (WeedHack)", "value": "3394cb1f90d141e6884e5ad9e53dc766", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477038, "uuid": "b271c04a-e369-4227-b0ed-64f3e71dd494", "comment": "Malware payload (WeedHack)", "value": "00b56c9007c0674be8a01375cddc566c5f85ab08177c402b460da4565a7e83e0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477038, "uuid": "ed1ffba1-d4be-495f-bfe2-1361d72e7d80", "comment": "Malware payload (WeedHack)", "value": "b2afcd6244372411720ff0b6391f9938742fa612", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477038, "uuid": "37106481-1d7c-4446-a989-5cd3b0ba7f33", "comment": "Malware payload (WeedHack)", "value": "410cca4e14d4b2b117642da3ea6562de6f440f915110d2fa4f41f200972c1f4a5a08c1d15166c6dd30bd129795dee38a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477038, "uuid": "a695d2a8-f2c5-4d53-86e9-8024b0a061e8", "value": "T1D895335DE98E2D34C2DAF6088FABEF4A12968E87313388676D3879465E77502DB45C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477038, "uuid": "822a6b58-ee6e-48f5-9a57-fae3ae835104", "value": "49152:oRcs8E6HBVNsMmnNwIZ6C8XitmQ/89SPO/hl:oRv6OMmnNfZ6C8Xitmi89SPO/hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477038, "uuid": "54f2f458-a43b-48e9-b3e3-49e71ce34a47", "value": 2043586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477038, "uuid": "3cae6fda-a07f-49b1-a7cd-38408d8b5995", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477038, "uuid": "ff9d0db5-db04-48ab-93f9-2c308ce7baff", "value": "pixel2.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0f6a2f-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776545588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545588, "uuid": "b2ff8444-4cc1-4b5a-b8bb-3ee2c4228b4a", "comment": "Malware payload (Vidar)", "value": "32e2d011908881b80dfca9393093d849", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545588, "uuid": "a69f7b86-a408-4e35-a389-b0340930210a", "comment": "Malware payload (Vidar)", "value": "00f7ed099a7212b1d655a3143adc9e8693d3bd1a6f845a461b35eba929929bb3", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545588, "uuid": "acd61116-cfe8-420b-9135-ec23052c1cad", "comment": "Malware payload (Vidar)", "value": "693b4e2f64b83b265e595c4044d228fc896fc5f5", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545588, "uuid": "7098d285-7791-4f49-837d-e16c916052b8", "comment": "Malware payload (Vidar)", "value": "730a62651c3db24a859333a5dfde96eb1205b7d0c7a3dd0305dc7976bc5898a8f5c916b62a441cea173a40b1eed20d08", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545588, "uuid": "2a2eed4a-b31a-4aa4-963a-1980301fe37d", "value": "T108C57B47ACA448A9D46EA3358CB642967B35BC98073623D31F636A396FF37D019BC704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545588, "uuid": "8dd90ed6-f36c-494d-a09e-616b27fb550f", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545588, "uuid": "455467f5-8803-487c-8da9-c1d66afdcb59", "value": "49152:OvWAacodW2Ngnr1wvzRJyBJgon+Ia3UPOrzRYiKtpv:OvWRZU71wvzRJyBJFn+IEUPqYPpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545588, "uuid": "5148753c-90a4-4135-8f4a-60e774d80180", "value": 2554242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545588, "uuid": "80cd3c84-a5d8-449e-aea2-5a4adc1a43a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545588, "uuid": "ab2bf68b-9a7f-4eb0-a4ac-0970e0420b23", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be42a0f-3b08-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504224, "uuid": "b9a334f4-49a1-4a12-8ccc-67a6b7f3de60", "comment": "Malware payload (NetSupport)", "value": "7881a3cd137435b71df07a886dfdb60e", "object_relation": "md5", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "pw-ilil", "colour": "#0ECDD4", "exportable": true, "hide_tag": false }, { "name": "pwn-ilil", "colour": "#5F747C", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504224, "uuid": "8ac68c58-a036-4fd1-a437-9d191bca809b", "comment": "Malware payload (NetSupport)", "value": "0125d34c4ecec65cd18cdeb6a88ccc8004b8f773f78c6406a84658e28f395405", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "pw-ilil", "colour": "#0ECDD4", "exportable": true, "hide_tag": false }, { "name": "pwn-ilil", "colour": "#5F747C", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504224, "uuid": "e0cfbf8e-45bf-4171-8a76-f5332e9c65b0", "comment": "Malware payload (NetSupport)", "value": "deb4e2e7ee780d453e8f112636a47e58c98c5301", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "pw-ilil", "colour": "#0ECDD4", "exportable": true, "hide_tag": false }, { "name": "pwn-ilil", "colour": "#5F747C", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504224, "uuid": "46b37b12-ae32-4b3c-93fc-3498fda7154b", "comment": "Malware payload (NetSupport)", "value": "21850657bf6eac4060172acde65ae1365ea9085fdb86ed590c21828ae3ab816d349e1ab84370d4ea561eac269944a930", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "pw-ilil", "colour": "#0ECDD4", "exportable": true, "hide_tag": false }, { "name": "pwn-ilil", "colour": "#5F747C", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504224, "uuid": "0e7861e5-6c7a-483c-92e9-6f560023aa9c", "value": "T1D66533C3B97BE94FCD2E69D035B65EEEBB7A1C6218E405464633EA24700553F78033A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504224, "uuid": "3d9c7f71-508d-4493-b43c-d5cd7761be2f", "value": "24576:6NyoM7AqV/fQ9cNeEFYw8DYQAg6fUFy082aV+hZllQNqy/ffM44Jc+BIVDKekNrJ:6u3RfQ2NRf0Ag6fH082TLQNqYfEBBIVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504224, "uuid": "f730b97b-b68d-4b1c-9d66-7846f6cdc984", "value": 1506352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504224, "uuid": "5386f0ea-7caf-4a35-8c18-174aed4989e2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504224, "uuid": "7c9f43ff-c50f-4b47-8b28-23263cfe342b", "value": "pw-ilil.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a1c8d3-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488002, "uuid": "fa4b44e0-497a-41a5-b112-40392e48d0d8", "comment": "Malware payload (Mirai)", "value": "f012e3a951b2cef141fb3a2dd701ac76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488002, "uuid": "4d6e9ba1-78f7-44e8-a32c-2d8719b32640", "comment": "Malware payload (Mirai)", "value": "02179c64a4e24d5787232db3e4acad0b9cd14c9b0bc9e99b6783da8ec311c060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488002, "uuid": "68e5e3ba-3ffb-4bdc-8d94-ee60c8a40a4f", "comment": "Malware payload (Mirai)", "value": "620e77ad54f2478920d6bd0f85bf98284c32c981", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488002, "uuid": "558321c7-5605-4d43-a23a-dd112a9d0b84", "comment": "Malware payload (Mirai)", "value": "ab972282dacf58eeefa0d4e28db42ac1884e86d7515cf3a671570034bae3ebcf8f1bc93813a63c3cb9ad5ff959c0af20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488002, "uuid": "17b7c32c-a9d0-49ca-a098-74f6cd7d9edf", "value": "T1EC8312FE522F1F79ED721C32CF764151320B2E2A341961E9C5B06997BE6D3E046C943A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488002, "uuid": "b4a75015-4689-4b3e-9c45-47f42eb68b68", "value": "1536:G/gWI2xC4JNVJrXn1k4B4fUJJABkLG5SDiHAg1gdtdLItu4FjFdT7SoDnp:GVIoJ7nq4efUbQkKs+HAgqd3LItdF3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488002, "uuid": "e32a4a6d-e514-466f-981f-6185100c7929", "value": 84544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488002, "uuid": "bec1f839-547f-4245-a17b-b5573e42a07d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488002, "uuid": "4a87d289-a3ad-4434-b42b-1eb77af081e6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d72b2a5-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473007, "uuid": "7bb5dcd3-4a97-41ad-af53-3bc2d1be47b3", "comment": "Malware payload (WeedHack)", "value": "7e82b95484d37a656fdd5cd44fc46d5b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473007, "uuid": "c5313ab0-2006-46b8-947a-83b523ecca3e", "comment": "Malware payload (WeedHack)", "value": "0255dc0be99963d4bd4e5b75d67eebf9f94709298ee91c969a50eaec609fda6d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473007, "uuid": "9fe63fed-b401-45c6-b27a-37b22018d643", "comment": "Malware payload (WeedHack)", "value": "07d04f17951c135ae021af8d0ac7e8517e458aa2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473007, "uuid": "4b220142-cb06-46fe-a5ca-577dc80bd970", "comment": "Malware payload (WeedHack)", "value": "a4300ef9bfd1bd78f8f0cc823a18a86cb54fb037c3635332be41c8172a3867076c8e4afe7cd521555260a9e08b68cf88", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473007, "uuid": "60f1358c-a4bf-42ce-a4d1-f6aae2b9f58b", "value": "T131B4239397C21C3AC284733A795C88673A9BD6F410ED6DA19BE31B6A4B337E5117C4C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473007, "uuid": "f91866cb-5d77-46b1-bde1-9e7e662b9916", "value": "12288:XKzog4RTAvHNEJ5SKg3j6qboQDnPoubRODl+Br900qo:aUg4UHo5SKKj6moQbouQlcrCTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473007, "uuid": "afef4385-500f-40c4-9879-3f1a710979a4", "value": 527623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473007, "uuid": "f82efe5d-2e90-45c3-ab7d-4c5197246566", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473007, "uuid": "12307d1d-070e-42ca-a91b-223ca0c536f1", "value": "jennyboobs-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fceb342-3b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776518807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518807, "uuid": "3ba84e5f-f2a7-4dc7-a1ed-9acebdff3369", "comment": "Malware payload", "value": "dec7420b04c9c333f371b0a6daa6298c", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518807, "uuid": "32edb549-da3c-4938-b78d-085543c7e70e", "comment": "Malware payload", "value": "02a928b88e98a6a54cf78cf6dbacfd8acbd4a1e4c93a986e6d21e58b273054ed", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518807, "uuid": "a17e9f75-0917-423f-8937-99c250d323f7", "comment": "Malware payload", "value": "74db02514964ba49123c4e8c792381143a8fd846", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518807, "uuid": "62b63ce9-fafb-42c2-ac79-5766173e3625", "comment": "Malware payload", "value": "58ac831478e37755c90287c7cf7bf921622eb46e165693f1cb2b08e064de0374190d7e58abfac07d58076a2d392a63c8", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518807, "uuid": "a2e07725-e373-4b1b-b0a3-7d0ce81ea336", "value": "T16944233265B31B7ED433229C6DC9AAB5488F68528B84FF9CF3849961CC2E0527C1F55E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518807, "uuid": "16709cd3-affc-435f-95a2-9e2f4574dc3e", "value": "6144:APSkk8Xydm8X8k4SsXNdbYGyDmB5ERgW9sm/bx/F:AqkknbyDbvOmIj/bxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776518807, "uuid": "fd625ac8-795f-4343-9e37-85a06c8818de", "value": 273114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776518807, "uuid": "2d9228bd-c80c-4759-b7d6-4f2f76b00bf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518807, "uuid": "6f9e3416-6b7a-426a-b054-5e8ac582b7aa", "value": "Smadav.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5615ad63-3b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776511542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511542, "uuid": "2ca386e4-a4fc-4b18-9e3a-f9f70ebd4e96", "comment": "Malware payload (Mirai)", "value": "683657ebcc135582bdf53825eb410d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511542, "uuid": "1fe29d0e-f264-4f39-98d4-a0c0dd6897ec", "comment": "Malware payload (Mirai)", "value": "051caaebf4bed38109ec655dbdf35585f65894d5351910bff733b11d03987768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511542, "uuid": "970936c8-fa1d-4e85-8f6e-dde33ff4f394", "comment": "Malware payload (Mirai)", "value": "e0d1bcc8b34c6705b7a9e4289380bbbd396c7053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511542, "uuid": "db354e6b-eabf-4f3c-aca2-1b2d3b6b4e71", "comment": "Malware payload (Mirai)", "value": "92ee34cd35a10941204a7f4cc0f4b11034ce5ef5cbe15eef0e4b5616a05cb886c8cb825a0a96d4e8e91370a599dd48d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511542, "uuid": "e6ed24b5-d049-4eda-aae0-c668b9ed08ab", "value": "T156931991BC92962BC2E023BEB67E518D336667A4C2DF721BC8254F117B8950F4E77B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511542, "uuid": "5a0d5f4a-1f3f-4aad-a741-610f4f2d32f7", "value": "1536:Vp9Pjy7ECqN1GGuQRP/2rpcTNgz+aLAeok9R0IxiC6cRcLLAb85iKiXstFxBX+gU:JPjy7G1GGuu+a5kh7sAiiq5Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776511542, "uuid": "c4eb4696-a9d0-468e-b7c9-dbc03f0f9a8a", "value": 97088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776511542, "uuid": "f7b24396-860a-40a9-93f0-c2b6ffc5ad71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511542, "uuid": "e3e3e155-4269-4771-be38-6e25d38f3090", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0365cd34-3b4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776533308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533308, "uuid": "00454815-9583-46a3-b636-64ff1ed3eb12", "comment": "Malware payload (Mirai)", "value": "e49063cdf047b9916cebdd356799c616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533308, "uuid": "98c6a3bd-a23e-4f25-bb6d-6b31c09d0d8e", "comment": "Malware payload (Mirai)", "value": "0547ae658e5383989fcf75408e813c491da48342dfd32bf76e051c969ddd527f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533308, "uuid": "cf1eb6ef-7dee-4272-a6f2-cbf13bdc5cba", "comment": "Malware payload (Mirai)", "value": "3936c2dc24a1254cbd23baf2872c5a4ed87eb4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533308, "uuid": "f01004f9-87cb-4102-83b9-aa47a8ab2aae", "comment": "Malware payload (Mirai)", "value": "85fd89f38fcbddfccb50e994fb2c315b84debd57f4669861fb7d347a1d1fa7abdef63974e9ce2e2dd75ee74e0578203a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533308, "uuid": "625ff6b7-1072-4377-b30c-4a29f458c7c5", "value": "T12BD33A81FA8BC0F5E41704709027F33FDF31A6295037C55EEFA59E76EA67A42860625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533308, "uuid": "ed526f49-5646-4a9f-8765-b04a1cbed76c", "value": "3072:TfsxBaiG9EgrjitNQBTwkMRcclzQta1+bva:gxBhg2OTS4s+ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533308, "uuid": "28c68ccd-7d08-4684-be94-98c590e0ac69", "value": 135296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533308, "uuid": "3d38652b-434a-40dd-9a3a-e5b1e246dcb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533308, "uuid": "ea66416c-261f-4dd4-9769-c0bd7d623e17", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57c1d45-3b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776552478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552478, "uuid": "43458263-6f8d-4d5f-a186-36e845313b4f", "comment": "Malware payload (Gafgyt)", "value": "008013014b16df83759bd57e783c61d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552478, "uuid": "b52152bd-3992-4823-9708-25d041bad105", "comment": "Malware payload (Gafgyt)", "value": "06448813b42c6fbd9ee88e84b455bf13ef28749d87c4e376455f918dbfd9810f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552478, "uuid": "e1e1250c-6d96-4b74-8e47-13c17a679914", "comment": "Malware payload (Gafgyt)", "value": "decc81b71d8b57ef53f6e4168756999923de1691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552478, "uuid": "4538eadd-e1a5-4f8c-916d-40d1ee692012", "comment": "Malware payload (Gafgyt)", "value": "9c7d5596e601cf2a91cc380465186ccb4a338876cb1b2a9d74528a49c29e8eb602e154b01ca919261a533740cb7bcbd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552478, "uuid": "f84f4c64-b2a0-4002-871c-5d4287b2884d", "value": "T10263D60AAF554EBBCC6FDD3706B9070630CC594722E93B793974D82CB65A50B4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552478, "uuid": "34f5c515-a084-4532-9196-498bc23d889f", "value": "1536:/WA+as4fw6NbvLlbpmFqFswU18UI3JBLu+0TGZueeObg5fN6/R:OApst45bpmHIL0yJgda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776552478, "uuid": "767af449-4e4a-469a-9778-e87b867615ac", "value": 68492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776552478, "uuid": "c5d5fd12-afb7-4bd6-8f79-2ccc8eff2a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552478, "uuid": "64da6754-2c87-4b83-a0ae-40f5dcbc0428", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374d1bb7-3b13-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776508914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508914, "uuid": "e5eafbe3-c50b-4454-93e4-3b90e9fc23f1", "comment": "Malware payload (Mirai)", "value": "91c6b678383cf92a818b3e08c1900ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508914, "uuid": "748db5d3-5022-4702-872c-746ee440274c", "comment": "Malware payload (Mirai)", "value": "064fc04504e868ec0f453d426b77a25fdeaeda9abb9dc72ec5dcede19bdf157f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508914, "uuid": "085ce026-c6cb-420e-b028-a5d7135caabe", "comment": "Malware payload (Mirai)", "value": "3327b77bcc89ec8b2f13e7d3fd70688aaee22389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508914, "uuid": "6f9c69d0-992f-4767-915a-425487f1d024", "comment": "Malware payload (Mirai)", "value": "6a69c3f865d77a5bfb38fab45084cf2c7d8eed9f3c6337f97684a73baacd240a6ae5a8b71ee8277bd7b87bf563520bb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508914, "uuid": "62c07777-893a-4040-9f1d-9b33970c5a6b", "value": "T19A63017AD2DA2D80DB124F3204AE87CB872925FDB0DB36B250AE6495B5165F7320C787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508914, "uuid": "26092efe-0b3f-498d-9017-0019dcbeeae5", "value": "1536:EeoSvONpuv3PT8myJHE6V7EWRa/bqVr691uy+lNF3CLqcRez9:EXSWNsfPT8m2TDRa/Wrct+R3CTReR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776508914, "uuid": "7f3b9a79-99f3-4bbe-bcce-efa7f5919621", "value": 70160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776508914, "uuid": "b447bb4f-444a-45a8-85ef-c373e9067b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508914, "uuid": "1c967a52-f1c8-4db6-b7e0-b1c3a8588995", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129ae13e-3b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537629, "uuid": "b4a46f6d-7f67-43f1-93cb-beb6c89d005b", "comment": "Malware payload", "value": "cc964a14eb723c48eb5bae83704c196c", "object_relation": "md5", "Tag": [ { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537629, "uuid": "9f67463b-20ad-4ae8-8fd7-f860c348c321", "comment": "Malware payload", "value": "076d9f0485cbda0df2583417e6c68b281c316770bd2ea76a5424fbe4d4295da6", "object_relation": "sha256", "Tag": [ { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537629, "uuid": "2920d544-09e8-4471-8529-742cf81743e0", "comment": "Malware payload", "value": "1baedd81fc7d28da5a6083b157c4b3cbf3b0db1f", "object_relation": "sha1", "Tag": [ { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537629, "uuid": "c89606f8-f3e0-4d32-bbf7-892a3c46a00e", "comment": "Malware payload", "value": "076561e346b58f08e65007fd7352a3bf1d703d81b10584a7d4161c6b8e9c2eef48fadf48ef34f6ec3780387ae4790ebb", "object_relation": "sha3-384", "Tag": [ { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537629, "uuid": "9c205454-e738-46b5-995e-a5c2fc9a5b35", "value": "T19911880753521F2FD6A8F47816EB08AF152457E399A5EE471000745C139C4F6271A039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537629, "uuid": "c3293226-c03c-4128-896b-9894563caf9a", "value": "24:98kKNIumY5B09hhfbZdGQnE94gBBfZwFwZkKA7:9xumOWfbZd1E9dfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537629, "uuid": "f15616a0-a165-4381-8799-cc7633adb40e", "value": 941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537629, "uuid": "b1ec07b4-2e4f-46f2-a042-f4d20ee42982", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537629, "uuid": "38768168-49eb-4d4c-81da-c9793f3a0042", "value": "Commercial Proposal for Ground Control from Ukrguard Charitable Foundation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cf4d02-3b52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776536231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536231, "uuid": "4d6c5cc7-ea96-4173-8f87-0e388c8bc9c0", "comment": "Malware payload", "value": "664b06ac14c456cb756077eec81ece05", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536231, "uuid": "e6858683-aebf-4d83-9239-90ae27efac3c", "comment": "Malware payload", "value": "07d689abb9d48c5054de00775b1cb6fa0f84c26784fbfdbbe3a1da5d7ff16665", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536231, "uuid": "1e149c54-fba3-4119-aeaf-e24a6a23b45f", "comment": "Malware payload", "value": "08ba092962ef7fb2220416acfe319c9a8ec80a25", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536231, "uuid": "bc3c5e46-1c23-4286-bc00-72bf18d0448b", "comment": "Malware payload", "value": "1c16e36b09e8ddd7378c9fed44de7840cf2bb619a005ec7a4159b2afae3fb4ed8efa6515163c8fec9b6a61ae5a9c0270", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536231, "uuid": "49b0ab4f-1c40-41bd-8593-2e186489d57e", "value": "T14CE57C3676B84986D12FC07DC59B8B0AE771B50647204BDF04A59EBD2F27BE50E3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536231, "uuid": "859d855d-9071-4a4a-9377-e8c10af33be0", "value": "a48c63f7fbdee314ebc5abfc945c6bd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536231, "uuid": "2d6e87e6-129d-41bf-b63c-dc81c88c74af", "value": "49152:rhj+ggxVyGy8gstbglBFoXzq+DBVlvqKbvZeF2:F/AVyG+a2+dOF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536231, "uuid": "94b243a5-7271-4db0-a7b3-a27d428849ef", "value": 3228432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536231, "uuid": "db686996-55e8-4cb0-8311-8694ceb5f408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536231, "uuid": "661b30d4-f660-44a7-a0f3-bbca80f91570", "value": "lib_pdf_repair.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88e3ee0-3b11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776508299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508299, "uuid": "2bf33cdd-3f3c-4e53-9c98-1837c54bd43c", "comment": "Malware payload", "value": "4195774953d206352888b7929302fee1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508299, "uuid": "06e30f98-e520-40f0-8074-b9e6844fe3b4", "comment": "Malware payload", "value": "081c3eaf1772ff49a7423b05d700b19ab96340416937f16896841b823fa459e7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508299, "uuid": "a75fe5fe-713b-44b8-800b-4e3b83b81a2d", "comment": "Malware payload", "value": "a7f7ea4e201520319b8ee1990f35af601c589e12", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508299, "uuid": "8e050d96-cf04-4042-90a9-2b0903fc54b3", "comment": "Malware payload", "value": "c839a6c84b70b395401b9318b4257c7ecd13d2e0096a77e057d22bf77d2c8f9bdaa3c0a0d23b55538c24161f376cd41d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508299, "uuid": "2aa3d093-2f7a-4a9c-b178-7f1431bbbd17", "value": "T1A1C633D79CB78428D8FE269841E43282D458E096922AF3F2FDE0BE73C465DD5661EC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508299, "uuid": "13ca62aa-9bfc-46f6-bf23-2079c395284a", "value": "196608:QKq2jLs0j5R1tWEtCAZhKnYTJQo/0gjd42qLWmScSfF3PWI69+:QSns0JJtDZhKn+X/PO2qLWmm3PWI69+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776508299, "uuid": "b3c4b792-c5e9-46b9-a67a-9b5d543ed817", "value": 12276369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776508299, "uuid": "0b52ea14-b41a-4e1d-abc3-6ea772686670", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508299, "uuid": "8697eee3-2927-471e-840e-4ee22828a7de", "value": "wow.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf252f6-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473030, "uuid": "d1e9641e-87cf-464e-ae53-aa724a9e03ac", "comment": "Malware payload (WeedHack)", "value": "0ff44fc395778919076060b5085aed58", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473030, "uuid": "db7b0d72-8fe2-4ed0-ac11-68495296f65a", "comment": "Malware payload (WeedHack)", "value": "0b5c69a0ea7896726464de287c82b4f49c4894ff6d028bd738035590e54bd0a2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473030, "uuid": "7d64e97b-ae45-4913-b0ad-db8dbf910f09", "comment": "Malware payload (WeedHack)", "value": "46587b6b00fbf4077db64afc4682d540f01a5a6e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473030, "uuid": "3ce7b77d-ee54-47dd-8eb1-67edcae9ceaf", "comment": "Malware payload (WeedHack)", "value": "69e5b15a7b8079efff113a30100c9eaa8822d9a32c54294826cca3bee45960f9134382a19cfd8d569d452f8d725af476", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473030, "uuid": "a438f8cb-49eb-403c-86fe-c67c4f405bcc", "value": "T1D5051233873A801DD99FA937E401EC262D7859E4D00A3A1F1BDD8B9744A3CFD86D568E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473030, "uuid": "5547c84c-154d-49ae-a9ed-0cb6b5c1f2ed", "value": "24576:QEHRR1vbPX5eq0a3LYQ0Ko8a8IS7YpWCHy15fkcYS:Qw79bUq0ULYtYRIS7YQ715fkcYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473030, "uuid": "88e32a3a-f740-4292-a557-5f963e4a99b1", "value": 843744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473030, "uuid": "fe3be304-0caa-4447-ada8-7e36909f1c4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473030, "uuid": "fb2995a0-1180-453e-9e26-110b8faa518a", "value": "platinumclient-1.21.11-n-16.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293a8d1d-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474101, "uuid": "71f0b090-bbc4-43ba-91f5-3313ef306fca", "comment": "Malware payload (WeedHack)", "value": "cf6fef2d0188a45096c2196c8909d192", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474101, "uuid": "e5254fb6-f4de-4d50-b7a3-fb62d9e2f96e", "comment": "Malware payload (WeedHack)", "value": "0b65ccb711722a7a1a25b3a6d719436b1a1cfbd9a95383ec1369f6bc6bbeb007", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474101, "uuid": "5072d7fd-40aa-4fa6-9c71-0fc0130a89af", "comment": "Malware payload (WeedHack)", "value": "3fb4686a18d76cd76d1a55a424727024936a2f61", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474101, "uuid": "4ebeaa5b-f4de-44d6-a18b-ddb130b610a0", "comment": "Malware payload (WeedHack)", "value": "c07d0b858c831103e63925d171dd79e99ec726ce1fe13323d5be1c104063dbd8fdf546e2f2ae9026c99cfb84f49ee280", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474101, "uuid": "ef497afc-04e5-40a7-acff-52b72070cb39", "value": "T1BBC3F132E29CB46CE9A7C23DC4E028796D4B2C7C965F691F29E295CB541ECEF1310369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474101, "uuid": "4eb7d912-b8d5-40fc-b74a-33d75bc6c916", "value": "3072:uu1ttga4KP5GgWTFVwM+QhOZ6bHv0rrVnyrXD7fuQztx:J1fiKhGgWx2mOggtMXvfRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474101, "uuid": "17cf10bf-d56e-4281-8eea-2cb6168a374a", "value": 126384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474101, "uuid": "33eea424-9dc4-4103-8379-07a8c2825b7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474101, "uuid": "29469eb5-f2ad-4d43-afc3-8b06348d62b4", "value": "DonutSMP_Price_Tracker-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fcdfe8-3ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776487271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487271, "uuid": "223d39c6-f270-4ab3-9557-f32f20f7f5fa", "comment": "Malware payload (Mirai)", "value": "02e9bb2a57a6c924818ff0883bf219e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487271, "uuid": "cecfdc99-e36b-4982-9603-e2e043f572e0", "comment": "Malware payload (Mirai)", "value": "0bc30af1a0ca30006e84b1d528dc6ab4548b1f8288ad9ed7a67861e013532545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487271, "uuid": "168fae35-59d7-48af-82d8-cd8b113dc232", "comment": "Malware payload (Mirai)", "value": "c4cf51c28acf67bf4f5993470f3c7118d38966c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487271, "uuid": "678bb7d1-2ba3-462d-9770-654dfb5e1c47", "comment": "Malware payload (Mirai)", "value": "3d0bd4f232d5c01f765b04e477a6ce26c51473fb975c41e8262095ab312901a96f17fdd62f86fa0a6f3816def5abbee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487271, "uuid": "9e8f4787-b2b7-42c1-9910-7e1026983b49", "value": "T1D193FA1E2E325FBCF769C23487B74A259398378637E1D585D2ACD5006E6038E642FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487271, "uuid": "e819c735-63d1-4b0d-b9e3-232f5431e60e", "value": "1536:OqLfvgboRu/ru+PvX7ljwtd8SmLTKWtM6iiei+bh:ONboIrfPvrCtdlm/KWy6i1bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776487271, "uuid": "04939b79-718c-4873-84cb-b1d9c0051909", "value": 89496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776487271, "uuid": "0eab4fe8-5179-4655-a96a-3bc21b178d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487271, "uuid": "2d754020-2c6e-4903-95c6-954fa428f5d5", "value": "dips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936ff0cb-3b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776526678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526678, "uuid": "6c8782ac-fefa-48a0-ac46-a98d6e353be5", "comment": "Malware payload (Gafgyt)", "value": "f06aeecef583819de246d8ca938f92e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526678, "uuid": "ec3addbd-23fa-4e7a-bba8-a72678439f94", "comment": "Malware payload (Gafgyt)", "value": "0bd4303fa4b78eb27323a138b541ffa58b8c8da08d2619ac285f8d49cd538d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526678, "uuid": "9d1efe1d-c6f1-4d6f-9f87-80873b3c81d4", "comment": "Malware payload (Gafgyt)", "value": "00e6861f0408629c82a8f1891e8c1b7291feeb19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526678, "uuid": "9844c8d0-4173-4b8c-9cdf-d157c4add544", "comment": "Malware payload (Gafgyt)", "value": "b89752057e2bcb6449696ac779192875255ddff639f19b285370bf940a72143ee1118073c694cb923ce099daea60e698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526678, "uuid": "378d5117-1ed3-41ea-bc26-caabf7bdeecf", "value": "T187E3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526678, "uuid": "166a94b2-4e9e-4391-b819-7270a653c4b7", "value": "1536:lTKKVHbKBo+0NFgNZhEyv2zJuoaZ8jCSRCt6+5Jx0/Jwq75hsp8nipD:hYhEVzPasCB/e575hsp8ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526678, "uuid": "3391d683-fd4a-48ce-9c4f-47ca99e9f37a", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526678, "uuid": "0332c58f-14a2-4674-a304-e5d1c7647686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526678, "uuid": "6e51820b-d30b-4047-89b3-9cde1feb0d91", "value": "FBI.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e0b784-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776488019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488019, "uuid": "08aaddff-82ac-4f8b-b07b-a5f3645bac38", "comment": "Malware payload", "value": "c3b3b59eede42d0c4c8a09e86c92a6c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488019, "uuid": "82045d3b-56ee-471a-a1a1-06c041c5adf6", "comment": "Malware payload", "value": "0cb1f2b0b7e1c9ba4a101727a202846295a4aaf86ad5f18781d703ac31b40eb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488019, "uuid": "a8835218-952d-46a3-a0bd-904da849a02e", "comment": "Malware payload", "value": "f5ebfba9468b98f58c70fe936f3d159b2d040d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488019, "uuid": "2bdad592-ad1d-4d5c-b96a-3e82bc3c8490", "comment": "Malware payload", "value": "f9e1b7555ebbe3fdc9c6f6f6dc4c4dafaa0e5caa2861656f99424a74a3cad9e8958f89f8b9ac56b0048838c514ec2c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488019, "uuid": "cc7ffd59-e039-49e6-b07f-9bec763ccc57", "value": "T16F246C03B6A254FDC08AC4F0575FA256EE3774A84A1B75F77B843B312912EB18E09792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488019, "uuid": "75d09513-f6ac-4239-a80c-b63b867edb52", "value": "6144:XpjZHu7toE8OBets/JjKB8JFmioXORqn:ZwXk5OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488019, "uuid": "e5161a25-7ad6-4486-ada0-65c4642ef13b", "value": 215248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488019, "uuid": "828dd939-95fd-4f45-96a8-ea125d85d7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488019, "uuid": "8c28e04f-e52a-40ad-9f3e-639fd9e68a51", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5614d9-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776527419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527419, "uuid": "0f0c6009-3e98-43b9-80eb-082a1d4f06f9", "comment": "Malware payload (NanoCore)", "value": "8f9fc72514eda968a2246bb996cdfa24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527419, "uuid": "6fa00e76-5aeb-41e7-9670-d6458774419f", "comment": "Malware payload (NanoCore)", "value": "0ce9cd4a47b271232a4f65cddddf07e1868c7a7b8c6e0c1f48ca3794b399b210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527419, "uuid": "da8729c4-0548-45c2-a1d9-27c5b686ea53", "comment": "Malware payload (NanoCore)", "value": "2e967c7dbf6356a43d1870f3afa1ec0b3aa5e447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527419, "uuid": "a1ceb031-94c9-47c0-8a12-fbf91d863479", "comment": "Malware payload (NanoCore)", "value": "003ed8407fc99ea66e8dd179e7aa825b7d0351740b45a806cf4a1004537aa8f3aedbe4d3f008bfd8aa64b4753c1b5abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527419, "uuid": "5d438db9-e3ea-4060-942e-da80578718e5", "value": "T12014CF1677E84A2FE2DE86BD60225252837DC2E7A8D3F3CE18D465B65F223E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527419, "uuid": "c9549a9d-5074-4394-8b87-f4d9dff46a0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527419, "uuid": "921e6c73-820c-4926-918c-000cca299d84", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIaYF+BX+4D9kNh5y/NMCGEWa:gLV6Bta6dtJmakIM5UMJSftpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527419, "uuid": "a476101e-f3e7-429e-82b0-3c9f38a0812b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527419, "uuid": "c76e8b80-6749-48c6-b87f-2503617c3874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527419, "uuid": "d8904419-e0e5-4e2e-905e-8285fcbbb119", "value": "apiproject1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b407828-3b08-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504250, "uuid": "f6d40e7e-54fc-4d1a-8e09-ccb30387d72c", "comment": "Malware payload (NetSupport)", "value": "19f6656ed758f10875497959728bf877", "object_relation": "md5", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504250, "uuid": "1c0b80b1-a9b3-4751-a0e4-296f580b6561", "comment": "Malware payload (NetSupport)", "value": "0ef3b11323e22db7ff106edb65a0227507dc5c6cf8003fce198b2f4da392e34f", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504250, "uuid": "8dc81367-2bae-4440-bb62-9ce95f389f77", "comment": "Malware payload (NetSupport)", "value": "3fcb78d12fb5543216711dbf21ef19eb1be14e1e", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504250, "uuid": "0b2c14d4-80ce-4b19-8255-389448fed5ea", "comment": "Malware payload (NetSupport)", "value": "c655038ad1ffc7e0b4f501501b85984f40bd02fc0003bed3e5c90e0f5ca73afacf105fa4456c5ff90ade006cfebd8f75", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504250, "uuid": "0848fb3e-0889-4cd1-89eb-dfe7cc157a9b", "value": "T15EB0121C840126BB0609E60E50CDCB079E150C7D7190CBC937411645483E4285E90449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504250, "uuid": "9ea9cb3e-919f-4491-85ec-9d2f5553febf", "value": "3:VSJJFISFNnvHfCMfDpnVdfqrP85MXyJSaARKLDk/:s8SF5fPxV4rP85x/LDk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504250, "uuid": "dfbd3fc5-adcf-4f8e-9156-d46f0f4f1d97", "value": 96, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504250, "uuid": "89915828-91e3-4c71-9ab1-d89e51d73eff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504250, "uuid": "79eac024-e8a1-444e-a97b-cdc90598cd62", "value": "0ef3b11323e22db7ff106edb65a0227507dc5c6cf8003fce198b2f4da392e34f.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df570df1-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551286, "uuid": "307dbcca-5680-4c19-bcd1-99ff4d774421", "comment": "Malware payload", "value": "d367f4cbe05baad5747bbf9c9986f95d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551286, "uuid": "501625aa-ff37-4bd8-8c47-e75650c28d46", "comment": "Malware payload", "value": "0f70cafadae4e285f0be14c69896913e9d46b1d9f9d32f9606e9805271c1f031", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551286, "uuid": "0a9466e8-c9b5-42b4-85cb-15248a253d42", "comment": "Malware payload", "value": "5063304a8dba983308b862c7b8e5383922c2d934", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551286, "uuid": "de540509-f146-4adb-9f80-3bc46734c15b", "comment": "Malware payload", "value": "a95d5366b2f1b66533ca27ddb5898ed1a136b3e2309cebc63e1c0f519982dbf8b4eaf1e90459326cd0e1bbd2e4600e82", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551286, "uuid": "39d4e264-4708-4907-80fb-c5d419eb7ac3", "value": "T19E051231C81E23BBE1168576F3AA4D21EF2E0D8DD08A611B4DA0DBB75E5ACC9DF91530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551286, "uuid": "7cfbabca-c104-4413-a0fd-a211cd85cb7c", "value": "24576:Ou9Q5C5Z+2V2zMhjYc58Nt8Nr+ivgzpINYRW:OZyJhONtxKapINYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551286, "uuid": "5108f6f8-9778-4dad-a65f-2edd4297e2cd", "value": 834800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551286, "uuid": "7f458b4e-78c5-4c4f-b288-aee35d6cded8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551286, "uuid": "aaa850a0-e639-471b-8eac-dcc504812b31", "value": "Exordium-2.0.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83116fb8-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527509, "uuid": "5cda215f-9643-4140-9bcc-86afabe2b4b2", "comment": "Malware payload (Mirai)", "value": "a66797c74456f16cdfba38bcad9720f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527509, "uuid": "fb8710f0-6c90-4a12-81eb-f613dbeb4aa5", "comment": "Malware payload (Mirai)", "value": "0fb9d0a706f44de4ce97a26a6addc05d8bc7ccf08b0aaacf83133111e84cdd6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527509, "uuid": "aec5d7be-1bd7-4b85-a22a-be92c89d2f90", "comment": "Malware payload (Mirai)", "value": "6418a84438cc29030add8cf1c5fe6e21f76340f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527509, "uuid": "76719d31-4bb5-47be-a997-6e152a3b1505", "comment": "Malware payload (Mirai)", "value": "fe0d45e9d95c33e121d159ca2cb3c1bbd06696190b9479e09d3206e43cfd6309583a63d4436d8f78fddd24c910e80b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527509, "uuid": "185a175a-2ff3-48f6-ab6f-20662a58f2bc", "value": "T160C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527509, "uuid": "02cefe01-9f03-434e-84e6-53f5b6664366", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyVw:VoRNjmj1VGFVrRiy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527509, "uuid": "d1618c51-6c7e-4fff-a1ad-9a5055f5c4f1", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527509, "uuid": "5f8b42fa-0dd6-4ed6-a4de-af5b766f465d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527509, "uuid": "66e566a6-8fd7-4132-b164-ff031ecc16f3", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ef8c8e-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534009, "uuid": "aaf83358-c97b-4757-b79b-1b069d628c32", "comment": "Malware payload", "value": "27aa60fdcde20301d135426b8637ece1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534009, "uuid": "05458359-d0e8-4558-9592-c17baeb53eb3", "comment": "Malware payload", "value": "1016d276642187847307e046952c1421a8ca7623f8bec81bced52e541607ebdd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534009, "uuid": "b8c3de72-d4f6-410b-b4ea-5e92630f724d", "comment": "Malware payload", "value": "83f6ef646cb92694c055f0f4860dcdb03eebcdd6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534009, "uuid": "138fada7-ded5-4c36-8d25-37ce9fc824da", "comment": "Malware payload", "value": "5049ccdb6017ab2fddf0e1019b1bfbfeaa42de643f9bbd238bfabb445f7c8a01b475daf2b02eb4637b0befebf372b658", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534009, "uuid": "5ee54f10-9a33-4d46-9408-02b9a5816337", "value": "T1F1E4237CEA1938109950FB373134E54B0EEFE6A0CC19BE42F20753B55A7EC5A6225B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534009, "uuid": "a8065250-d903-4cbd-8b68-1314bd4d60a6", "value": "12288:LXr7y685grpbcDOdEWdYw6W9YLIxvLNH/ihI8JvIAwh16psCk4lU2UW7XM8Sl3TA:rrD85aZcDEbYTUxjNH67vIAwh0psmUtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534009, "uuid": "052f0814-a0f8-4bfd-b612-d234956d515d", "value": 660841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534009, "uuid": "eb6e0ef6-4d0e-44fe-9a0a-a54ab373c7c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534009, "uuid": "b3daa963-2dbb-4759-9387-ed2454c86159", "value": "bypassnew-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8a72af-3b08-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504255, "uuid": "87876691-348d-4601-af07-b8a374faabf9", "comment": "Malware payload (NetSupport)", "value": "c516e89dda23d5c169751624d737a0fa", "object_relation": "md5", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504255, "uuid": "30904413-9a65-4ed7-82db-f0ed7c85bad0", "comment": "Malware payload (NetSupport)", "value": "11f1ebaf8adbba8fedc6095e6d2cd444e7c59085ff3fa97224f0f784ff1d3b6c", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504255, "uuid": "4c7c933a-f1c1-4a8f-922e-aede4efd87bb", "comment": "Malware payload (NetSupport)", "value": "a575bc92d0677ff47eb015c9a0e72468474bd40e", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504255, "uuid": "e1046d46-8f12-4edf-bccb-30032e482d7f", "comment": "Malware payload (NetSupport)", "value": "77a379599f1b4a46950e8852a92d2533711c607ad38712259685e2cad672a65dcf80672bdf479b07dab1ba9059a30102", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504255, "uuid": "e4024599-7c28-496c-92a1-5ec6f817bc1c", "value": "T17CF05CFF50AD1D3BD14305C89D4975AB81C78B9F889D1EA1A2CE77610DB6B3E09D900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504255, "uuid": "850be4e2-842e-46a5-929d-b519736c1677", "value": "12:2huRs9AHNi/deoiGFxXJ6Dptt3V1MLA4bCPs:2huRs9+aDPrZ6t30x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504255, "uuid": "f47c3870-df04-453f-816c-b3cb2b742a2c", "value": 492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504255, "uuid": "9b9936ce-bbb5-4fb7-b52c-1784b4bb99a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504255, "uuid": "d1b9f1c5-9002-4250-ad23-3e6affad2dcc", "value": "11f1ebaf8adbba8fedc6095e6d2cd444e7c59085ff3fa97224f0f784ff1d3b6c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a18f1d6-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474156, "uuid": "1236dab9-96f1-415e-9f4e-37db4a053a06", "comment": "Malware payload (WeedHack)", "value": "80cb74195299ff2c895b0525b0f27a2d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474156, "uuid": "8ccfc6e9-9ea9-42df-b020-1af9a67ccc92", "comment": "Malware payload (WeedHack)", "value": "1264c2ca36d1221f6cc335a7c16f6b3cd8d53b17f13be4898a189f9aa8a6c02f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474156, "uuid": "738e15d7-adc1-47b0-bc9a-86bea2bd0d3a", "comment": "Malware payload (WeedHack)", "value": "48a850b08d1ef8880157fe163f549cc2756e0088", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474156, "uuid": "0a4cdeae-61ec-49a3-96fb-15bae54c6177", "comment": "Malware payload (WeedHack)", "value": "1434c4a96cebe5b39e169ea5f20bd2cb6f2998528f2ff8a8b42d000c3c262fb7b7abf2ab122598eb240237a953c7fa7f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474156, "uuid": "0b07f983-b73d-428a-9c93-d30132591cfb", "value": "T1F5A412A3A17B0D32D90FC9BBF6432BB1BC2C119A91422C3D7865950788674BB93F531E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474156, "uuid": "ca6531b8-d2a9-478f-a2a1-fc4468585bac", "value": "12288:zBCw1W8d2/j2tbf/zzLoN+0zEKeNJ260o0YtycZX:z8VzAj38mJx0YIcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474156, "uuid": "90a518ba-1182-448c-a7c2-394b7f48119a", "value": 492449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474156, "uuid": "0581846c-92b2-4ece-8893-4dc7f98ad9cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474156, "uuid": "37bc708e-c34c-4fa9-b97c-815fdd47f59c", "value": "opsec-1.21.11v1.1.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2867e8-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492950, "uuid": "7d78a470-3769-4a7a-915d-01b2e92ede8d", "comment": "Malware payload (Mirai)", "value": "15d46c55c5d7bc69a856ef25d5f24447", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492950, "uuid": "e3ebea00-91f8-4770-b896-346d0f178f75", "comment": "Malware payload (Mirai)", "value": "12d6c9ab00d60aa843f9513428257da8d1c0c4678349069712ceef42f1ecdbe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492950, "uuid": "0180730f-6446-4917-9bf6-c1e8d6aea88c", "comment": "Malware payload (Mirai)", "value": "d97e4f08bb6588d209b4bf026878c5f7d4289306", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492950, "uuid": "267039bc-01ce-493e-a23b-0203d58e6b46", "comment": "Malware payload (Mirai)", "value": "0f1d905d8fd88903b2983c16cda71d130b1f74d996326b0b55bd9ff8260400a3b7d3f2dbb8cdfbbfc04ee9c261305a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492950, "uuid": "f1cb8a91-c32e-4d9d-a608-fd7fe4ffdf1a", "value": "T1B1F2E160F6502889EEAD19391CD5D6C977E18FBA33586FF229C15F02180DC2AE892DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492950, "uuid": "98342412-30f5-41d7-8383-efb293028f37", "value": "768:b7160aX0xrq5uHZEUZxhIvTyWKeB/SqkIB4cpw4uVcqgw09q:b7160akRou5EoxqyChNtB4cpw4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492950, "uuid": "a83dd92e-e8d0-4a5c-97cc-27280d79360f", "value": 35100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492950, "uuid": "70a87954-69c9-4df8-bdcc-f59632c12ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492950, "uuid": "c06400a8-9c49-41da-903e-6625d0c97943", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411003f7-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776485737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485737, "uuid": "9a762e55-3682-48df-99b1-411e33692baa", "comment": "Malware payload (Gafgyt)", "value": "4c80104e69f5a23259aac667779b8311", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485737, "uuid": "3d90a2a8-2b08-409f-baab-fcdea6fe841a", "comment": "Malware payload (Gafgyt)", "value": "12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485737, "uuid": "46292956-64fb-4594-bf14-ab813ab0d0fe", "comment": "Malware payload (Gafgyt)", "value": "1fa1e9ce75cd84f3f1364120882704ba08c1bd03", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485737, "uuid": "cee81631-d0e1-4afa-83d8-7ffc800b4d03", "comment": "Malware payload (Gafgyt)", "value": "23e067d8d61f9a905cc4a5122bdca563968382a1735df822c5d1ce01ab5fb068e02ed91bad22b1e10b6f1279c003d1c1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485737, "uuid": "ab5d6fe4-6084-42ed-a4be-755a8ff55c16", "value": "T1D13132CF22F20970ACD1A92732AA481476ECE1DB54C65F5B6CED78FA809DE187410793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485737, "uuid": "b66407c2-54e5-40d1-9a6a-5bbf24bbd938", "value": "12:q0FkV0FO0F1Ic43fX0Fm8eekX0Fu0FuX0F2ge0FncfX0FQh0Fwl0FkaM0FMfWK0e:vk+L1Ic4km8asrus2gbnWs7wOkaF0KQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485737, "uuid": "5d1c8be0-2d70-450a-a26f-17b9266c053d", "value": 1561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485737, "uuid": "6e26e9ca-3c08-4d1e-b5c7-6cec0db2cb46", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485737, "uuid": "09bee496-4f65-4816-8d7b-68059cc6332d", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6435d1ef-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527458, "uuid": "9024f6cf-cfab-406b-bae9-ad91424f8e16", "comment": "Malware payload (Mirai)", "value": "c64e755297f28618938fc4ac391a9346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527458, "uuid": "27b7445b-fb47-46ed-b9f9-e85b120b4b3b", "comment": "Malware payload (Mirai)", "value": "134d59d9722d5868bd5c0df4f46ead7d4c7db31c3c2ab0ab291edc19c6693e01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527458, "uuid": "dd87acec-9b67-4e03-9c36-8a8c20ec0e9b", "comment": "Malware payload (Mirai)", "value": "7fe894e7bab9b45dd7a33399cc0d118b90c099af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527458, "uuid": "43698533-dcd4-4515-88ea-8bf603d2b706", "comment": "Malware payload (Mirai)", "value": "7cff076ce7be058be177de376dbc252b9a2d58b0dcfada41da862edc08d513f3561070db5b5a7cebafb52284d62a5ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527458, "uuid": "e0d5801f-6352-4c45-b209-41acf13bdaeb", "value": "T1C9B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527458, "uuid": "55597f23-88c6-4da7-b7c3-deec4eafa2f8", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzM8rSR:t3SrlGWnKTU83AQB5A5Liy36fAUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527458, "uuid": "49c89701-041c-4d9c-961b-e366115fd9ee", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527458, "uuid": "8fbdcb91-9bae-43aa-ac42-70dcc9069c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527458, "uuid": "302399ce-7fe2-4757-9af9-37c54d8df12b", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65007fab-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484509, "uuid": "13b58880-f8cb-44d4-a0d5-4d84c45ca9a0", "comment": "Malware payload (Mirai)", "value": "58a3019b295bd1fa04d927b22ec22084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484509, "uuid": "335dd94b-249c-4166-84ff-6fbe20502d10", "comment": "Malware payload (Mirai)", "value": "140c64145920ccb5e0871e7417a580422271d7b563b808746525d76c06900000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484509, "uuid": "3ba8beb1-06e1-46a1-ae7c-e3d5c3cd60c8", "comment": "Malware payload (Mirai)", "value": "69dd8d688d48690143c1f4651dec0e34c2372d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484509, "uuid": "73199d48-3b50-4823-8289-9881456eab7a", "comment": "Malware payload (Mirai)", "value": "72abb1a25f3ca735009c8b205059d119aa98277cf91e069d6835849c9a0d5975cf5ebb8f277ddf0ec33f7e6ad32d1111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484509, "uuid": "f914daf3-5b16-4af8-bdb6-1fd1e6c6f51c", "value": "T1A03329DAB402AD7CF89FEA7E80160E0AF22123551053072B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484509, "uuid": "365f07f5-f028-49f7-b2be-cdf0ce2ba4c7", "value": "768:7MehvKgc46P1ZmWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pISk:QIK34GPmbBF28Sjp1UGRJbOMdw8hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484509, "uuid": "24119f89-15fe-4ddd-9c3e-690cf94310d1", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484509, "uuid": "670643e5-93fb-425d-be63-8e2f845f7d8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484509, "uuid": "614fbd9a-4100-4f55-bfaa-af8510c021ba", "value": "Josho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3fb572-3b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776555447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555447, "uuid": "853cd8f4-0bbb-4884-acd0-c0e6eba034b1", "comment": "Malware payload", "value": "53b4116cef2ae2bf6ca9c7ea78b6bbb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555447, "uuid": "7ba93661-b8e2-4743-b600-ce40beb6b421", "comment": "Malware payload", "value": "142118e2dff0b1589ace9e9eb3510fae2f47b46dd1a63426c15e1397752dce81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555447, "uuid": "ccffc2fb-a9dd-49e9-b853-83db0d3d6a24", "comment": "Malware payload", "value": "c6c2c1de97c924bbbce611d94d12785346511b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555447, "uuid": "6257cd51-f79c-46a4-b559-552cc2b0dcd6", "comment": "Malware payload", "value": "b682c6c893132a5411ee9de8ede1408911136857f98929a5f2ff7d330095f24e219047d37f60dec76bb1f721a9349ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555447, "uuid": "dd4adc42-ce83-4936-a1a9-e45ca4ca866b", "value": "T16CB65C05AD842BA7C46C4E7444EFC9A222705D140AF2466665A4FFEDBCBB2387F578CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555447, "uuid": "aad573a6-3338-4124-a011-6b681196299a", "value": "98304:Wusui99jCmbBIWvEkA1mLqLX3tZn+qtrgY2CxU:WWi/hBgHmLqLfn+wUYxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776555447, "uuid": "121d4481-c635-48c4-b2a1-9c7e08478b55", "value": 10934459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776555447, "uuid": "07574aa8-b8d6-4a54-9c64-d0b5659f8a4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555447, "uuid": "75854624-284c-4fc7-9763-d000f9ee6555", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878739cd-3b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776539543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539543, "uuid": "86061e40-60b3-4424-a9be-4c7bd6edb9a0", "comment": "Malware payload", "value": "bdae63ae121c993f98d02207918b9080", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539543, "uuid": "28aff774-a792-401c-9272-91feff4ea8ea", "comment": "Malware payload", "value": "14771ed8c3f663ed6998da9dd0733045509d32a9898d294a382c3f77026ccba5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539543, "uuid": "bead47ee-dcf0-4930-8b11-2152a61f3294", "comment": "Malware payload", "value": "17896aa35239b984bae1ae8681757754b0271ef6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539543, "uuid": "6b863e23-0b13-4f7a-91f6-2e13d6cb0044", "comment": "Malware payload", "value": "45ca16f715f33e20f4b63719d3613e4f946fcc173864766c90c6d130b154e8b2cdc2319b7d318875406a7dbc051eab2a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539543, "uuid": "3a007210-d911-4453-b8de-1a2ed139777b", "value": "T16914E01494490C90FF3735BE59A12759EEBF2EA0E04732BB84B40617B9B389796F0774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539543, "uuid": "0d48642b-39dd-4fe2-8b09-031cc6d669be", "value": "3072:P7zNBHtx89nlW8zQlwRTM84TFg8lvNEekRkPFyClHoXGX7VThHDDQ7F9o3zaGTg0:P7zNBHMyBRhMkPZlI2LfL3zaGE23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776539543, "uuid": "ccbaaa14-6ce3-40ed-83c1-58bbed9aceca", "value": 195757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776539543, "uuid": "2593ba86-b1aa-40be-98b6-1493dd48ecf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539543, "uuid": "3c24ae0c-91b3-439a-8714-557f2bb5f745", "value": "BambusFarmSchematica31.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db82e5a9-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527658, "uuid": "89f38be4-43e3-4e9f-b749-93d172438190", "comment": "Malware payload", "value": "9430391d1a5dfbd569aa3f4b4f29d62e", "object_relation": "md5", "Tag": [ { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527658, "uuid": "596bb158-dc3b-418d-b607-7acfd1e9bcb2", "comment": "Malware payload", "value": "14f0f6c88eae66521b0ef4fabf6542f44e0f63239e11b3be7f2d7e7a0aaebac8", "object_relation": "sha256", "Tag": [ { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527658, "uuid": "20be13c3-8f8a-4dae-8712-1d0d1a02c326", "comment": "Malware payload", "value": "82af43bda3d5ff85bf45e47337cc09053a5730de", "object_relation": "sha1", "Tag": [ { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527658, "uuid": "32ce608e-0bc6-4126-83e5-ed1fd8603d87", "comment": "Malware payload", "value": "01d506f2638dfbd26080a639e22e74e4eaf0b484b47a138286dba6c28d111d98a9221a9a648bfa945c3f0446d4a3702b", "object_relation": "sha3-384", "Tag": [ { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527658, "uuid": "f2e9cbbe-16af-4310-8ac0-fa7645b43243", "value": "T17D8733A81639030A117866200577F4F91B9381F4F9371CD1CAEB2864DD67ABB48FBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527658, "uuid": "1c800d55-f35d-414d-af48-92be165cf1c7", "value": "786432:BS+CWQRtXrMAbLJFHmXEXIHgNvV9Mwh6Hoo8KgaUxBLaHgbDtzAymmqtIHx:BSbWYAy9hmXua2vVGcu8KtUPuGzAxm7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527658, "uuid": "cfe50433-bd7b-42ba-a9ef-a1b91fd17331", "value": 38074573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527658, "uuid": "634c0318-ec73-43b3-9f30-6a8a43f87127", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527658, "uuid": "86dfd283-a5cc-4099-b5d8-bf7485d41e95", "value": "dingtalk_down2.5.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03777893-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545334, "uuid": "bd0b60a8-758a-4e8d-91a1-085f952af4d7", "comment": "Malware payload", "value": "5f079dcf5dff32cbd1aa6c646b1ae759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545334, "uuid": "bda58cc9-23d5-4f2e-8610-5f784645f671", "comment": "Malware payload", "value": "152fa9b5a1ce376477506c19d464c884aa76f79b19d9319c2d830799fdb73549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545334, "uuid": "88ed3726-deda-4f53-ba77-b346be5adde8", "comment": "Malware payload", "value": "6e5e0bad07ab030ff730954bc7f35a4c6c70416a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545334, "uuid": "f0a955f1-80de-4c55-9fa7-1da223a412d9", "comment": "Malware payload", "value": "b4308c2cdcafef603099284929696b7de11479ff92e8ed7e2c960d78748f7c99a0f4a4fd8aacbb45edaadb91ef261b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545334, "uuid": "f4d3faf0-c0b3-4524-9339-0977fdb4390d", "value": "T117D623ED519423E4E4C346C0B68F53CE35D0A51E46EC5C287ADB2C026B62D6F660EEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545334, "uuid": "a8322c0a-dca6-4442-bb51-5c0b20fab3b8", "value": "47c16f046b447b7c62c1f021caa6cf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545334, "uuid": "a90c626e-f7f1-40d5-b64c-40fe7cadf1e1", "value": "196608:gF2VZlwFvpI8WYa3MMfcjfayQb+/gGxJMNcg1l3pLCrrYml1RVhUj/8:LVTwFBIo7ayQElU53pLCPNlH7yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545334, "uuid": "7e400d2f-7e8a-4f96-83ed-34e6d85ca928", "value": 13787584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545334, "uuid": "0ceb2f5a-1a25-4212-961c-1f5c0df62f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545334, "uuid": "fdec48fb-d0c1-486d-8a66-a4b6a3735f3a", "value": "AetherixCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970a244c-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498767, "uuid": "09bcd69d-e3bd-4a01-98fb-75bed5f0d58d", "comment": "Malware payload (Mirai)", "value": "4acff461684bc0a9fba771fa1306b329", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498767, "uuid": "5e78e329-0966-43ac-a33a-9a2eda2f4472", "comment": "Malware payload (Mirai)", "value": "159fc2483680fe8ee6b169c60d0d040f4b134dabc57d7af5ba5a97a90d92aed1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498767, "uuid": "76fb3588-ec14-45ff-8ba3-cae85b879999", "comment": "Malware payload (Mirai)", "value": "e3b2a06ed97bb5b0163fce97e028653478dcddd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498767, "uuid": "316f2d88-c7fc-4e2d-82ac-5fc2c8310893", "comment": "Malware payload (Mirai)", "value": "d294b759531913f1afe2dae1fac73bb7a7a2c49551814f500b8465d5def7c2ffbce3a6f6da49685d30bc967acd335d67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498767, "uuid": "1fbb975a-2953-454a-98ba-92f75f2e4f62", "value": "T125A3B501FC906733DAD22FBBF36A82CE733596D86B973381962D19F05B85BE81979050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498767, "uuid": "00728eaa-0704-4128-b946-0b154ee19ca4", "value": "3072:lCgnryYPxkhJjh8hOVlMQaQg5huWHC/lOCaYejQAiSgcK+3Cgs+TMrPSbyCENvqY:ivUTR5H2mwcBQ4Kuoze9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498767, "uuid": "30a0caa4-39f1-4075-a125-500b12e17c93", "value": 106754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498767, "uuid": "22429b37-cce9-4b53-b4ea-29ad083c0574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498767, "uuid": "f3701b30-4a2f-4de7-b361-3babc8966758", "value": "Demon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e935544-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776499209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499209, "uuid": "ecb9668e-06a6-4d55-adeb-bbc13e710e30", "comment": "Malware payload (Gafgyt)", "value": "38492efd6a9d008c18c62d1f46513dae", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499209, "uuid": "4d9908f0-4dde-4315-ba5a-1ce8c95e4b7a", "comment": "Malware payload (Gafgyt)", "value": "15dd7f624978e4dd49fe4790e4411f2153bd71c7297a154ab430929630433b6e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499209, "uuid": "f40a9ae3-70a1-4a76-bd25-8d03bebbba3e", "comment": "Malware payload (Gafgyt)", "value": "63e58aa7e14a1f2c4260509be28b58c27387f266", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499209, "uuid": "f5ae00d6-bcda-4468-b80f-779c57e2c154", "comment": "Malware payload (Gafgyt)", "value": "002eab0ca2cf5a5166c3ecda56ed1e8d957e15f1c73ec2bd15741d32c56944606319fb76ae065b94725f5b5a8dda7276", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499209, "uuid": "14c13322-b976-49c3-a793-cbf15620b776", "value": "T1DCC3D641D8A06733E1E22F7AF76A85CE73221BE867973352852C6EF55BC5BEC1939010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499209, "uuid": "52183608-d38d-402a-be0f-86cbb7bc3c50", "value": "3072:Hudb3Snhk2P7a3rcf5Oln043XNwsUgFyVAjomHDD3L/iqjZdqpYCzoRYF5sQe5j/:OzpWnaATWEpnQbvem5QO/H7pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499209, "uuid": "548b2adb-291c-44c1-ad15-0291879c7a2c", "value": 127956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499209, "uuid": "a03b6800-d4d6-4b74-a1d8-6de1b775cb05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499209, "uuid": "cf76d409-8945-449b-afff-93229f4d7b8d", "value": "Demon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b706bc4-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477084, "uuid": "bd5c680b-586a-47c4-843d-d904410c6c02", "comment": "Malware payload (WeedHack)", "value": "385f8791f40f4c6c0a6110a8f63d0ccd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477084, "uuid": "7730a86c-8990-4b57-8dfe-54292d965854", "comment": "Malware payload (WeedHack)", "value": "16a083cb790108eb46f66ab7d71fa455f503e690689ad92387b5a1e519a4703d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477084, "uuid": "9c6cd68a-7e79-47bf-9961-6a488f344d5d", "comment": "Malware payload (WeedHack)", "value": "c7f692ca88f783d16057353f2216f74b2163f1c3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477084, "uuid": "c4ef2e2a-d13c-4faf-8eee-187bb4bc74b8", "comment": "Malware payload (WeedHack)", "value": "0dd53b63c08c6792c54ba7e43ede6408d33f2489ffd325bdf0ccaa20b26ee32258bed9321695baead311bdbaf58be82d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477084, "uuid": "dc935e75-86eb-4ab5-9add-66f16cd1fc4e", "value": "T1294302B766296A16E5234B3172B9F9F0748C27F8D0817253B4F1465740AB1EE2F4E31A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477084, "uuid": "b4a1feb0-d489-4d66-b4ae-5d89fbe254c0", "value": "768:3G9nESdVVE7h3r28fNeRqwjku/+4nMw0s+fNB7ETZ9v6z8g6IKN7NuPKYQAa/8FV:PSdS/VBu/+4nL0RfNB7EPRg6tX58B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477084, "uuid": "add44b91-b894-4fa2-bd5f-71ac899421b3", "value": 56353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477084, "uuid": "96d08bc9-01ed-45e5-8ead-0d381ab5bb61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477084, "uuid": "9d34a3f3-3b4e-4590-9270-41931056070b", "value": "TaunahiCracked-4.0-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430b28e4-3b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776511511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511511, "uuid": "b5843eb5-9f2d-41dc-bb1f-d5a414dae51c", "comment": "Malware payload (Mirai)", "value": "81fcfd87e64cedacb49a108d1a07fabb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511511, "uuid": "690a15c3-f67a-4b96-9e35-5d798e1d95a1", "comment": "Malware payload (Mirai)", "value": "16aca11323d8bb11a76352e9385a808925492c0e06d4fa9b240f4a130e1e85c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511511, "uuid": "738b59ab-e983-4b8b-a351-b960a96db71d", "comment": "Malware payload (Mirai)", "value": "479103522683f36facc3a5980b49284f945e3c11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511511, "uuid": "b9c2e4d0-01b1-4ee2-83b2-159075059452", "comment": "Malware payload (Mirai)", "value": "1d2111ee1cea9f78dbbda8a85e1875044452117ac57f09ad53ae59ab5a8cbb4031ba2a91b4cd0c9dbb625550d106c210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511511, "uuid": "d4bcf7e6-1d03-4d1b-8d95-37d5d71221e6", "value": "T1F3F2F1B06E012C40CB7198B3D73A8B9F3CF24FFCE664763A45819E75258B76009F81A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511511, "uuid": "a48c9c03-9332-479f-a2f7-921becb94916", "value": "768:82Be3pOEOANAc/HRfanFNhBRstOtg57c+cfRYOpqs3Uozis:8weX2mHInpBjtgW+UYOpnzis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776511511, "uuid": "974c0c1b-7307-4f5c-8e0e-3bc53f53fe2e", "value": 35916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776511511, "uuid": "b9fe87ed-328c-4412-8896-57ccc59f3314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511511, "uuid": "20096d18-78bd-43a1-b1c6-e2b499058a0b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e99a3c-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527033, "uuid": "b4101afa-ef31-4b55-b72b-dc167a776af4", "comment": "Malware payload", "value": "3b1e991602c429b4a45024af88f1526e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527033, "uuid": "bfe39952-181b-4f7a-85dc-eab062dcfe02", "comment": "Malware payload", "value": "16fb0f249ea6629bd5371c4b3cc3eee0e9e91605f1fcc8aa1d206e57367c6aa8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527033, "uuid": "a9257db1-1f02-489b-9ca1-c6990373e069", "comment": "Malware payload", "value": "c7efb8667b7cafeab6b26b94f36c7df870ed3c2e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527033, "uuid": "10e7631d-196f-4c52-936d-5df5256e971f", "comment": "Malware payload", "value": "9e24de00c8b706c05511c0ecaf86842507e5d94a5912c83fba2e4271d62a5f7f4ffe74f07eb5ae2ad114b12f5d3cac87", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527033, "uuid": "f0d40634-7c9d-407b-a8a2-801b28bb81b0", "value": "T1122633D6E51F9633D48782FFE52F0AA2B0C028CE505760BA7EC567A3216B8C5F785706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527033, "uuid": "3d2b386a-aff3-47a6-8c17-39896549bce2", "value": "98304:/7SPwXm3KMMyLbPn9ExF7/sr3XZk2k6GNAwbrupLggtRBr+Fk:/xW6a/9E/7UrHZw/AwbruPt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527033, "uuid": "7a71cdb9-5102-4b2a-b994-47c32a9741e0", "value": 4600922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527033, "uuid": "c0631d2d-d243-4e59-9249-b1efb612dd5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527033, "uuid": "0082450d-da96-4568-8b16-d6c90093c02a", "value": "Noxx-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec604504-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537135, "uuid": "734fc5ef-8c99-4eb4-ba05-f9730e1224b2", "comment": "Malware payload", "value": "725920e4c5294245c9232bd2f6b23515", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537135, "uuid": "863ccfc2-fdb5-4e07-b863-bab60ee89129", "comment": "Malware payload", "value": "170083159d04f601af55599dd45f20fb3bed52282dbdaa66c0889402c5f0943e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537135, "uuid": "10748c2e-4f92-429f-a67d-405cf2e6c7ca", "comment": "Malware payload", "value": "d11e193a6dfcaaaf925c08d9b22927b9b1ac4bc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537135, "uuid": "8ef736a3-149c-45e3-8a39-0fecc8ad480f", "comment": "Malware payload", "value": "3590694f405857567326c2bd6b322948d7da8dc6690a41d884349fedf0144e6afa7a196f6961785c513e8e36946d28fa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537135, "uuid": "722f3b33-75b4-4ee3-bdc2-db98e9d61d09", "value": "T1A426F125D65E0032F813FB33D042B5E038FFEE91660BF0667A69159E486AE81C77E716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537135, "uuid": "b78f1392-c670-4acb-ac7b-bd98d5a4fa14", "value": "98304:31x2SKrN6PM0qTR8kOcBXl3ahWiem9Ls5IRTKX54F0X:Fx2Dgb9y73ahnFlZRTKJ4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537135, "uuid": "c2571a06-f21f-4a9f-b901-4eb298ca5e78", "value": 4770181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537135, "uuid": "955a9a7d-fa26-4ccd-ac8d-7d87c07bc53d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537135, "uuid": "05cf4b1e-d6db-47a7-acfb-b16dc6ee85c1", "value": "Meteor_Client-1.21.11-80.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b26319-3b53-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776536374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536374, "uuid": "842f8af6-7f3a-4cd6-8b8b-39e24446f85e", "comment": "Malware payload (ChromElevator)", "value": "10a58ae0c1c5fa8e532096955fe7ca36", "object_relation": "md5", "Tag": [ { "name": "CaptureScreen", "colour": "#AA35ED", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536374, "uuid": "bf925a9e-feec-4f47-81a8-341f642485c7", "comment": "Malware payload (ChromElevator)", "value": "17655c00200dc2a50e1ff42db5982582c98afe381710716d5048e8306829b0e2", "object_relation": "sha256", "Tag": [ { "name": "CaptureScreen", "colour": "#AA35ED", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536374, "uuid": "c58fb178-efec-4fb6-b956-722e377e60d0", "comment": "Malware payload (ChromElevator)", "value": "6d11f9b3e26742ece96f1f28cd941b113738f138", "object_relation": "sha1", "Tag": [ { "name": "CaptureScreen", "colour": "#AA35ED", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536374, "uuid": "0ecdb4b0-fbd3-403d-be2c-b20190f61bdd", "comment": "Malware payload (ChromElevator)", "value": "c569b4adc708edc987fc300744e5f3b55d33dca0b113485ce417e1216057fa68dd58b2d478db1173a7d29d7f0832092d", "object_relation": "sha3-384", "Tag": [ { "name": "CaptureScreen", "colour": "#AA35ED", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536374, "uuid": "e32b1c8c-c961-4ea9-b956-e7a4e58d2fe5", "value": "T1D0A79D0773E601A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE45A3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536374, "uuid": "70c8eb9b-568a-44ad-9ac3-be9561f7d033", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536374, "uuid": "373ab6c8-915c-4438-b8f2-662d729f5f8e", "value": "393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfG:sMguj8Q4VfvyqFTrYs/WyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536374, "uuid": "ac6e16f4-ec5f-4c70-bb25-6377fe9958c8", "value": 46860235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536374, "uuid": "a65fc939-0294-4391-bfb7-50edfebd0dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536374, "uuid": "7eb80e33-768a-4f23-aed6-da05e30de329", "value": "HydraInstaller7.5.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0983494-3b3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776526297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526297, "uuid": "66f57f72-9e8d-4970-8c32-8398d843918b", "comment": "Malware payload", "value": "08220b352fe3ab4a55f1d36ff5c47036", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526297, "uuid": "77e595a5-a90c-45ff-a1f0-083dd0168ffb", "comment": "Malware payload", "value": "1835ced5fb1f31cc82485b520220d7933c5361e037096cde76d9940a358b6b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526297, "uuid": "bbec7835-f3ba-4368-a728-31d706ac4a5e", "comment": "Malware payload", "value": "ce0fa81724f35fb41b44aa90fd2810646111dd4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526297, "uuid": "d7be09be-5673-4a89-8cc0-f1b5614397a0", "comment": "Malware payload", "value": "86747a12f65b533a2a596e66b1ff16e9e5c784f1cf8e72b25f71712185ab9814827f314c63874426517449fd646bdd0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526297, "uuid": "3eff4436-e5c0-4b92-be89-3b6cc1737a02", "value": "T1E927CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526297, "uuid": "ac0f1dbd-eefa-4617-8c82-bbf2335f9f3f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQH:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526297, "uuid": "ba5900c7-dfdc-458c-8e29-04cd8c1b5fb4", "value": 21200896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526297, "uuid": "f1bbb2d8-d8be-4c4b-b635-3cbd53f31f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526297, "uuid": "4c957cad-a3a5-420d-8f58-bbb1025dc16a", "value": "1835ced5fb1f31cc82485b520220d7933c5361e037096cde76d9940a358b6b58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ccce25-3b82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776556535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556535, "uuid": "94b6b087-2911-4b38-b1d9-78bbfc6cd490", "comment": "Malware payload", "value": "1260eb1adad1e1c54b2f9e9eed4a502b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556535, "uuid": "26aaf2fb-190e-4a18-9c85-e92ef94315c1", "comment": "Malware payload", "value": "1879beb6cacf5fa6198de417596bf2749b7fc60a2f7646eb7b51de090467182c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556535, "uuid": "a6aa1738-393e-4503-a30c-3a841316f79c", "comment": "Malware payload", "value": "41a61468d804353169276d72a0d9a3885f6838d9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556535, "uuid": "0f0772af-b807-4af8-bb5d-1842bb7fba69", "comment": "Malware payload", "value": "534825b6e2f2aa55725ed7d1e186b3b51806389a15dc1a8214c3cbb8128a11710c6f095918d86ba2f8dd560fb1f519cd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556535, "uuid": "4edd4fd4-4871-4594-89c6-1dec92f1c03d", "value": "T1CA141312C1068870DD4BBB79947633CEB4454E21D033BFFE68E3012B945DADA673E556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556535, "uuid": "8cb1831f-d0a2-4445-b1d4-e881f99ab9c3", "value": "6144:y4QvIQX6PjmYSQfIb1296f03IeiUoIkKZ3:UgQX6yYnIb1v03gI13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776556535, "uuid": "1c9784e0-dcb4-48db-9f6f-9eba207298c8", "value": 198631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776556535, "uuid": "c8063c9d-a8c8-4eb4-bdc4-a3ea1e6cc86a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556535, "uuid": "8b2e5cfa-1759-4c28-8da3-3b5d65399f79", "value": "GriftClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2ff847-3b7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776553246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553246, "uuid": "1deb223e-a89f-4753-ab82-798def4d4895", "comment": "Malware payload", "value": "228faee479ec0da795b0165505d484a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553246, "uuid": "1f195bd1-695c-4f0b-8ec7-277d1cbde229", "comment": "Malware payload", "value": "1a8ab48e1fc9a4a8f17d145470522061f0ba52b53821d67452f4345f9ef209f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553246, "uuid": "3d3e6bd4-8263-4ffa-b5b4-f424c64661f8", "comment": "Malware payload", "value": "03163f04d75dd8b7ca4381f09c9770b46a9d9622", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553246, "uuid": "810f503f-0f86-4f39-979e-00af55d2e092", "comment": "Malware payload", "value": "1d220be752ec13d1f8d851cfb841fbc2d0b175ed52320056774825db49969834c546a39e68e2350ceebfc0c8e1795bcb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553246, "uuid": "b6a9346d-7684-4d3d-9b26-3e324c0d4473", "value": "T10B136C6526953C25AE99883B5C7E2F0CB9A983E1304891DDBFCB3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553246, "uuid": "94c6e6c7-555a-4551-a465-b6d13fa2cc89", "value": "768:bMs9NyXsZztCg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bJHusZEcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776553246, "uuid": "175a8863-8148-44d7-a6d3-e58cbe3c878b", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776553246, "uuid": "82797859-db82-4cea-807a-09e53f2a518b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553246, "uuid": "bd5a00a6-3b54-4512-bbd5-8ee39b62c5a5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cefea7-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776499201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499201, "uuid": "4ce98c2b-b357-4b14-afd0-8656377c3c63", "comment": "Malware payload (Mirai)", "value": "a33888d3a7bdfab9284fb9d25b13083a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499201, "uuid": "0b17fed5-5576-4d0f-96bd-ff91e0d07909", "comment": "Malware payload (Mirai)", "value": "1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499201, "uuid": "a4a35de5-110e-4ebd-86e2-e65b8c951241", "comment": "Malware payload (Mirai)", "value": "64ceb3267e11b8f53d3fc91104f4761fb22a16ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499201, "uuid": "805cee82-a947-4656-82ec-c105b2014efc", "comment": "Malware payload (Mirai)", "value": "0f115e279bda13ece4eb643405f99d0598119dc781c74ddc774fc0ddefa3782ac40ec844519bbe5a0d7647620c5a681f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499201, "uuid": "ac0db5fd-4618-4308-b543-6d7ceaeb3476", "value": "T1B38308925785C5F7D0431BB706975FB50B2AF83A0DBAEE41F36CBCB48A610A4713AB14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499201, "uuid": "b59f9367-4285-4027-8f3b-28f36c43046f", "value": "1536:eNXQrUwQvIfGAAz9vCd6aJxprGhVFBfxBq4rwmFHg2OZIf5jr8y:eNiU6eH9vS6ELrcLtUmtg2OZ85jr8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499201, "uuid": "45080c61-6dac-4ff9-bcca-a8b2e1f05211", "value": 85363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499201, "uuid": "4de285b2-91d8-463f-98fb-ba9f27a686fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499201, "uuid": "46b997a2-c377-40d1-89c4-cee53c16049d", "value": "Demon.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1585fb62-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492966, "uuid": "b364a4ce-9fd0-4481-8e50-ca39d25af3d1", "comment": "Malware payload (Mirai)", "value": "514874dd4c65d6e7c6e40d1496f23a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492966, "uuid": "bc629118-5529-4fa3-a69c-87dc8173bc4c", "comment": "Malware payload (Mirai)", "value": "1b8132c065284354b66eb8ba3762af1f29386d9ca09555dead7f975368029514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492966, "uuid": "b563e5c4-ab6e-498c-8314-fce806545459", "comment": "Malware payload (Mirai)", "value": "2438b1ca40d590b92ff2d146bdba1f51379cd1ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492966, "uuid": "349720dc-a1a8-426f-94f5-1c9573750b22", "comment": "Malware payload (Mirai)", "value": "1eafda82bc87f6a5d60619cbf88b6bac7ee1c7970bd3b5647956ac8a7e1cd8f6769265053843fe98477aa12da501a2c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492966, "uuid": "434f3773-d7cd-4ce3-aff6-c6b916d6f520", "value": "T17E732A17BA4080FEC899C43843BABA36DC7274FE1379725A17D8FE366D55E601E29C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492966, "uuid": "1115e1a9-d8c0-4e23-a8b1-d0fd1034daa7", "value": "1536:DeuIZobGRRINkGIb/+w4HnC+8l8Anzcf2:quIZzDIWGIf4HT8l8Azcf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492966, "uuid": "5972bf41-8e4e-4855-9a8f-073551b5339d", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492966, "uuid": "524064bb-af4b-4b94-b30d-5c757f76cdc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492966, "uuid": "c8b9cdec-0231-4ec3-b6a4-8421371cacbc", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b0a248-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776485720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485720, "uuid": "132a7588-10b5-4c88-a38c-71b03cd42d42", "comment": "Malware payload (Mirai)", "value": "f39e99d38148c67dea15a92f2175d455", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485720, "uuid": "ddc14fe8-a795-4a53-9e74-73136d4b8107", "comment": "Malware payload (Mirai)", "value": "1be48412c3715304339cec89f83046d83c79d248fd5ecd678ec93062e801a5c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485720, "uuid": "9024553e-c8a9-436c-96c9-03d8c8655f90", "comment": "Malware payload (Mirai)", "value": "73586f1015efd5caccfd279e6384faeeac59c075", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485720, "uuid": "452ec3aa-7e36-4e21-949a-80f31ff1958c", "comment": "Malware payload (Mirai)", "value": "e9f6e4c267a1299626602f240e62cdb680e90274e7ff5a3961c6e429791fff74d205630c7fe6b4e512c57e9ebae10a8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485720, "uuid": "4b8c666b-7b10-458d-9c8d-22aae74063af", "value": "T17C214CDE3CB86A34150FB9C4701E49087947CFD5A837CB88668C44B661C7D24FB66FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485720, "uuid": "6b4cebf2-c222-4925-b147-5ca34eb33b88", "value": "24:4zTNNIG07EKpa5K+F7tNfm71jlp0XgpHA:4zWEq8BP81jlp0wpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485720, "uuid": "6b74a95b-7450-4e6b-a872-d6cc7c4fcca4", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485720, "uuid": "ea61343b-6879-4cfe-87f7-b70fecd5f944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485720, "uuid": "6d982df7-c7e3-4b5f-82e5-d77a2e249086", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9fc0db-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476903, "uuid": "1d3af773-b53e-4b02-9513-6bc23565c44d", "comment": "Malware payload (Gafgyt)", "value": "53a98e584b66a45783b5a724a5ebd4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476903, "uuid": "fcbd5a82-91bc-49f0-9e6b-4cf6cf29c25d", "comment": "Malware payload (Gafgyt)", "value": "1cf27b83f6d0ab542fcaeeb61459cd172defcd1cfbeadf1a248f4b20e8178b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476903, "uuid": "dff428d7-2f4b-4dd7-811f-a3cb0b73b767", "comment": "Malware payload (Gafgyt)", "value": "a9379a9d497965bfeb0b30619eb4551a2032b64c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476903, "uuid": "03488cd4-70d4-450e-b0d2-0c6b47bf27a2", "comment": "Malware payload (Gafgyt)", "value": "67b273abef53efd8f42d251df7d6a0000900c872105459fb44218c31cb9d71256f1c991fb0a0228a49f00692b17a1c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476903, "uuid": "1fd4bd5e-380a-4f66-a70d-79606ba6549a", "value": "T1F2D33B05D8509767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1E3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476903, "uuid": "819baf69-59ef-41b0-8ab9-5609677a958c", "value": "3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6Xe45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEXR5hLE+3C3gmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476903, "uuid": "b9937d30-3782-469f-9395-7faa4ac04a0f", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476903, "uuid": "4da789f7-b7d9-463f-bb09-9c4892d5d042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476903, "uuid": "f525b1e9-633c-4c6e-a6a0-c794349ef0f0", "value": "arm61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b0a162-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527463, "uuid": "b47b47cf-4d0f-46cb-b256-c3ed5a952205", "comment": "Malware payload (Mirai)", "value": "95eacf3223c014a39392b5ae645dbc61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527463, "uuid": "facb409b-8d56-4a74-8726-01a4c3ee820d", "comment": "Malware payload (Mirai)", "value": "1e58c112130b1ae97966152d7776aa41094a69e5e1dddc300359fd1b7c83c684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527463, "uuid": "2e91e111-d428-4f08-aa10-3c4f5a98dbb6", "comment": "Malware payload (Mirai)", "value": "a4b07a542dd6e27a6bf6af181c570426fe3ac8d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527463, "uuid": "6838e1ca-c149-4f36-81e1-2ea8156cc29f", "comment": "Malware payload (Mirai)", "value": "547abef15bfff41693e21eaf4a76a8d0c3fe23cb52858fed6ae8f33e8378344f13cfdfd8d8eddb38fd9aaf3ec1d360f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527463, "uuid": "e86c8d9b-caa3-4c39-bff4-59befbdcb0a3", "value": "T1377302B22167DEA1E6B1843223473D597D32887A077462BEBC7CA76FB486E111C0C95F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527463, "uuid": "26ca0418-5e10-413d-a1ea-42a81cbc69b3", "value": "1536:V8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmRFzYoro:CzRnwP0bMQ2RijvDZZ1rYGhG13RFzYSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527463, "uuid": "c6e2089c-8b0f-4da8-9e5a-002da0535d92", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527463, "uuid": "e44430b3-1871-407e-9930-3f3c5488fbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527463, "uuid": "bf3c1d1a-61d5-4fcf-aba3-cd2322fd8b69", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae40ea4e-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534024, "uuid": "25d6fdbc-3795-4240-9a3c-d1eb12ed2328", "comment": "Malware payload", "value": "6a03dc19278f4871057d26f498b8d13d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534024, "uuid": "cb3726e2-5b70-427a-b337-1108a09289ca", "comment": "Malware payload", "value": "20b4052fcf15aa4c87bc630409fc6db457195fb0d04d96595cd878ec66a778d3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534024, "uuid": "a5a62edd-a065-4c9f-a866-f767632e89a8", "comment": "Malware payload", "value": "0c750d82779e5383f3856b70caf4b9c359c2176a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534024, "uuid": "99d24331-3342-4e4c-b28f-2d790cc584b8", "comment": "Malware payload", "value": "f0339c0d8931564db1e2b55b6d5677d5c124f593bfbf5b59e707284be9117a4e792525297826f42fde7c472aa998b0bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534024, "uuid": "79c5279a-5837-409f-a853-f8cabc3ed297", "value": "T1A6B2D022C0A3AA74D58FC438364F5C716CED1EE5808F3B5B81A95D3603595BA8738EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534024, "uuid": "2d5fb6eb-18fc-4fd8-9836-ad0d8b2fb728", "value": "768:FP9nvWfCTZJVSirdAhZv3VJbh/FHdVo4n:F5W6TZaiBI9htvoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534024, "uuid": "9f23ddff-3e55-4c18-81ef-60eba69846c5", "value": 25620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534024, "uuid": "d53464bf-36d1-440c-b433-487482eddff2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534024, "uuid": "248137fa-a7cf-47f4-92e0-8e8c4bbd6da9", "value": "LifestealClientSided-1.21-1.21.11-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ca6b12-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494176, "uuid": "aa6b114c-8930-4e1a-8bdf-acd8d676db42", "comment": "Malware payload (Mirai)", "value": "e279329aa83c61c79e1c16209d3a5d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494176, "uuid": "dbee428f-1048-4525-932d-ab274fb6f8ed", "comment": "Malware payload (Mirai)", "value": "20dab8f45c894c09b7f9c8dc834e9db2138e77f46d7ff7acc0173be9b954d3b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494176, "uuid": "66d5f8a7-0135-4706-a757-b3399579987b", "comment": "Malware payload (Mirai)", "value": "f6d2e13a8a5ab0dbf416aacc4f19f4add2740e9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494176, "uuid": "764fa2cf-a217-456e-b235-17e0b4a07b66", "comment": "Malware payload (Mirai)", "value": "80cd930c7f874298de2b8a1388bc51bcca43c0339e1cc0c2a6bba43f8c68b73e335ce6a672d1301164577edcaeff18db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494176, "uuid": "ab66786d-f040-4bf0-8801-7228d80967f0", "value": "T156B2DF3471E9A0F0CD316035F87DC987ABDA41FD90FD3722216660E85E9A98D29EC6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494176, "uuid": "9e2e6012-d888-4b7e-85de-e3cce9826e2a", "value": "384:joBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1/CDhymdGUopb:7aNSq5sOHpTqncvsdDePiAUgefoeDeXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494176, "uuid": "681698f1-f3ea-442e-917d-d1e781fb21d7", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494176, "uuid": "284d7ae9-df82-4ea1-be47-73200d1caee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494176, "uuid": "ad1e3325-0930-41dd-8ae9-1941171c6ef3", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2eb71a-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527469, "uuid": "6517d8a5-76d0-4d5b-b0ec-b181a4741c9b", "comment": "Malware payload (Mirai)", "value": "d1d9087c16fe36784ce8223c68506a25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527469, "uuid": "05a6b4c1-8c11-4686-bb6e-317188f84aa6", "comment": "Malware payload (Mirai)", "value": "2142ace932912354fb84da2972608de6182b99614f39735e362ab10aa9625d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527469, "uuid": "28d68891-0808-473f-a01b-ca7479d06da1", "comment": "Malware payload (Mirai)", "value": "e6e122d32ab23a2567bde3dd37a090458cc04113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527469, "uuid": "1246239d-7124-4437-a159-2473717fdd6e", "comment": "Malware payload (Mirai)", "value": "97fcf3379c77a48353b2a20cc78cd9965d0b51fc02b53e0b96a22d040828c7c4fefbc8ca94500c143be06e29c57dd02b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527469, "uuid": "bfd416d0-5d6e-42d1-bc81-935267faa07b", "value": "T1645302415A6CE83BCAE2D53C0F7801E546985DF464D7401F43CD7DF88A06978BA9CAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527469, "uuid": "8fba4428-fd0b-4ba9-80aa-b242a9578676", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VVRAQu:MaHJgMo8FwOA4zUFGUO3UhbYQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527469, "uuid": "b221edbb-e260-46e8-b529-beefd7b4e3b8", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527469, "uuid": "d44486e6-3c7e-4a19-9422-81d2d07b681c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527469, "uuid": "b9b2178d-c583-49bf-a23c-71cf778f0b74", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49af540-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476912, "uuid": "ff1a22ff-5adb-406f-9b26-f532e747918e", "comment": "Malware payload (WeedHack)", "value": "25283804a503db79cf74403fe5396561", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476912, "uuid": "13e25100-1878-46f4-b88c-cc520e57b90d", "comment": "Malware payload (WeedHack)", "value": "2176c3a1af471458d59e719fe07c1fd2b774f5af0c179b5aac44e499e08f9444", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476912, "uuid": "99c882ad-8797-4dc0-8c5c-76d5a8f6b966", "comment": "Malware payload (WeedHack)", "value": "570a377b7f669592836c969294858499799eed47", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476912, "uuid": "cf05ec2f-0427-4194-8c9b-027741974f63", "comment": "Malware payload (WeedHack)", "value": "a822089be5cc11b35ff19776509b13fc5c99d2c333d8693a1c1fcabb4fdfc05f8843fd78a15d2f96422c26df03df317d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476912, "uuid": "33fa4fd4-414e-4d99-8302-7a97ca80bbcd", "value": "T1652402A3D3250876FF1E0D3E9032B1429E3E3554A56AF6BA25FD38038656AFE5346360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476912, "uuid": "d3b7a5b9-194d-4e83-a88c-96ee468209e6", "value": "6144:PWQIiv8cyp85QLdjIeM34LM8aHPf9TT5juDC3J5:PIcyq5QLDMILM8ofVT5juWZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476912, "uuid": "91c0999c-99d3-480e-86d7-69eb3944bace", "value": 218630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476912, "uuid": "faafa336-ad2d-4001-98f5-9fe3a2805d7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476912, "uuid": "c8ee9341-3d0e-4b68-a19f-7b6ba6ee179f", "value": "Bambus farm Modded Schematica.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b176bd79-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476907, "uuid": "b52a8ff9-0c12-483b-997c-7d1e4305b820", "comment": "Malware payload (Gafgyt)", "value": "16363d24158c9ab3a394c518023a62b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476907, "uuid": "9c0e1b68-497c-4205-8c6c-b4d70399856e", "comment": "Malware payload (Gafgyt)", "value": "2225e62d389c91d864b1674419559a3336fd05af76020f4bf1b1d8b2707146f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476907, "uuid": "24fd125e-73ec-4972-8510-679d962a051c", "comment": "Malware payload (Gafgyt)", "value": "c3f181e0e5d64c82f684b2ce304da80835e87fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476907, "uuid": "821ef8de-0eae-4d89-a563-33ae9da01019", "comment": "Malware payload (Gafgyt)", "value": "197ad82b814a7f2ac61db612a0a2d856f8cab154860640f923777ace28ddd1b6a89574ddd717488f0fef23a6022614d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476907, "uuid": "06f01069-822c-4eb4-a552-f75884b55c34", "value": "T163A34A82A780D5B3D1A306F6129B8B150133FB3F4A6B9DA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476907, "uuid": "20477d40-575b-4a6e-9956-73e7449ff1e6", "value": "3072:Jg4eodUWUh917j8mc2deiPUDAZURyPfb5hQTSvxinf0OzTyoQQub:JdRu917j8mc2H5Z5Pj5h8cxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476907, "uuid": "09732d3d-39fa-4066-9d3d-f449fc376b44", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476907, "uuid": "886f138f-9787-4c78-9c41-144fe2141147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476907, "uuid": "e2a1baf4-3887-4b84-9974-3bc8c13445ca", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4102552-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545604, "uuid": "da61f856-40e1-44d6-8bd8-e45e05cf46dd", "comment": "Malware payload", "value": "b70945d0eedae09826bac58ab789c1f6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545604, "uuid": "fe4c9000-0858-4142-9350-d8237850733b", "comment": "Malware payload", "value": "2261dc85e58006264338edd141fdc8d208e903814be5253b0414610614a6e4ba", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545604, "uuid": "2a17e6e9-4dcd-4154-af55-e6532712e65f", "comment": "Malware payload", "value": "b5717d7fe6ff10038e9fb8f71c3c3265cea7930d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545604, "uuid": "ffba252b-fbec-4dc0-ab82-17048e07872d", "comment": "Malware payload", "value": "9014f83d506482ca490e0bad19906f4e26f5b116711497f0183829caaf11b182924d55fa511c15355086b6d96f439b6a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545604, "uuid": "29c11bdd-dcfd-45c1-a0d7-0218d93efdac", "value": "T1EAB2D195930FEF30E5DAEDB009CE1A90397847D8F25FB892B1E6CC83217729D8789165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545604, "uuid": "3f38839a-b95f-48d3-a00b-21c774d212fe", "value": "768:3y9nxLEJzGYs51h/F+A7oYiUPSh76yh6R15R:3YF53oA7JPShMxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545604, "uuid": "10c0dd12-a74c-4721-b56c-e6ed32c9e2a3", "value": 25520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545604, "uuid": "3bdec1c5-9c0b-40aa-8e71-d009aade8974", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545604, "uuid": "ab74b78b-4617-4ade-991c-f47f36e5c4ba", "value": "kryptoncracked-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7146ab7-3ac7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476567, "uuid": "139beded-d9b9-4d1b-bee1-0d34c2df495f", "comment": "Malware payload (Gafgyt)", "value": "5327d651e2908ad9e8535a7e920dd098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476567, "uuid": "fb9926b6-57a6-4963-b44d-0e5a02175e3b", "comment": "Malware payload (Gafgyt)", "value": "237baa9e4af13c1326f7421d474401b06d836c7337b76b222d8676655392881e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476567, "uuid": "9d10e738-7f98-464a-8a08-1231a6e038f1", "comment": "Malware payload (Gafgyt)", "value": "3ccb7d535eedf8aa032b1f599b7f893fc3d9ec8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476567, "uuid": "6062de3c-0ff9-4dcc-9d3d-0c9c34c9163f", "comment": "Malware payload (Gafgyt)", "value": "47dc78742e8f81e3c6dde78f3ef46adb37e2585ce26856233edaa52b62244d81261b5f8de0524f4308c3571e603ef19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476567, "uuid": "d568c88d-b4e9-408a-bb1d-2a445ce14083", "value": "T173A35B82D642C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476567, "uuid": "a1dd29bd-1469-4d86-8aeb-563fd69bf0b4", "value": "3072:aPaqjPQP39VjGWX98732V7kGyNVe5heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NVe5h+0FXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476567, "uuid": "04b9ae8f-f78c-41cc-a885-1623988a45ff", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476567, "uuid": "aafce118-2814-42c4-9ee2-93b1626012cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476567, "uuid": "3606acde-26d8-4a6b-b676-b91a0bb9935a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d955d9-3b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776506474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506474, "uuid": "854ce9d1-d1ab-4958-8ed5-dce346868ea0", "comment": "Malware payload (NetSupport)", "value": "4e361cf64befdb54e47c25ed89c35402", "object_relation": "md5", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506474, "uuid": "03c29725-5cc2-4c34-9df7-ee81620c777f", "comment": "Malware payload (NetSupport)", "value": "23bdeee8dd5d030c1d58ae4c1eb8b40e4038df2d6fdf0502f330e584255d62a7", "object_relation": "sha256", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506474, "uuid": "144ea1fb-aee9-44d3-87a1-cb509188563c", "comment": "Malware payload (NetSupport)", "value": "d5ffd744addbd910197f891692506aeef3b9b769", "object_relation": "sha1", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506474, "uuid": "91d7a882-a1d5-46ff-8540-953f69ced08b", "comment": "Malware payload (NetSupport)", "value": "e498fe5d3d5f2d56a06aa54ba4f8c454251ae7fd8a869024f78a11883fc40c607731e51462c522b566330d957c607d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506474, "uuid": "202e59de-be30-4516-9a84-5cb7b36f1b5b", "value": "T16D129E1ED7CC4C82D0ABF5795B908215C93BEAD806E600150AFD63DA7782EF7A235334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506474, "uuid": "8c48d7b1-2b47-48b2-8077-8cd398402019", "value": "192:bNkRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+5:JkRm/wksuQJ/g6dI+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776506474, "uuid": "8e9aa4a8-0684-4c5f-98be-36a9a029dced", "value": 9033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776506474, "uuid": "73a29216-19b8-4093-96d4-866faed36ce1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506474, "uuid": "0e0a7e34-7e9a-4e9f-b009-ee29a89eed91", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ed1b61-3b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505848, "uuid": "697b8d78-3f9f-440c-8121-4189aeb70898", "comment": "Malware payload (NetSupport)", "value": "96491e8917ec90fcafb9c79a6341e305", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505848, "uuid": "c9564e77-7389-414a-8224-b85a14e682af", "comment": "Malware payload (NetSupport)", "value": "2438de4fb268d6333fce4f53a0d48a73f51b0a68081f626d8b1011cf973b2b80", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505848, "uuid": "5842d0b3-898c-45a1-9817-fc211c67c628", "comment": "Malware payload (NetSupport)", "value": "8bbcc569307b0d862846d88fff639b408a939488", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505848, "uuid": "b47fe9ad-2960-4193-bd58-fceeea8ab37b", "comment": "Malware payload (NetSupport)", "value": "dc27e263deb3ff197327cdebbcd26b0af2b92529af06446037a52e88d0cce4356c2e61430b5a1d41640cc56c71509bcb", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505848, "uuid": "6e07e53e-7f97-440b-83dd-7381f4417eab", "value": "T1F0129E0DD7844CC3D1AFE6762BD08115CA7AD7C846E7044A1AF923C5BB82EF7A621374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505848, "uuid": "fe8e0fe9-983e-4d8a-84b7-3b2b678464ab", "value": "192:HRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+SNb:HRm/wksuQJ/g6dI+SNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505848, "uuid": "0882f143-84fa-4178-a0c9-3aefcf680ced", "value": 9026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505848, "uuid": "ed680220-a2d8-4354-ac29-2f6d9262d624", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505848, "uuid": "a14dd615-7ab6-4e21-bdd2-6c73bfd57365", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68e32c-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533969, "uuid": "11a517b9-7c22-4080-9b4f-3a917eca8450", "comment": "Malware payload", "value": "bcb51c9fe28941c02ea7b80f9882f8ff", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533969, "uuid": "f89e4ec7-426d-4d7d-a4a1-ae3bd706d4a8", "comment": "Malware payload", "value": "2478a34372a9353bd3c56389bc5ca70522514998a66619f89f0ac0a0b50503d7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533969, "uuid": "5c16e72e-a603-4512-b123-ad67b6395f53", "comment": "Malware payload", "value": "94f241dc785950e11fac24fe57abf5f4a1f54f5f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533969, "uuid": "99f89ecf-dcc5-4e2f-8d59-03372336cac9", "comment": "Malware payload", "value": "d4a805404f117b5e32c0829f3258dcc7194e9046ac38eb24842af7a5449dfe0ec449771587628621a7a3f31fe6e2e28e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533969, "uuid": "b4f34610-713f-4ceb-b603-08adb3d1035e", "value": "T158B2D02956BCC932F15F59BE7444FEB92DBE8A3891C72A3702540837061AB3ADE08536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533969, "uuid": "832cb72b-b0a3-4330-a6f1-fd35d65ceec8", "value": "768:n9nBskDHPKELv1zyi3s61WvLDpvbjORRX3SPEY7cgr:vVyiuLDpvfgX3KzcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533969, "uuid": "7a4cef27-8db3-4d84-a995-9ea3d331aa00", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533969, "uuid": "ca731d1d-0def-4bde-bb47-9d346721db83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533969, "uuid": "b0b801fa-5113-479b-88ec-6580949448ea", "value": "2478a34372a9353bd3c56389bc5ca70522514998a66619f89f0ac0a0b50503d7.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de61df0-3b7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776554532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554532, "uuid": "353939b7-16e6-44ab-b39b-f01ca0113f25", "comment": "Malware payload", "value": "e59d559c26101a49b75f5c37a476a456", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554532, "uuid": "15a6a9e7-e112-46e8-8933-223ab44b8daa", "comment": "Malware payload", "value": "24833ba1f6617529bea2020b0d4d829505729cd390f874e37ea77f801aba69e1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554532, "uuid": "637b21e1-20c9-44a2-8c58-82095c82ecdd", "comment": "Malware payload", "value": "bdf00ac05bdba4389e9038f2eed33ac7d9594328", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554532, "uuid": "59fba291-b813-4fc0-884d-244721633db3", "comment": "Malware payload", "value": "347698ce971b2882e3e9ed3bf4946ea70d838d928b0a59d85d7219012d6b449695c553a7386a9123b30eb379a2953f45", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554532, "uuid": "66d677ca-88fe-4cbe-987f-e88bd85d7a0f", "value": "T12D04042C45CF05C415E2ADC88AEAE44BF762462E5D2CD585BB2DFBF01F125B8E0F61A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554532, "uuid": "d156734e-b3f1-444a-b7de-76c75f07353f", "value": "3072:2Zpanzk5Ofqa4QwZfq0ncpfqU75aTwBy8IXitbt+QvtU6fq3BRfqFJ7KfqgNfqtz:2ZpbOfqa4QwZfq0ncpfqU75uwBy8IXiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776554532, "uuid": "0d0383a6-2f1b-4066-8973-6d5d176de68e", "value": 184132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776554532, "uuid": "5e102ccb-eda4-4c30-b022-8a46feb76210", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554532, "uuid": "2856865f-3e3f-4679-9e3c-b0952db5562d", "value": "Record_Updated_v5.9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dca2810-3b80-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776555686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555686, "uuid": "aa901efb-376c-476a-8303-c5413c6e9034", "comment": "Malware payload (Mirai)", "value": "cd79807ee9d8f3c7918a68a1e247ebe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555686, "uuid": "09a09d8c-8386-447d-bc45-fcaf01add60c", "comment": "Malware payload (Mirai)", "value": "248a21666cb74702b7fb30a7f99409ba833354d41f56a6ebe5057ef01b769128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555686, "uuid": "8a3a5438-04cb-480c-9e75-fdea1388735d", "comment": "Malware payload (Mirai)", "value": "82e9483c73f0d986ebfd41d5bd53b0d4dbb619a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555686, "uuid": "7fd5fe1c-7dfc-43d5-b71a-910d849d45f1", "comment": "Malware payload (Mirai)", "value": "6f145e576423d0085bb018d30ffa71e066990f95e99fd6cf6d48a8fe80a3718f277866ecb4629f18c0812f134ae9d49f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555686, "uuid": "f07cc8c2-36b0-4b6a-bcee-12d267328ba7", "value": "T15CE24941BA93D5F6F88500B05877E7B29A7AE63D5074DB4BD728D636AC43701D20738E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555686, "uuid": "3cea4b1d-bb91-4bd5-a2de-4c3e305c0b1a", "value": "384:fXyStNtRbhaEMLaeOIJeT85xsGhcnl/1mUbtl69bYg5VJ5C0Drg7hxKwlxhTYNGR:qStBbharNXxKFPbPmYgx5CA07hxBlxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776555686, "uuid": "32314753-494c-4467-812c-ca012c2aba18", "value": 33952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776555686, "uuid": "e926ee21-e13c-4e66-93b7-6e40ecfb76bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555686, "uuid": "9814e72b-0f5f-4514-8e84-dfc36faae33f", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58954bee-3b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776511547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "593594c7-79ec-4879-a73a-828e543d711a", "comment": "Malware payload (Mirai)", "value": "3a0b26159b417c73c02515aa4fe23e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "eb30ae6f-f248-4d24-a67c-cebd89d94ec5", "comment": "Malware payload (Mirai)", "value": "24d105aa3ab0c1b53690129352abf3bee9dce44234333aa99064beeb897ef47c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "743dbaf1-699c-4c3a-b2b1-b7195bc91bb2", "comment": "Malware payload (Mirai)", "value": "de6ced9e7dfac34fcaaaac97fd08f05d78f21da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "9d4f4783-2e09-438d-8cdd-23c5d9312cf5", "comment": "Malware payload (Mirai)", "value": "7654ec2fe8a89c280dc6689b70e959f73c9bf87e03e1fab17e6a68278b1af10541476376a7dc016485741de89a086094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "56a50b66-1a9f-45cf-8607-50b3bf4bb660", "value": "T1E2444C45EA418A13C4D627BAF6DF02463333A764D3EB7206D9246FB4378779E4E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "1a58b746-a726-4030-b956-c3e6c64b8904", "value": "6144:VIenIS6ZAxYwiO0ajWQL5yZUPn3cWkm/PVfM/RGZ:V5nIzZHwiO0ajWQL5yZUvsVWVk/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776511547, "uuid": "9be4fb1b-c5ac-45c8-8606-0a6943ca3541", "value": 256224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776511547, "uuid": "f9004da2-2235-4da1-b840-42760562b9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "8e96b1a1-5dc6-41be-bd1a-9dc240338393", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2d8976-3b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776553242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553242, "uuid": "f1df80ca-4933-411f-8a2c-42752ad04859", "comment": "Malware payload (Mirai)", "value": "17f17009fb31907e9a84556aa16e0685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553242, "uuid": "fe40dfe9-40c0-4746-89e9-516e10c5a45b", "comment": "Malware payload (Mirai)", "value": "25773464acbf122c1fded1c1fb9f6ebf8db72c0839c49b37d234962682950771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553242, "uuid": "be55057a-dc6b-489d-be7b-17d8bf6cd44e", "comment": "Malware payload (Mirai)", "value": "3cfc018610b9a57cd7d3cb48ce2326381ec1c370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553242, "uuid": "6bc81db9-d79f-45a9-a086-f13c8d2c95b8", "comment": "Malware payload (Mirai)", "value": "dffad6e85294dbf9d62f8ceb64443eef0cfffc50f1b2d3baff1993547121bc852d028688a97f0a9eb0cbc891c92953d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553242, "uuid": "7477b28e-aa2e-4421-86b6-47b9d99cf5e5", "value": "T13F236B63C8392E48D15696B1B134CBB51367E851C14B1FBE2936C3B89893EDCF6863B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553242, "uuid": "3a92fbc5-c4bd-434e-acfd-aebbfb6740c8", "value": "768:c7gKJHr6/zejrvlZo1+UjNZKYsoCQQHK61UxaIXV3oVwfrG/fSxo7I:vKJL6/WbYjPmoCNK61UcIXVzy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776553242, "uuid": "2a64e05f-7cc7-4c47-bbd6-66813ac2f149", "value": 46548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776553242, "uuid": "5ccfffb5-c02c-404c-a95e-b4af539a4eb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553242, "uuid": "702d1e58-c946-4065-af42-a56b574819f3", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50148c1-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545739, "uuid": "c5b5bbb8-d083-4fba-9ebe-92cc52bc07f8", "comment": "Malware payload", "value": "2c91fb42f7eb22f7cf7e708efa809c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545739, "uuid": "2068fb2a-493e-4a51-8ba9-0f98e6196f0c", "comment": "Malware payload", "value": "261b53375269f57825b7b39a9411fc4d9a3b7a892cc7cce7a99951626c7eeec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545739, "uuid": "67378a43-2882-4af3-9467-8cc862f7c317", "comment": "Malware payload", "value": "745b2054c39efacf0b800b6e8ed5911c71a07f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545739, "uuid": "90cdfd3e-f50e-4270-86c5-286213c5a43f", "comment": "Malware payload", "value": "8c63a52550e6cf850a0891b18ec4db286b2365f74567356a448a59bf7b1f4bab920e1c04361b786d652f6f25dbfb83d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545739, "uuid": "bbc9a7f9-fadd-4f6f-b3d1-8c1c4aa5a7cd", "value": "T136857DC5CF55678CC09DB8BDCD2A394232054ED9C23AEB8605BA2FCF1AF955056387E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545739, "uuid": "df111e37-bd20-45f2-91f8-f149a1404624", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545739, "uuid": "9723f2d4-f428-4bab-9ef8-be6b8a2f58e8", "value": "24576:2eapBTPpDD8J5viRwpk7brtEJTNuKqRbjXWqWdtWh6ssGNqc3eO9TxECC1Fw3kwL:2pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545739, "uuid": "bcbf4186-d7db-4b92-8a33-b8d5cd42a3e5", "value": 1824904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545739, "uuid": "faf8eab2-fcf9-402c-876e-a385de4e074f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545739, "uuid": "b868b944-2b2d-4cf1-aab7-ddf475fd93f2", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf608cbc-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537059, "uuid": "8c870a1b-3937-4d2e-893c-62ff5bb79396", "comment": "Malware payload", "value": "76c76b57f912c8dd9ceb9c24e496f9cb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537059, "uuid": "014435ab-2410-4fd0-996f-d332b17d92b8", "comment": "Malware payload", "value": "266441bcff78111927fcf69e9fc88cc618326e8d956538490fad1d13a258ae0c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537059, "uuid": "e4cd9df6-fb8b-4431-851f-9bac912ae3d6", "comment": "Malware payload", "value": "e4e1b2bdd9a526f03661389133e82d91d744e3bc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537059, "uuid": "bcf35b05-2f9a-4274-8c55-0103e80f2a52", "comment": "Malware payload", "value": "f11f02b694cb726202ad27101392413b93e00c5cfe0dd3dd21467f774ed0126213656f5e1aa9f00bf13086f1414cd1b0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537059, "uuid": "a5af9cd9-db1b-4fa9-b8a0-6a3e900d90c1", "value": "T15A75332A4FDE122A3E181D01388FCBEABC875C71F8BD55D1393F112866A49B1BF54C51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537059, "uuid": "570b1a56-ac9c-4175-83b7-6ed587eb8a62", "value": "24576:pCNJ5FzuiACG9a8YJ7ntWLJlywPA6KxaJQU3heMsEZdPHUEdzkoj:A5psx48Y7nsjyIBKcQU3wMsEZF0ExLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537059, "uuid": "c1bb7826-b0b2-4d44-afbb-9f7be3cdfeb0", "value": 1562005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537059, "uuid": "49f1351e-606e-44b1-b885-3b3fb69e101f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537059, "uuid": "118c664d-c85f-48eb-bf51-bd179e2a8972", "value": "Example-1.0.01.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beffff6-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509324, "uuid": "3e4c4480-6d8a-4c03-8480-e5d0a80262ff", "comment": "Malware payload", "value": "83762efd3ff027bbe2b55e8e0bd125e4", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509324, "uuid": "b8b5bcc3-3d27-4309-af99-71670ee3e991", "comment": "Malware payload", "value": "2665f17b9c8aaacc035d827973d8424e2e43dc7f1cf92d5f7fca65b03a8b31a7", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509324, "uuid": "536c7c5f-d0d2-4629-808c-ceb0be01b6cd", "comment": "Malware payload", "value": "b74983bd8ed5eb3908e7766f7702c323aa4d9f70", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509324, "uuid": "d18eef1a-bbdf-4cf7-b367-04bcca701d52", "comment": "Malware payload", "value": "42dca2f7307d452ccfa9f6d362df19ee8fd0c3af44504fb3a2d50b9e5a6a17009ef29d1089789397e12271076596aff2", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509324, "uuid": "774f2f87-40cf-4600-809b-b848a367f58a", "value": "T16304302F884F46D497E77C14D5AA0E03EFB84227120DD5F9F75EFEA42F0295A82E9190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509324, "uuid": "05e36cc0-b936-4429-9389-6786d08a1561", "value": "768:5BhfcbVAAAUk/ak/Rk/Mk/8JAV2IiGnZD0gBUoMaGiry+xvxK1SSYA4SBWJg3sgX:5Bhvkt0gBUoMaGiry64RLgqhM+qKFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509324, "uuid": "f605b016-7c3a-4d6d-a2e1-fac2e361d4e7", "value": 186801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509324, "uuid": "e0d035d4-e8a6-40b7-91e7-28e10042d007", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509324, "uuid": "52548401-1a9f-4e33-89ce-3ccf01a70e19", "value": "Quantum_Document_Berlin_9940.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf62a583-3b09-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504847, "uuid": "fe0c99c3-b0f5-4adb-938a-90751572f126", "comment": "Malware payload (NetSupport)", "value": "3ae21c9b5ae68a09b878ca97ffde163a", "object_relation": "md5", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504847, "uuid": "01276f0c-f627-4e20-b65a-acac0a3e9ba2", "comment": "Malware payload (NetSupport)", "value": "267b0b1dc0a99f9f3918f24f626518d23dde5e0caf1128f128f7857906e3ebf5", "object_relation": "sha256", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504847, "uuid": "09ade110-32ca-4348-85b4-db3449367775", "comment": "Malware payload (NetSupport)", "value": "f57fae6ed5ac623eecc6ad59e153054b81d1deb7", "object_relation": "sha1", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504847, "uuid": "925f4df3-5931-4b5f-8aeb-35eea40bb30c", "comment": "Malware payload (NetSupport)", "value": "bb8c988e3f5eef9c210489fb7d8372bc1a311944331d082e65ba5c2e79e5eaafdf63ad36e9ad048e8894162d2aace221", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504847, "uuid": "391b9f12-aa02-42e0-a0e7-e37137978e99", "value": "T19BB012A081ADEB1E6C4A4F7D314E01143D00057E8170E8BA72F76500073010E971D126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504847, "uuid": "395dfc1b-0be3-4857-8115-a287d8a0bb52", "value": "3:VSJJFIGthT2NCdF1R1f/fvHkDWAlos2OqL/H:s8GLqu1DHfWWAqFOq7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504847, "uuid": "4c1bf818-058b-4625-a6a7-0c948143438c", "value": 101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504847, "uuid": "088a0bfe-d97b-4501-b009-19c842eb9397", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504847, "uuid": "4a4e0d24-18d9-4c16-a6db-482a9cff662d", "value": "267b0b1dc0a99f9f3918f24f626518d23dde5e0caf1128f128f7857906e3ebf5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c59f3b2-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537001, "uuid": "17f82c0a-0c68-494a-9cf5-868e99b14f2d", "comment": "Malware payload", "value": "db06e96be72031fa8758171e1f77549e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537001, "uuid": "390428a0-3fa6-4015-ab76-f9982dc43603", "comment": "Malware payload", "value": "26c933a8cd0b41065a9559a90a6c2e40da4b42e4d0e76a56dc9c7775ae6bc877", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537001, "uuid": "252d02c8-e359-4add-ba6d-792dd39d2b4e", "comment": "Malware payload", "value": "c5db4a5e9a117110c54ca1714bae88420b8bf17a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537001, "uuid": "551de4fd-9ad5-4576-ba31-0d00693fee9d", "comment": "Malware payload", "value": "93d0e6b4058fb7902b4ca6e0dd1350c109e8ff73b003e8447fc408327e4b7223f32f4fa3d1847417ef429c8e752ac4ee", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537001, "uuid": "5f10b2a9-2f55-40f6-b45b-0b54bc636828", "value": "T11AD3127F746CD12CD82E6FB5AD9238DB5EB92C4353ACB04E2177920849DB2E36581B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537001, "uuid": "148e57df-915f-45f6-b3d0-4a51844e4179", "value": "3072:eo46JCUFXtTQl7vpG6s8YdEDlOtrEJhesGe4oRDvT4q:j4EjXtT18YzrEwHGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537001, "uuid": "8480d9c1-e5a3-45cc-8b97-620bf8a0f933", "value": 138391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537001, "uuid": "da41a6bf-3795-4423-8f14-7e0501056b44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537001, "uuid": "1685166b-aeed-4f2e-83b6-adfce21c412d", "value": "4E_Cracked-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95fb14f-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494180, "uuid": "8da7cea0-59a0-48e0-8544-505ae804f8d1", "comment": "Malware payload (Mirai)", "value": "8118aa70c1de6f78e16026854af581f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494180, "uuid": "26f87801-8c63-40ca-8587-017e0905d6b6", "comment": "Malware payload (Mirai)", "value": "271df5ed45bb9b7d1ce8836dd0dae06861cf9eac654e5c3adaf27f79390a7072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494180, "uuid": "ad71e6ee-ec76-4766-8003-8d2a8b0bb295", "comment": "Malware payload (Mirai)", "value": "9053866704217d82b3fbd383555aec7151ea1144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494180, "uuid": "da5e4726-c9a4-43f7-9aba-6b4a225979b0", "comment": "Malware payload (Mirai)", "value": "e7b1dcf026af9aafb6128cc015f1fd72ad0e1491c38abed122d54146a736bb39d358f22d064af9941915a13cdbc70171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494180, "uuid": "e713c756-0a30-4574-b730-b5d0618eb6e3", "value": "T15B732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494180, "uuid": "d7c57a32-23e2-4833-994e-1433b2838ca3", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WN:927jqCt8v3GI/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494180, "uuid": "da8c44b2-6a11-493f-bf99-b01fdae49788", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494180, "uuid": "bace7f93-cd0c-4eef-984e-a4da016cddf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494180, "uuid": "2ffecae6-b90a-4415-9e25-e8b9ced92b20", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bffebd-3afd-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776499593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499593, "uuid": "01f9d26c-fd86-4796-a65b-a226400d4fa6", "comment": "Malware payload (LummaStealer)", "value": "5c132a0dbf043e324949e47d85d8a53e", "object_relation": "md5", "Tag": [ { "name": "85-11-161-198", "colour": "#81BE29", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499593, "uuid": "65a573f0-b278-41a0-9e16-ac092c080c24", "comment": "Malware payload (LummaStealer)", "value": "2762f3e0a56d62e70157c398626856befead49f0926ba921f478bb599f10e2f6", "object_relation": "sha256", "Tag": [ { "name": "85-11-161-198", "colour": "#81BE29", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499593, "uuid": "dffb0094-c329-45db-a5e1-c8085a5079e1", "comment": "Malware payload (LummaStealer)", "value": "c2a021ad266a40a0ebf01b431eb50126d8312c83", "object_relation": "sha1", "Tag": [ { "name": "85-11-161-198", "colour": "#81BE29", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499593, "uuid": "c1ef02bc-e68d-4725-8f95-557d90781ef9", "comment": "Malware payload (LummaStealer)", "value": "97ddce36c03ecd8d67229b18a91c2a9b0834e0f2ef31453634498f34cf8130caa96e4f0732528a5bf68ad9e0d501ff4e", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-161-198", "colour": "#81BE29", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499593, "uuid": "f2c2ac3f-8e70-4208-a2c8-7212dfd82ee6", "value": "T15A955911EEC754F6E907173319FB62AF2335A8090F36AA87DA407A7DF9B66D50832305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499593, "uuid": "5a9bdf55-f21f-4617-9e9a-e805f25578ea", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499593, "uuid": "1138e044-0004-41e5-8e5f-5baa79462f68", "value": "24576:hFmGn0hR9QyeTs7epLoRLGpDkGrfVregNqyNSE32qH1lvcat9uYnG+XOP:hFs3eHZUkLxbuYnRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499593, "uuid": "1cd255f4-4314-4e9f-8df4-b9db6a9196e4", "value": 1966296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499593, "uuid": "21671834-c4b1-45fe-aa07-081dfe128207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499593, "uuid": "60e876f5-4c88-405c-8426-78c247a5e0bd", "value": "jd7nsn8-exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c7d57a-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545637, "uuid": "06d6023d-4307-40e5-85e8-2c12c5fba58b", "comment": "Malware payload", "value": "7af2671b71084ef7ac48d1e4e17fb3a9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545637, "uuid": "70fd578a-99cb-45f0-beaa-4ea315c842bf", "comment": "Malware payload", "value": "276f03cba9b15d17eacfcc8cd721912ddd551d73327cbff0cfb2ed51701e8a33", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545637, "uuid": "876ec4a7-dec7-493c-841c-d395acd51f10", "comment": "Malware payload", "value": "74f4106b9bdfb79404bf713d3a4f629e019f1573", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545637, "uuid": "9c9e9451-e448-460a-a2ea-70a51f7a8aae", "comment": "Malware payload", "value": "d3f927102a488b89154723ba16f2771942830562437d7bfa4e3126c9bec9fec4be57198b11a8dafde9dcd49df5e799f7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545637, "uuid": "ebe260dd-8113-4c47-a8e1-542a99dbe848", "value": "T1BAD53331139EBC7BFE24A3CEF742ADE05AAF53854CD6259C45125A0E493EB38DB02716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545637, "uuid": "21f97162-5772-4bd0-8d11-631a63caeca9", "value": "49152:/RSiJy6bm23ACKQHc+Cc/WrdZyzRXlHbUheXlfJA/VUYbCvf3wdaO:/RSmFbmFCKh+CaWDaR17PGdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545637, "uuid": "695a7252-2e96-4c2d-b44b-322670e7b1fe", "value": 2840988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545637, "uuid": "f3fc8991-177d-461d-8f95-f00bb753eecb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545637, "uuid": "636ab57d-99c0-4038-9d25-f977b8259ef8", "value": "savagepvp-1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02351f16-3af1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494222, "uuid": "5b563265-d3fa-4e72-83ac-24f670bc420b", "comment": "Malware payload (Mirai)", "value": "e14d2bf6737228471e588bd67da18284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494222, "uuid": "422ee07c-469d-486c-ac23-36ef8e6353dc", "comment": "Malware payload (Mirai)", "value": "27eba3a25de0ce65c542b70d9463cbb922d8d2cce301fc64ea996f41c072fd47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494222, "uuid": "a8078069-b274-4d01-a9fd-608f70f9b162", "comment": "Malware payload (Mirai)", "value": "0838e9400ee55295988dcc00b7a1180987c0ff19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494222, "uuid": "31675b96-f693-4122-83c8-ccc0b95078be", "comment": "Malware payload (Mirai)", "value": "7fe669678ea8427bb9f399fbba34302b817f10e0c8ee017e45a885e670410383c9e8a70898fb2487a330ac46b108e0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494222, "uuid": "721f7c6a-159f-4dfb-a317-158cee4ad027", "value": "T16083C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E640BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494222, "uuid": "cb21eab2-84e5-4232-9ce8-65d91556d9fc", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAHUG:x/8RHTgMcJ0fmqJZOpkM/0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494222, "uuid": "f6fffc10-420c-4e13-83a0-56c017ce3f92", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494222, "uuid": "c16516f4-19e7-42bc-bf33-8d1ef481f3a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494222, "uuid": "e437745c-ecbf-4817-8f64-b4b89abf3f86", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7729de56-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530496, "uuid": "82d2cf7c-d617-4462-93bc-928b1d000287", "comment": "Malware payload", "value": "9e6a8e301d095223d9c1c8767dae17fa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530496, "uuid": "05c99596-0ed3-4424-813d-86d74b397b59", "comment": "Malware payload", "value": "28d4008115956553a84d1d618f565ea5f9206e039e6f7072643ae838e24039b9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530496, "uuid": "cb365cfd-05b0-4975-9b74-b0781ba65f6b", "comment": "Malware payload", "value": "92c99324bcb8458899c8339d43f0e9f1e75ba61a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530496, "uuid": "3170238e-e211-46e9-8ce4-f8eb1c231dce", "comment": "Malware payload", "value": "8267291728ee2c3af8b1f360d8e48892927c4089f8a47860d62c3540176ff17181dcf0d9011020af928e1ee5a54d90b4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530496, "uuid": "779fe792-c46f-4db2-9c84-3c6d3939a58c", "value": "T14135332EB78800554E9DE85E6567657104230B8A0B2C92F8DCBF8553C805AFAFECDCF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530496, "uuid": "f7038eff-7798-411a-ac23-9bd0a5038003", "value": "24576:AXEanYfCLnhCqN2dQkMt1Ce7Tojgx8Z6KG3zdx:famKnhr7kC1CegjOPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530496, "uuid": "3d17d119-a923-4b96-9de2-8a48eb2cf3f1", "value": 1060329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530496, "uuid": "6b8c1c77-b474-4da2-9d12-13e58be0571a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530496, "uuid": "1467a7b7-5bdd-4b62-a2cc-138f47390262", "value": "MOSSREGEARLEVIENDARRYLDONUTSMP.NET.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a279208-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545399, "uuid": "28108c17-05bc-4792-ab0c-c36395e2a1a9", "comment": "Malware payload", "value": "7c5a01ec677c40c1b856dd00971e6a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545399, "uuid": "3ba23ff4-634c-4694-8e01-eec68c2a9e1b", "comment": "Malware payload", "value": "2903963e0976d40b0a2dce3fdb9f95de1faae2929dad715492aa939c5a70bd69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545399, "uuid": "d5925e60-43eb-41fd-bec7-2ff7ff31fceb", "comment": "Malware payload", "value": "bcd88cfd120148ba7eef059304e12b5be50c7c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545399, "uuid": "b17b8592-54a2-460a-8469-3803757a76ae", "comment": "Malware payload", "value": "553535758db11a6759c51b70f96991b4e7125382335c00cd4b4bb593d8fff2b9bc6dd5f7b0ed4d6f5d97b257ea80dae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545399, "uuid": "55a8bf33-b230-432a-9a74-9be7db13e6fc", "value": "T194D623EC84C162F8D4D34600728A439970D1A64D85FD4C2A3ADB6D022B69DFF674EAF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545399, "uuid": "83ffc58b-4b18-4577-a3ea-9ce3e1aa682a", "value": "d009d11f3190fe6e254bda813f542262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545399, "uuid": "45907e55-8777-4c26-8df0-41f1640a9aae", "value": "196608:IKpYb6J3+Vxim6JtvluCuwhpUdut5q+G02Fwx8HiqmiuqUudsUCS:fpA2uVc/odwpUdbSWHlmRuKBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545399, "uuid": "87a13d07-0c6d-41fd-9f4c-76e79d632dfe", "value": 13038536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545399, "uuid": "545023ad-1431-42dc-9ed4-d10ddab756ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545399, "uuid": "2af95015-bd2b-4853-918f-1a8c95eb6379", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752601a2-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "135b2d36-8cba-4496-b8e8-2a3bce197adf", "comment": "Malware payload", "value": "a18422f44fc3ba8be5688340325c67ae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "0fdc5e27-4b01-4194-9807-942b2badad39", "comment": "Malware payload", "value": "29f0bb4d382e446a355e9fcaf43f3383ffe977db8aaf74fb110c6656dd7d9b6d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "920d1080-1878-44b1-96bd-8b5032808814", "comment": "Malware payload", "value": "fa2e837bbaaf34f034dc4b04f091eab621e97531", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "c675db2e-4e30-430a-8158-b58abe507f7e", "comment": "Malware payload", "value": "1e497703303c907a75bdb97de5d17fee5f408304659f7363f2937aaf348ffe6ee39925d1593de9322c92f0fe21592b40", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "6a5fe465-8075-4e88-84ed-ff8390c96ebe", "value": "T10B962307627F0B24EC0FE9F2C465963319AD3092E067707A64B82DC16D7B8F463BEA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "f9b18f2c-5074-4c1b-b8cf-2e464e9d46f2", "value": "196608:4uTALAUajHhCg/82T1UHJOCGWWUgXj8OM4BvPq:4LAFjHhCyT6HgC/EM2Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527056, "uuid": "6d10ad80-6155-4697-82dd-adbbe8725e78", "value": 9175507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527056, "uuid": "c04d497b-fd92-4bb6-8121-40dcb01b7610", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "511ee777-b271-44fd-8909-d34f1cc30808", "value": "Pulse+.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfd9453-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527472, "uuid": "57b149ba-cb02-43d1-ae2d-7e647bd64736", "comment": "Malware payload (Mirai)", "value": "3eb502cb4272a7e805ed62bc75b5657a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527472, "uuid": "ad2e9d1b-dfb4-4c05-bb67-c5ccddc4e2e9", "comment": "Malware payload (Mirai)", "value": "2ac4ef7a6ca610f5042e73c65d4fb5b8726320a6b3be83d72c0788368cbd1849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527472, "uuid": "20b3593c-efb1-40c7-b223-ba0af7bde47d", "comment": "Malware payload (Mirai)", "value": "d8a34c1afcaa922ba79b7234ca7a97f8ca9c6064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527472, "uuid": "a5de5092-b921-4c28-9b7d-8e1c4ff0653b", "comment": "Malware payload (Mirai)", "value": "75fa569d9b64d4a33c575f8a0e6070fce2861a1ea52775263a6c41f80398d5d453cbea506497d26c905a6e5956164dbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527472, "uuid": "c9729d1a-97d9-4710-8a09-1c54ec0ff4ce", "value": "T16A147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527472, "uuid": "97ce0a9b-0541-4704-a65b-1bd152bf713c", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR8UKG:IcY5JpMByVs9jSHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527472, "uuid": "bc7baf37-adf4-4c05-8991-c90f1ab577a2", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527472, "uuid": "1697f149-a554-4dff-b746-4d221293f642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527472, "uuid": "c967d64e-d2a7-4880-9113-3c40743a1f81", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969f0422-3b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776526683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526683, "uuid": "22980f4a-4045-47f1-89ea-da4848e54792", "comment": "Malware payload (Gafgyt)", "value": "775bab7512e16275ea4d89e12b91b2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526683, "uuid": "61333c9d-9f83-4dce-98d6-3a649a039a14", "comment": "Malware payload (Gafgyt)", "value": "2c8132cbc6d0578a67baee05b8e0a00db7d1a14f31e11608074fe8f7d9608c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526683, "uuid": "b26953ca-579f-4633-b408-42cb00a69509", "comment": "Malware payload (Gafgyt)", "value": "892f844bcac633fa80adda2a0f1b346bf523d7d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526683, "uuid": "28053ddc-224c-495f-a497-bd8a1b6bd245", "comment": "Malware payload (Gafgyt)", "value": "5480c8efc0ad763c6cd77eccaa8a0dfb9e81e3759d3e34e039314af4f86a61df7e9e99ece1697fda984cda9ef117a7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526683, "uuid": "addc8741-daca-43d3-a578-6b3248046323", "value": "T170A32926BD018F43C2C315F3BB9F47887B2667F9D2EF3243E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526683, "uuid": "55f5942b-105c-4fb4-bcc8-046adfefa06c", "value": "1536:HGuY5rm339swDBmti+dqFRBBYZF3C2or/OQrW+sbGI4q6yPx85hlpMVq:HGxoH9RNNf/YZLoRc/4rAy5hlpMVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526683, "uuid": "41e323ab-1867-4f63-9df0-1f0e2579a7ff", "value": 104276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526683, "uuid": "724135f9-1444-4d6b-907f-af876c210251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526683, "uuid": "ecf273ff-8847-4752-847e-4f66ff1e580b", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14195617-3af1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494252, "uuid": "f7ed5343-6d0e-48ae-877d-515c5ea1b1af", "comment": "Malware payload (Mirai)", "value": "3eaf24c92325c7aace1f1dec0eab3ddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494252, "uuid": "4e4517ae-4007-4719-a80f-b12d4430868c", "comment": "Malware payload (Mirai)", "value": "2dd817f836bed837d7f0ba54b3ef56a170f5c7e2a35ad9fde3b218c76264b1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494252, "uuid": "b504562e-a411-4851-8ced-cdd756697282", "comment": "Malware payload (Mirai)", "value": "c31571498a7c83ddd11ee2f7b631d37bbb0b7bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494252, "uuid": "4dead453-7ea6-4958-8cc7-29277ec589ad", "comment": "Malware payload (Mirai)", "value": "cf578c77dc54358728502cc5ebca8674cf81b091926fe9b3f63810757ff0810ff8157e24b45ad27718b32a99c123577f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494252, "uuid": "f9de4fe3-b175-4d8e-b354-92c7dd04c90e", "value": "T17F534C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494252, "uuid": "ac1acb85-d380-4ae4-a9b3-fa9bb665ea3f", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6i50:BET6Rq1gSmQ+LzDIiEbW/ogI9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494252, "uuid": "bc385b6f-3d71-4631-8347-871b983ebf30", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494252, "uuid": "9cc2581a-7e06-4ae8-8672-f016c3b94c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494252, "uuid": "53c1c068-baff-4295-8f1d-f1b760b79e50", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962cdc3c-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545580, "uuid": "3fa005e1-76ec-4909-8df0-43695a99d50a", "comment": "Malware payload", "value": "da9fc151083db112a1e0c34add2283b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545580, "uuid": "a19b6e85-b73d-4ec3-a9b1-b726e957761a", "comment": "Malware payload", "value": "2e4790dd0065904f006db00bc8252f6f3d46a76a87a83bd5e423c4c2c9cbd25a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545580, "uuid": "681e188d-e26a-4377-8cca-0cef309a4c8e", "comment": "Malware payload", "value": "d12b4afc385c626f9c4a840bb95a142d2d717dd1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545580, "uuid": "e8999617-52a3-460a-82aa-c4975347ef16", "comment": "Malware payload", "value": "8d49d03bfc5077631772b8d1905f7edd869503b5cc98e348631b25169e7011f2c671c3a9d3f0919323a4fcddcf64bfc2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545580, "uuid": "9af1b357-5422-4970-9c2a-2f289c8ea466", "value": "T190E4C787F1208AC7F44FDA7F14904210AEF0E4704607F2561B6E895A6FEB9C89F653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545580, "uuid": "a517bbbd-139d-4ad9-9e28-68ce30131f9c", "value": "6144:i1eMX5Uh/W94gpr2T8PjhMo8a/9x1ewIK6TIDB2V4AU5i2mn/1Rp3x1Zpu5:i1rYKfct5/1z65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545580, "uuid": "6644bf88-ee5b-45b0-826e-e4a80634be0b", "value": 702518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545580, "uuid": "7bb596d8-133a-46dc-a72e-9085b586816e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545580, "uuid": "d5795b95-e10a-4dcc-b30c-29bafbccf54a", "value": "Dark_souls_remastered_DLC-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b39a38-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776499216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499216, "uuid": "a7fa2aab-ff09-429c-b772-23c7af665a61", "comment": "Malware payload", "value": "c187c14e46fe6d24ac802f8edc70a837", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499216, "uuid": "9dbaf00f-cbf8-45f0-a9d4-831a835862f0", "comment": "Malware payload", "value": "2f261e21db56fb984baeec70a48b820c3d8006bb6611888adabe9bbb7a4a3dbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499216, "uuid": "f4899337-5d3f-49ce-8c81-74eb6f408f13", "comment": "Malware payload", "value": "7eb89ed234741aa74b5fe4c025bb002d39948ed4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499216, "uuid": "44c36e35-1a45-43c6-b2f3-8095196b127c", "comment": "Malware payload", "value": "aa47fbbf4655da5877d804bc9a6b961228cbd36759a9f0b32e6e9fc76593e4014da0ee584e79e6af882314e97f0d2f4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499216, "uuid": "aeeba903-6bb2-4eaf-b003-4a63f5f15d7a", "value": "T1B6D3410BA761DEB7D85FCD7B069A451110CDA98A069DAF2F73B0CA1CE78E88B44D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499216, "uuid": "471e8444-8e7d-446e-9b42-9598fed55f7e", "value": "1536:187eT3rdO7DirQtD4HBcZZM2MZB36KHBPok9XbA/Ok9/MMmi1fhWxS51Mlfc:yA6ccjVMGKZlIOk90MmiBhWxS3Mlfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499216, "uuid": "fa47af87-94aa-4849-8795-9979ad9bd51b", "value": 130541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499216, "uuid": "f35657fe-2b1d-4e1c-b6f2-8d1c95d203c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499216, "uuid": "d4e4bf76-2721-4c56-8bd4-e7a255181642", "value": "Demon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943ad720-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486306, "uuid": "b3bce030-e0b5-469f-9142-0c8515fc4a1a", "comment": "Malware payload (Mirai)", "value": "e4ecbb507541980d417bb9fc3ecf9041", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486306, "uuid": "45f467fe-afc1-459e-929b-4bc810e1444e", "comment": "Malware payload (Mirai)", "value": "2f57b3bcdb141b72df9a816c8212094b27677466ec2e5ccd27e368a03ee26978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486306, "uuid": "fe63e6bc-2c4c-4c54-b879-36f95ca55e27", "comment": "Malware payload (Mirai)", "value": "70bb6518789c5080a267f79675cbfa73e4ac8f3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486306, "uuid": "6b4a6c9b-ce88-4c52-b3d1-1324dd3275fc", "comment": "Malware payload (Mirai)", "value": "a68380b7487f08b8f060bbe982a3e2ebcae35d83ad13848e61c3490a989ccff13c8828d3e80c14b7ef8d6e19d70095cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486306, "uuid": "9e891531-001d-40ed-955a-b20fec8b10bd", "value": "T165531995F880CA23C6D12276F69D554C37171BF8D2DE72028E202B346BFB95B0E27D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486306, "uuid": "62b62859-a031-48fa-b6ce-f88c4f493138", "value": "1536:8SMN9KbeuAbTWBTM8D1aClZIBaLLfEHngdlnzMeFdARnODj86OsY69Fe9AP:8SHhSS5hPLEHgdVjDj8T4gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486306, "uuid": "08ee1363-1857-4ef4-923a-4f1df4a653a8", "value": 62800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486306, "uuid": "4a23b58b-eb8e-44b4-8687-acc45ff08626", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486306, "uuid": "c8e995d1-e893-495b-b00f-6b422636951a", "value": "alyssaaarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365c5b7f-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474123, "uuid": "334f41df-37cb-411f-be62-f50fe6f04e1f", "comment": "Malware payload (WeedHack)", "value": "989442d5b78b91672c480bb4477a0478", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474123, "uuid": "cca8582f-3283-4cfb-9623-b6da30875228", "comment": "Malware payload (WeedHack)", "value": "2ff34a5a9b0769ca8d4e1f7684508019623cd40e819def4e342da9d12f32587c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474123, "uuid": "b53ef290-03a8-4a2e-8f04-d22852504417", "comment": "Malware payload (WeedHack)", "value": "8ba5cbce7c0ca3074f7fd2dacca4aaebbded136e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474123, "uuid": "f45a107a-ec1e-40b7-9dae-04bd96ff3395", "comment": "Malware payload (WeedHack)", "value": "b176e6964b850059899011730eb758dbce1df6fae3b407beefdf9ff829130bf408e9ccd05d7b8275007040e6276f7e0f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474123, "uuid": "d331fc65-703b-400d-8d7a-53950d813c8f", "value": "T155B2D1F783135EA4CF576AF525853AE478ACD3CB0847790F0C6488171D12FAA4B54AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474123, "uuid": "80a3bd0f-efe0-40ea-ab76-26d22b3b369f", "value": "384:Zj3w9gntiTM++egtR7Ycp51K/zVAfK8YFZk1osFqExHq5Jkc98g6WfYtW3r05Gq:Z79nMBVgtBXpXnCzjbAxqTk5yAW3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474123, "uuid": "6870a08c-03ca-48ec-a063-93fd4bfdf976", "value": 25568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474123, "uuid": "2fe45611-fbe4-496f-939a-2e3b4e8bf21e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474123, "uuid": "7c5fa5d4-d09c-42e2-8b82-2605c7323218", "value": "Example-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f08f54-3b1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776512556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512556, "uuid": "e450cd6f-580b-4068-a149-27bbc727f747", "comment": "Malware payload (Mirai)", "value": "4dfed1c7c30de9cc97932a6287e41007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512556, "uuid": "b5086f7a-242b-490c-99df-155d80712a6d", "comment": "Malware payload (Mirai)", "value": "303bf1629f8a98593d5b774c3e42e86ae2c68aa981066c4995fbb2870c004dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512556, "uuid": "4f03c01e-c87d-42dd-8a73-7ac4546304e9", "comment": "Malware payload (Mirai)", "value": "d5cd7dc9b16f08af662b57f0a41cc882daf1fb0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512556, "uuid": "df5ee2b2-86fc-41ac-9e51-d7968ac75725", "comment": "Malware payload (Mirai)", "value": "64f1f9c445b2185fb3f8020926012347bd4190dd88eaf94b0ea4edb915de85b9dc130fed9c97dcef6d05c27bb85efdeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512556, "uuid": "28069cf7-d85f-4357-a6ab-aac3604e72b4", "value": "T1FB049E32C429AEE8C1A49476F1B1DB7A1BA3B45041671FBF17EAC2794047E44F90A3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512556, "uuid": "307bddeb-68dc-4b66-bbb3-1657c89f0fe5", "value": "3072:mJTMjQax7jQmw87mugbFe8B72kwoBw5eN2K326PArsWmKppvWioT2mfu:mJTMjQax797wfEkfuDuo1+ixmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776512556, "uuid": "f59ee561-577f-4ccd-817b-5ef71d84301d", "value": 176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776512556, "uuid": "f86667ec-5842-4917-949f-4203a23829e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512556, "uuid": "440c3353-f36d-4871-9fbf-2cefa1440072", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27679bc9-3b7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776554843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554843, "uuid": "366b7ca0-deee-4259-afee-2cf27857ef44", "comment": "Malware payload (Mirai)", "value": "00dea88c2572032f0be58630d9fe5e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554843, "uuid": "6a3ae751-7d9c-445d-a5a2-2e71cddb8711", "comment": "Malware payload (Mirai)", "value": "310b21a945e16d0784e02736a82957901508b29e9d2da30da99687d16f09b0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554843, "uuid": "6c9743b7-6774-4bf5-9c4e-dd9a7218b2f3", "comment": "Malware payload (Mirai)", "value": "edc57e9522369ef587c0e060b3f7c6bb350d9a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554843, "uuid": "73b4866d-cc42-4fc2-b867-610772bcedd9", "comment": "Malware payload (Mirai)", "value": "3261229168393cf06fc7d12c2e1fb0f835bc967c103a34e644a7f5474a66f561df36439419a12900ec308121a9dd20ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554843, "uuid": "92ceca17-517f-4a89-bf5d-b348287b2530", "value": "T12763B55A2E358FEEF66DC33487B34A30A7A963C513E1C684D25CD1151F6034EA85FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554843, "uuid": "99e40b2e-4db2-4260-a620-67f35bc14898", "value": "1536:udE1Qd88+2YBvBWj79b6VzO2yw8jpTHe+iidd:uF+2YBvBWjcPyw8j1cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776554843, "uuid": "ce1e364b-f29d-4888-b7ac-b9a9760c0ba4", "value": 68492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776554843, "uuid": "4da06b8d-27bf-4d04-9b18-dbadd3638c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554843, "uuid": "d527dc78-43ea-447b-b92e-8b8fd917e822", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606f5398-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484502, "uuid": "9083de79-b03c-437e-abce-7bcd461389ef", "comment": "Malware payload (Mirai)", "value": "aa3d4d6f29eff013e8b0435414b5af95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484502, "uuid": "cce96699-3d25-46c5-9fa3-71afea8ba29c", "comment": "Malware payload (Mirai)", "value": "3149a2ece58dd0e413c7304de4a0e14d1dc31f74cf30e5faedeee38c42ba82fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484502, "uuid": "b5ff3940-0189-4d16-9ff8-ece94a8446fa", "comment": "Malware payload (Mirai)", "value": "e9e5b3ca3d10bf66e15be383698a7ccfc249ad37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484502, "uuid": "4a5428fc-df91-49ce-89aa-dea369dfaaee", "comment": "Malware payload (Mirai)", "value": "1e6c856d0a73e0c6790bbaefb04f582c5bb66bf87e4bd1c3977f929569c3b93e78305d58adec4f73dfafae33821f0671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484502, "uuid": "716a87a1-a8ca-44a2-88e6-7265f6066052", "value": "T17F432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484502, "uuid": "09a574a9-55b4-4ff2-b5b0-2b0b7cff1de2", "value": "768:TXon00+q9wp3C+vactfa1sDHLYAzsv6WswWSHoXdss63B/9JO+zC3+:TXw00+SY3CaactfI6Lvzsv6vwcGJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484502, "uuid": "8cae6ed0-a822-4cbf-840c-def1f173d9bc", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484502, "uuid": "1a7f4e60-3680-45ee-bf14-18cfb76e433b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484502, "uuid": "c8b52313-72c4-4b95-9124-bd818cdd693c", "value": "Josho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523a50bf-3b0b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505523, "uuid": "feecca36-417c-42e4-8be0-0fd53a231bb0", "comment": "Malware payload (NetSupport)", "value": "e9a23d0c66fcaf09b6767718d2b30905", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505523, "uuid": "5ef9bb6c-e4bb-4f25-a054-fb81be27f10b", "comment": "Malware payload (NetSupport)", "value": "31bcee5dbc22c5ee3cc4798087222b7cf2218b7619b482aa2b74223857d1132e", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505523, "uuid": "d0fb7bd4-6577-447d-8e6e-891e91a0303a", "comment": "Malware payload (NetSupport)", "value": "89e331f68cfbe5ff07b1b72eab9f4da90b5e2cd7", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505523, "uuid": "6f1d630f-80a6-4557-9b9a-408f688bedcc", "comment": "Malware payload (NetSupport)", "value": "8541add77b38be92dba21bbc1f20f262a4b9583465a09b8288aac4fbaeec8c2470a002fbc753378e435ad7b0807aca72", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505523, "uuid": "33943d8d-c0fd-4969-a758-64fcb628886a", "value": "T144129F1EC7C85CC3D1AFF2B91BE08115C926EAD846E6044616FD63D5BB82DB76631231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505523, "uuid": "4d5d6f97-4ee1-4604-b190-06275051f057", "value": "192:9Rmyca9fbpkjXskAPyXXlKaO/Ax8/dI+EV5wC:9Rm/wksuQJ/g6dI+wwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505523, "uuid": "7f4a01a4-bc25-4466-a102-33b28c6fcaa0", "value": 9030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505523, "uuid": "1d77b8eb-3dad-415c-84b1-e39d0f18a6f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505523, "uuid": "c3adfc7f-f97c-49b1-a3bf-7fdbcfd779ba", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9078af52-3b65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776544282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544282, "uuid": "f6e4570d-f7b7-46c5-80d3-dfcdb008738d", "comment": "Malware payload", "value": "b2e1e5e11aa70af2f512bead6d790bd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544282, "uuid": "7477e0df-fb5e-48d3-b4db-08fec87c1e98", "comment": "Malware payload", "value": "31dca828d853e249e7b6b64e683c6a3358307db8489dd9ee360ab326d5246af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544282, "uuid": "9b80b084-df00-426d-acca-8caf4fd3a8d2", "comment": "Malware payload", "value": "1c514ef57c3e4db00f783b3a635f248c2869e6e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544282, "uuid": "488f4bb6-7300-4cf7-bf10-cd3afb9fbfd4", "comment": "Malware payload", "value": "d3ca332ab047543ebeaec9bcdea275e385868c96743c41f094114358cf1f5a52bb758b92fd81bf324f7e5b7fcf1a70c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544282, "uuid": "9d4811ec-ce7b-4e0d-9220-55ecc46e31f4", "value": "T1E9E69C77910238E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544282, "uuid": "9c2b6681-04ab-4af8-ae13-75cc549b96d1", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaU:sXyWSpV+Wu7rI3JEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776544282, "uuid": "0ddbc6c6-f1a0-4c6c-94c4-062fb4d0ba69", "value": 14516224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776544282, "uuid": "431233b8-0260-49e0-bb98-f03cedc41279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544282, "uuid": "a5cee3fa-4a2c-430c-945d-639bbc98292b", "value": "31dca828d853e249e7b6b64e683c6a3358307db8489dd9ee360ab326d5246af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0cebbd-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551279, "uuid": "588f5031-7645-4a1b-b522-69f9a518866a", "comment": "Malware payload", "value": "268caeac1b6c54eb504aff2b689f765d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551279, "uuid": "4a975e42-8943-474f-86ad-1520d10265a4", "comment": "Malware payload", "value": "32ef985c021609b4acf53f61098850f9fc85ed52dbb9318d939fccb73fda8044", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551279, "uuid": "d273c815-27e3-4aa5-9353-b7ee0268fdb2", "comment": "Malware payload", "value": "018923e56ebcfe1a75119a9c2771f4dc45cc8c88", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551279, "uuid": "fb214929-f2c2-4133-b933-65e353717112", "comment": "Malware payload", "value": "b2ab0c35dc7896bc4b0a8d5ec0951f11f61073dff2d22c4720780eaf011f99c01327841e5d0ce2806e64fdf0ba997cb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551279, "uuid": "0e3e08e9-b221-40f4-8564-d76fef03a80f", "value": "T179F4336162FDD4B5533021A3D9BE54122B1BFA84C3C36501DE762A636CB61CF39A8C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551279, "uuid": "f4ba5de8-0349-4df6-9171-42444ea03cad", "value": "24576:13JpRoZxAbo3L9i6cYmD1gUGFE8JjF17D:NzWzAbYkmmSNeI3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551279, "uuid": "1f9aa3cf-4d71-4453-9358-2431485c33d8", "value": 793830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551279, "uuid": "15a68bfc-e984-4018-95f1-92d0527f195f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551279, "uuid": "841560bf-4195-4660-b940-63a77fca5b1c", "value": "Example-1.0.0 (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea089827-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551304, "uuid": "0085a5bf-3550-4cce-88f1-905113e87f69", "comment": "Malware payload", "value": "b94957e494198f8251c8464da43bad72", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551304, "uuid": "75676003-2115-459b-98d1-056aec60186e", "comment": "Malware payload", "value": "33affe937666ee1dade89d1533b60384b5619147657b7c35d9d12b5db25f121a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551304, "uuid": "142a72a3-ca7b-4e96-920d-220c2cecb92a", "comment": "Malware payload", "value": "313d7d76bc460c005a8f1ef1f09622d5f8260f7c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551304, "uuid": "f3c9b178-69d0-4cdb-a732-6ef9331e089d", "comment": "Malware payload", "value": "bfffe80660c9bb28b1551dd1c95ef0433a1e373ee2980f686eeec4be99abb9fa8bb67cff9c7c0c54182f7e57052ac6f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551304, "uuid": "090b4d16-5d3c-445a-b155-238d2f7255be", "value": "T11274F171D61C04EBE707A236EC1157362A5FA2CDF047221D36A4A843B05F7BAAF7426D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551304, "uuid": "da25c66f-ef9d-4458-a88e-753640bddf4b", "value": "6144:wkF9x1TZsyvda6zP15uthU7vveq7dDBGBuLaI3Fo4j8nd:wkFPbzP15uty7OCsBun1o4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551304, "uuid": "8cc9c81f-d7d0-41d4-a26b-ab5625c880f9", "value": 358329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551304, "uuid": "69c2c9cd-a835-440b-9b28-fed8f4d810f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551304, "uuid": "46d705e7-5d64-4522-8261-ed55e76f9329", "value": "RadiumClient1.21.X.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b559b54-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530422, "uuid": "1b844f00-f0e7-4a28-a7d3-c00dc2eca00a", "comment": "Malware payload", "value": "26238d32710b458309782c062be3b0b6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530422, "uuid": "f5065053-4d51-414a-9b61-3e6fe9661fd2", "comment": "Malware payload", "value": "33f28f82ffca11f494a9df6a822fdf429b80a715a7b1da4e90cc26745a3de45b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530422, "uuid": "b55304dd-235e-4e26-9e9d-964054d7e9ed", "comment": "Malware payload", "value": "20789bd89abb88aef991881026426b9027d283f9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530422, "uuid": "540f350d-9d8e-49bb-91b6-429363bc91db", "comment": "Malware payload", "value": "fbbdf42c8f6bb22255690de3b533b2715e820e747d5b8c1091189786b6ae75a3eeebc11be0efddbe2282518a982084f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530422, "uuid": "8315bf0c-b1ee-4d1f-9407-aeddbb50bfe6", "value": "T1A0151213A2FD09A1E33B727EE5447D623CAE07DBD20AF436D4E94D971C8B6C94A84319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530422, "uuid": "66610651-a3b4-4cba-b106-609f2df07f11", "value": "12288:ngccUsk1AYFmRO+2ONhqMezTeZ7eNUbpIyABisj2qPO9kyxgbqYR4KDdgaRQSFVF:n71G8ih9eO9eiBpqEkyx2DgaChy69ikU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530422, "uuid": "4dfa5405-0f22-41be-b527-4a5994a95a51", "value": 897656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530422, "uuid": "ad09109f-598c-49e2-80d3-6681c4d544bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530422, "uuid": "1d3b22eb-0a04-4dd3-8bd5-a6cec356b8f0", "value": "4EClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9487c340-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776498762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498762, "uuid": "862eadb7-c667-4d54-9059-7a32918042b3", "comment": "Malware payload", "value": "942e80dd8cb61b6e6e07b255541dc449", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498762, "uuid": "a94973a9-bd29-43d1-9c1d-68f4e69f483b", "comment": "Malware payload", "value": "343f666d548720d23ba6ca4c08e3ab10aced5cc9ea155c454f31bed5a939c89a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498762, "uuid": "5a9db7fb-d263-4e44-8fff-28bb1cf737ec", "comment": "Malware payload", "value": "b08dfb5fd6eb9eeef5b53d0736bbb51a6a6cc0db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498762, "uuid": "e646d8ff-82b0-43e7-999b-65bf625aa067", "comment": "Malware payload", "value": "42924ac2e13d87dce8a4b2c99513024746c38528dce43beb7c75ab820d11f22b0b709b6226f531e3ce373d3fb23ed28f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498762, "uuid": "0c3594eb-b058-4149-8fba-79e17c21b969", "value": "T1E6930A4759238FB7D45AAEF13DF71520079EAA911F4F0A5E61AC69B0070B4CCF62E728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498762, "uuid": "65507cb8-ab68-4da1-b0c6-dd256b3e8f8d", "value": "1536:My3ceLhajKN37KfGy7m2We4HC2wOuUZmQjT2q5ecDjAbc:MyseLh/NcGyt4H5wWmCT2q5JDjAbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498762, "uuid": "87e9cbf0-7bb7-48e1-878f-ea72db9537be", "value": 90074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498762, "uuid": "33de547d-1723-4464-9feb-ed36e02c47b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498762, "uuid": "863ffcf9-f074-43ef-bd17-55c2d2ef96bc", "value": "Demon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919e1dc6-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533976, "uuid": "2d7cd947-fbcc-4d25-89c0-06d584280e9c", "comment": "Malware payload", "value": "51917d66a52b1c408aa5a831f27d7c5b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533976, "uuid": "05de67d9-b01e-4f1e-8693-f4a022c43139", "comment": "Malware payload", "value": "347979ff9a265cf0f10daf1eadaddad900e0fa0f49674d72724f1f848afea3f4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533976, "uuid": "e26afa15-f600-4159-9bfd-e7cb019a3712", "comment": "Malware payload", "value": "c0ac7b120c5fcf37508ff021411eb0ed24b0cc5b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533976, "uuid": "16c0edae-b661-4311-ab1e-8b1b3b4fc63e", "comment": "Malware payload", "value": "9795f4ab7fc2e075a3ebf964572df12da7f12697a5e894d1f9e425c5b4ef4b2e8f0be44f8df1fedbab59391c6b8d3b2b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533976, "uuid": "3cc8d032-303f-4405-93ed-562f84430e9f", "value": "T16A7423261B24A691E18B8C37018F1B639BDCC67933739E56CB3D6500E8FA30BE54E575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533976, "uuid": "e85035e6-7e49-458a-9ecb-30ada87ee5f8", "value": "6144:nsTnH+GOmvnxpy+VoztsIhKbe/tzRaDgu0D2pRWsVW4WPfPbVhe8jI1pCn6dW0:nsTHSmfVKtsITlaDguhFlAPJIoB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533976, "uuid": "e060188a-d8bc-48ac-bf27-e2e420f7668a", "value": 363921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533976, "uuid": "eb95cf99-b32a-4a29-a57a-a73e25922103", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533976, "uuid": "c7d970ad-0899-49ff-95bb-fdc6995b92c2", "value": "Bobys_Crystal_Optimization-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60575e1-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527622, "uuid": "fabd6489-6281-424b-a7ee-5980f84925a6", "comment": "Malware payload (Mirai)", "value": "1417b35c6c279b98f773cedd940e804d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527622, "uuid": "1867cea2-5bd1-476f-9395-b0b387a5c7d5", "comment": "Malware payload (Mirai)", "value": "35e6e0e09f5bb5f0f4b5134e4d26558a8f58b7fb54ac439c1bee8fbe914b85ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527622, "uuid": "51aa1b61-5adb-4d7c-8fd8-e5bb76b6907f", "comment": "Malware payload (Mirai)", "value": "8cc9c09f6e3b4beee65eeedb152389cec2dea2af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527622, "uuid": "6dcd95ed-0906-4c99-8033-4d98d1d854a3", "comment": "Malware payload (Mirai)", "value": "5edbeaae32f910d457b003f2ea8c3a6b123d9c1751680dd893faf2a552d08059f7c58955e1d7aff52c55cba9224887bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527622, "uuid": "c42aa0b9-e9e0-40cb-b503-c013b7b846af", "value": "T179145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527622, "uuid": "785d169e-67c1-482d-a112-c42e780dfb10", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXFUaN:HZ15BTYCrYq1QDY624", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527622, "uuid": "1f34c65d-efbf-4091-a374-03bc66460d31", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527622, "uuid": "baf87b78-2100-4dff-9dbc-96ef3f23171e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527622, "uuid": "b1c04b97-667a-4ef0-b91a-f0d4db983c88", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302393ae-3af2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776494728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494728, "uuid": "00e0c552-86af-4adc-9561-e2edb1d33337", "comment": "Malware payload", "value": "ce189de2b9db3493e07dd2bd4725ad89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494728, "uuid": "baad2cbb-3f20-40bc-9bb8-ae7b9d37066a", "comment": "Malware payload", "value": "3660982593551ff1d767875cd99a7cae7dcfd2be2dd874a935cdae70a7077114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494728, "uuid": "e806cd14-2424-4733-a39e-3772042e10a5", "comment": "Malware payload", "value": "bc4df6aa244d6e421a2594a6f3f07391c987f6f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494728, "uuid": "c75e811f-2100-4fe5-9008-a68d8318c988", "comment": "Malware payload", "value": "867c1f0864157a23ea18aba1fbdb411564fc65116637bce961ece700c7a92fab6e20332acdab92caf444626094cdb984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494728, "uuid": "fba49927-1d20-4fb6-bae3-5498d9d54835", "value": "T148B6330FE40824CFCC178D79E4D560B27B590D781B6EAEEDEAF2E4199C1372B9671884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494728, "uuid": "734c0d3c-63fb-4077-8a65-e2b33fab63e9", "value": "c947183695560cc59793fd7524f97c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494728, "uuid": "4fa9e02d-acdc-48d8-9951-82111e9c225f", "value": "196608:fX6FYqbHp0X47Is+ix5Lb7BTXp79iOd9niec:SBdU47P7v7hfiec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494728, "uuid": "a978d20c-72e2-4786-b275-54fed3b342a4", "value": 11182072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494728, "uuid": "ea9a137a-7269-4008-b259-e727953beee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494728, "uuid": "77582239-2d53-480b-bcdc-3d20d9df0825", "value": "CAD\u770b\u56fe\u7834\u89e3\u7248\u79bb\u7ebf\u8865\u4e01V6.5.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd889d72-3b29-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776518615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518615, "uuid": "947a5222-be77-4f0f-867c-0984a9f17a49", "comment": "Malware payload (OffLoader)", "value": "4b5f930a53e1d5c3b68fb3ebbed0fa8e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518615, "uuid": "c34d6645-e057-402b-a58b-42f069ae8ff5", "comment": "Malware payload (OffLoader)", "value": "36e0a875a98679d803a3d5013f536a8de3929aaed1423b57233fffe03f500468", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518615, "uuid": "57d262f5-0ba2-49dc-9c1a-b7a32d31fa58", "comment": "Malware payload (OffLoader)", "value": "64c917c26817f448a4d121e81cadeb3269000fc8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776518615, "uuid": "0278b8ca-3d75-4d46-baef-de8f16520f07", "comment": "Malware payload (OffLoader)", "value": "d77e88e34223639e7362bc3ab57b84222f06c966ec3270b56c0b67b25017d4bb4fa3b43babe5b5ffa51447175408a20d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518615, "uuid": "692823f6-dd28-435a-b318-186b4e644763", "value": "T165C6F12B71D9123FF076853399B6B22018FB764BB4098E46A7D0395DDB296D01C2FBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518615, "uuid": "650c5956-d388-4ad8-828e-89ed2439f322", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518615, "uuid": "691d9381-5271-401c-a9b8-26ddbd11bc66", "value": "98304:dN66tApvO620ZE4INwkQEmUoEd8vGoFlywV:J0W664KQdD48T2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776518615, "uuid": "e5be9046-e39b-4511-9de6-9597140126cf", "value": 11780710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776518615, "uuid": "5b98654a-22b7-4227-b902-5697a50c4400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776518615, "uuid": "4a5b8142-2f12-45b8-9836-b5f98f4222fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f897c58-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492983, "uuid": "cd1aba14-7c19-443d-9892-bcdfa579e4f4", "comment": "Malware payload (Mirai)", "value": "8ae3c7476067f3c64ae41b8031138f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492983, "uuid": "54b91573-fb0f-4acc-aceb-efba86e03c4f", "comment": "Malware payload (Mirai)", "value": "37c7d45f4ee5c7c87668091cdce93ba27c3403eea5d34a945d0a3c847ba147aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492983, "uuid": "13160036-f247-4c2d-9469-1f6e38d7d675", "comment": "Malware payload (Mirai)", "value": "335f10fd5854ff06427b59c617117b96eceab002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492983, "uuid": "75c25139-615d-4305-9b56-4be9461abaf4", "comment": "Malware payload (Mirai)", "value": "17856733d147a82c097a3fdba99ab5f790e4d447837216fd1517acd9488d53e987fcaafd479f8e334b0cb603486c6e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492983, "uuid": "954b80ad-9863-460b-9083-bd2352ff2caa", "value": "T188A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492983, "uuid": "78f16c59-d49d-4deb-a4e7-68bafc54efd6", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeENY0:lZzTJa1rZ62yqPy/ULWzjeENP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492983, "uuid": "fd2d115a-52b4-42fb-b1a4-5034759846e8", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492983, "uuid": "1e1b72ca-0f9f-43fd-ada8-50e99fe49c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492983, "uuid": "1c1e786c-2eae-48fd-b538-a25f704d0bca", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e038bed-3af1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494242, "uuid": "73ae5b10-2210-4a14-9d85-27e38eeb601d", "comment": "Malware payload (Mirai)", "value": "82b3d6cfb4b9092dfbc6d3548884e570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494242, "uuid": "81543e2a-5ac1-4c36-b31e-df29dc4481a8", "comment": "Malware payload (Mirai)", "value": "383a44311fb8e5e15ad0f44cd102a3d65009a6ff20f06eef092ca7af2cf2d473", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494242, "uuid": "8a6bf3e1-5499-4e85-955f-d8c14241b3a2", "comment": "Malware payload (Mirai)", "value": "a1a6b37fb7f417271bda5e70ef310dd6a04a3441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494242, "uuid": "dfdd238b-ed4f-4d57-b8ae-faea341f6474", "comment": "Malware payload (Mirai)", "value": "1f04f371456007ee807495c2822876f56bc2341926cbdf5c7adb0f07e080295563ac38dab4157bf8eab23cc86c83ae27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494242, "uuid": "cbee7055-206f-43c7-b197-3e0eb736b247", "value": "T161630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494242, "uuid": "d143861b-66e7-4703-9aa0-ee450952d000", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494242, "uuid": "3a3041fd-129f-452b-bd28-58f60b0d40dc", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494242, "uuid": "bda972ef-adfc-4634-bd88-04d5f6a68411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494242, "uuid": "589a7f76-cdd8-4fbb-a5d0-22761034c84f", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821e01b7-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530514, "uuid": "37da5f46-bc5c-4f05-b0a1-ae30c1133c96", "comment": "Malware payload", "value": "ef8d824232ab8f2e9cdbe1a80957d6ea", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530514, "uuid": "d0acd4a5-0733-48f1-a7ed-c5668c8be2a3", "comment": "Malware payload", "value": "383df377634d5336c492e31c72b772ba166341b091b1d4e1fe1bc8c008c7f657", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530514, "uuid": "92ab6b6a-9d1e-4c23-9345-cd23088e11f0", "comment": "Malware payload", "value": "e6fb3de7690cc47a1f0aaa25db768f1ceac8cff0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530514, "uuid": "ae1338d9-1ac4-4071-9fd3-33fb3fe0aea7", "comment": "Malware payload", "value": "ef1259666c5e66082030a9f95998a75bd3da469627460a50b1bc90dd404467589c1867d5b05dc91a357ee20c5229a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530514, "uuid": "caf3c51c-d35c-4378-bfd1-1d7def0d82c1", "value": "T188C4233EA69A5472FB07B73280E2D516742C11C35B07B11728FA1A8F0C63A6FD7187CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530514, "uuid": "f7a6bcee-a60c-43da-ba30-b63278131fd3", "value": "12288:G/IO62vP3gI4lI2l/15ayUJH2Ugxtw8LF3TI6/b:G/IO1PXHa9QQthLTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530514, "uuid": "bd39f4ac-4555-43d9-a51b-96e0771aabf7", "value": 569369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530514, "uuid": "5d82a7ea-e7fa-487b-840a-0b59190f79ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530514, "uuid": "ccd95434-5d44-4284-8e48-71bc7b6ea4fd", "value": "Xenon-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff46e012-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492928, "uuid": "b98942fa-458d-46bc-a9bb-23040bc4028e", "comment": "Malware payload (Mirai)", "value": "94c52d11f1d088a8765c95058c37c74a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492928, "uuid": "5d96b697-7b58-4fa1-838a-97d950811a4e", "comment": "Malware payload (Mirai)", "value": "39460376c03cc7ebee2da8087a458116b548eef54ef317e2b583e86dea62a7e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492928, "uuid": "05889f72-d756-463f-9db4-f1f8b8ef5fff", "comment": "Malware payload (Mirai)", "value": "c1995b77d9d7b49a457dd3f17ae8ab105594db73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492928, "uuid": "09f635b8-f879-4e47-afaa-ae056c3740fd", "comment": "Malware payload (Mirai)", "value": "a3595f005c3f1f39cb3a0aa5472a153d56971725f6eb641aed9526bea982c4194c9b32b5da19c1fcefb59138bfba6c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492928, "uuid": "4153c3b0-899f-484a-8b32-b9772b8253a8", "value": "T1B85302D2A440D1E7C35A02FF66E4D847FB655ABC65D930AB367EC318A192C4838D7F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492928, "uuid": "8f66ed64-1a67-4aa3-87c0-6289b80cf7f1", "value": "1536:pVQSmwtMJXmejtKchLTM5Tfv83KJ2crl2EW1:pVywt8XZjhLgTX83KHl2EW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492928, "uuid": "04e98f33-a9d8-41ce-a6f1-5b02014c8028", "value": 61844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492928, "uuid": "1d97d454-d2dd-4963-8d67-ccbe344679f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492928, "uuid": "bb3f8a69-eed8-4ca4-88f4-8004a95ea8fc", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1dc606-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527446, "uuid": "6abab070-cf31-456e-97ca-c0315b3491d5", "comment": "Malware payload (Mirai)", "value": "81a571149394464647951970327f2131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527446, "uuid": "10b0feef-2e7e-443b-9702-79b41731bde1", "comment": "Malware payload (Mirai)", "value": "394e24d1d44d40a17a5b07a46d27237ba10d18ca38fcbd71963b22f2d140e486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527446, "uuid": "7a908622-12e6-4692-80d0-d9dca6b8a162", "comment": "Malware payload (Mirai)", "value": "5ac16feff7f637144912899af31d7f2535798119", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527446, "uuid": "470e5930-f9d6-44f3-9a69-bbe28de044d1", "comment": "Malware payload (Mirai)", "value": "b6e1f084952708a8880f7ca73329af9967a3ae0c35adc25e980bc1371b3637dfcb376545b32a00500e3260a0b119873f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527446, "uuid": "273a00cb-c08a-4201-8d0b-36b52dd56bf7", "value": "T1F56301CF6EB02B2AC1D8A1B5703415DADC3ADDC6D343C69C86E6A796473943760C8A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527446, "uuid": "9d09b9ff-a90c-4868-8183-e94ba7115d17", "value": "1536:saxZLmYKVDNSl2y08yumeJyGYVmIMGjmd01nNo:saxZLmYKX+t08jmeJhYTjm61nNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527446, "uuid": "0175ce78-ae9a-4dd8-ad77-192a6dd161e2", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527446, "uuid": "05b53df2-24e2-4a4b-8f91-8a6003ddc726", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527446, "uuid": "b05e775f-d851-49d8-b1d0-009a66adafd6", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6290cfcf-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484505, "uuid": "eb5c8d53-5875-4c4c-bb89-dbcde08ddbbb", "comment": "Malware payload (Mirai)", "value": "5498d7f2e41d6091c084f2b8cbc4882a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484505, "uuid": "0ed13ac3-f34a-4dc7-917e-be2aef83271f", "comment": "Malware payload (Mirai)", "value": "39670a4d645536086ce92fa7b666262d2bcc547916fefc19de25778155db4e51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484505, "uuid": "fe1ec172-69a9-4c3f-bbab-09ffcbb7b1c4", "comment": "Malware payload (Mirai)", "value": "efa9660dd190744f00c984191c2f9dc16293a935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484505, "uuid": "e43926fc-6d9f-4783-b418-6d38e7b74ea5", "comment": "Malware payload (Mirai)", "value": "071afdddbf514bc41b19e62674f926ac661d9808714dbd85d1c36ed072e3dbd379471e33dee2878d2d5cf7efe09f9044", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484505, "uuid": "542c1ebc-7a37-4e6b-b25b-aee0c7545eb3", "value": "T15E332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695EEA458136F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484505, "uuid": "11bae118-fad3-4b2c-bd04-3f0a2ab64686", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1oRNRR7Eg3tbv6VFssuWXwdyLB:k6HAt1ezbnAXZUBU33tbC/3XwKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484505, "uuid": "9e626447-916d-4e1b-aeec-1aa65d46a0f7", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484505, "uuid": "0300569c-5912-4a58-97a3-e6983952eb50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484505, "uuid": "a7bbdc13-bf83-4db5-a3cd-121f01ef8b0d", "value": "Josho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a2110a-3b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776539565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539565, "uuid": "8426d3c9-de44-499a-ab28-03257bcf10f0", "comment": "Malware payload", "value": "59cc7375e9150a9e464466914081b5b5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539565, "uuid": "1bbeb257-b239-4a78-9611-e708e51b99e9", "comment": "Malware payload", "value": "39691d7d22ca732adb50a990e19e739ee441e4fbf0ab440498a38125a03e53f0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539565, "uuid": "ba0234d5-b1c0-44bd-9b7c-e4af2e2d8055", "comment": "Malware payload", "value": "6d4334956ae3765b2c4158619402ff24ede15744", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539565, "uuid": "92999edb-f8de-4691-a466-b577445aacf9", "comment": "Malware payload", "value": "59cfe951c6c4e8b669ab91493db557bb2e159c05f2f60d750d0245e96546d463205c05da36ae27925af381f6c63b1f10", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539565, "uuid": "61b2e3c0-e8fe-44bb-946d-20284799bbc0", "value": "T11A86337160199524E97F83B6BA8F8FD2708C12C8E54361A613BD8E2F5BFD5C6C384E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539565, "uuid": "4474b8cd-b669-4e35-b1fd-30fd79b3c21e", "value": "196608:m+gQA31W9Pwqq1ry0LsIcbWAwJ81wsA1B99jsyQcTGkQg:mOWGPwPOyxc4J8SsKrvHTGfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776539565, "uuid": "0b2d3f36-7204-439d-ac9d-0214f674a561", "value": 8328308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776539565, "uuid": "4e83b241-3ef1-4ed9-b2b7-49f97390651c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539565, "uuid": "3dfb91f7-f424-4a81-8f6a-f15cf8ee2190", "value": "Grim2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b848ff8-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527443, "uuid": "f4b9f8b3-e824-441d-873f-fb27de6da612", "comment": "Malware payload (Mirai)", "value": "b7ed3b32bca15e8f0edd603638e7e45b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527443, "uuid": "6554055c-bc45-4d7a-a86f-8d1fe91dba00", "comment": "Malware payload (Mirai)", "value": "3a47a8017bce2c441a11612b5c9fb50f882c7d5da9479ec97449327fbb0665ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527443, "uuid": "72d656dc-7a1b-4467-941e-c78e45b49ef9", "comment": "Malware payload (Mirai)", "value": "0518fb42a0eac4b4fac09b43d2b112a63ee05900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527443, "uuid": "580aa690-e0bb-4639-8635-d6917c285b25", "comment": "Malware payload (Mirai)", "value": "07326f7eabe92239ce8d52fb3acc7d1c4ea07f58d04c1dd8437a81910e71525b109e414050869bd1422935fe8ff28c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527443, "uuid": "558351a6-eb22-4d41-8903-d0827bc59807", "value": "T18DD3B021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDF95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527443, "uuid": "28521a72-652d-47e8-95d8-7e7f14b19a88", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/x1:PiySSGp+PMmT7zMpl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527443, "uuid": "8e891959-ba6c-4226-a91d-8edc0c25bd80", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527443, "uuid": "97a74e1e-126f-4d82-8495-02384ba2fe8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527443, "uuid": "4a432f2f-bdb6-4b1a-be29-261f9da9e43a", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdb08af-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509272, "uuid": "db14dd35-ef94-4157-ac98-52e57bd9aa1c", "comment": "Malware payload", "value": "4c84af9f309c5d446202e796e6da5349", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509272, "uuid": "3451c360-47ac-4610-87c1-c92b3a9d59e7", "comment": "Malware payload", "value": "3a55f9a33dc31a0db4fadcfcde6afd3ebc74bed155d6229249a2af1edbda5ddd", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509272, "uuid": "167ae6fe-058b-400e-af6f-35614c655872", "comment": "Malware payload", "value": "6b29f3a9240ccd5a5de97ebc16ff7f2b7b466126", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509272, "uuid": "27cc2b6a-ee89-4e7d-8698-830047ac64f9", "comment": "Malware payload", "value": "1a10a45eaf5e81fd46fc40b50518e7dbb8f50b3c7f732ecf13d93304e8cd5deb373e242422b5dd7f54a441828eeafca8", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509272, "uuid": "5018f4e9-fb1e-4767-ba80-3c2f65c7ec77", "value": "T12E069D4AB3845DFAD257C638C717A332D372BC120775A58F25AAF71A1E37B814F2A610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509272, "uuid": "c627039d-65da-401b-afba-b11f26f8e6f5", "value": "0eb7fd1aa2faab26ea29af10e56d92d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509272, "uuid": "158cb840-8823-455d-8bb5-b30dbc1a4aee", "value": "98304:8poxxjlwbNGiuip25N0iUX5rJAZev+8Ko45btH6Q+/0OA5VZDmPIvj8mSYT+C:8pocJE5qiUXtJAZ+MoYJ1ROAxDqu4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509272, "uuid": "2ef938fe-a17a-47a7-b246-9b43ea7cf4fb", "value": 3755520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509272, "uuid": "3a75b321-c9e1-4793-80c9-1dd2903359a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509272, "uuid": "c1c0fa0c-e2ad-480f-a1d0-8e6c240784a9", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ed3466-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776527051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527051, "uuid": "3668f171-07fd-46a4-a517-225c6143302c", "comment": "Malware payload (Gafgyt)", "value": "7a8c8f47c21d734f57122372e6ec1b14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527051, "uuid": "130c7003-41c6-4892-9b2e-372923ad5cae", "comment": "Malware payload (Gafgyt)", "value": "3a7c12f4e5be164a96c499875978ffaea062b8e5a42b446294689081483bbae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527051, "uuid": "ccfffeb7-75fb-4923-9103-3bd6a5cbdfc0", "comment": "Malware payload (Gafgyt)", "value": "cb8792f61e37e412c44b0c3d4672d2705a121449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527051, "uuid": "5ef9ff07-b94d-40b1-bb8c-a5055b971ccc", "comment": "Malware payload (Gafgyt)", "value": "5167e5264b1c7bc67f1a2d296ef38d17c59e720d1d300c9065d7ab6f9110f0a21cba87f66ce1003db3976978208018bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527051, "uuid": "5bc4f5e2-11f4-4895-9974-632fd61e8da4", "value": "T193934923ED125F0AD20B64F0A1F59F351F22B8FA89975AD9E065DAE06543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527051, "uuid": "9834609f-38ab-41a7-aa87-5c83a4d63218", "value": "1536:9rZLXqjVVPBrwKYdo6nZz2ak0+Cvuy0/+ym5hV1qqpMm:jLqBVPBrXYdz2ak0+/yIm5hjqqpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527051, "uuid": "c982595c-c3df-4197-9bcc-964484b591b6", "value": 92164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527051, "uuid": "ee6cf09c-ce11-4c7f-9ee9-7fa680728873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527051, "uuid": "59219c2a-2b06-490f-a2c8-d8c492043722", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e17d94e-3b07-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503825, "uuid": "964f79a1-a6e6-426c-a8a2-66040a582d20", "comment": "Malware payload (NetSupport)", "value": "1cc48458e43193af2df93b95e4aef408", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503825, "uuid": "7b092dbe-a530-48f1-a7fc-339c91e3697e", "comment": "Malware payload (NetSupport)", "value": "3b8ec4cefc0c0975a349f4bb2462778356a9df378e7c6c14fe7a720a7b92f53c", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503825, "uuid": "9c6f9020-2e42-4d2b-b9ec-66b267a16a43", "comment": "Malware payload (NetSupport)", "value": "82bdaeb01e26a2f1cd11a80ba92e675711c9a0ee", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503825, "uuid": "9e4d29e0-8031-4e44-abea-be51f9e21c65", "comment": "Malware payload (NetSupport)", "value": "dfd43d9f9f80f8109cce4d1f8e24552d20ed36d220b8134909a8ebec06d1df86d7c5bedd348ecaf0a5e0bd9eafa1dc1a", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503825, "uuid": "a5ef1e64-b52b-45e1-88a2-d60b9dea25c6", "value": "T12C128D1EC7885CC2D0AFF2755A904165CA26DADC46EA000A16F963CA7BC2EB76632375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503825, "uuid": "d621edae-5dcb-48ad-b3f7-d90e70de34f8", "value": "192:9Rmyca9fbpkjXskAPyXXlKaO/Ax8/dI+uPhNC4C:9Rm/wksuQJ/g6dI+INpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503825, "uuid": "d0149350-ec4b-436e-800d-a28b79f57fb0", "value": 9032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503825, "uuid": "20bee27b-ea66-4695-9f13-8fda9519b906", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503825, "uuid": "45f3daa0-c952-4e35-82e0-d840b1ec38ec", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810edda6-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533948, "uuid": "808d2caa-6205-4861-81ae-5280f118687d", "comment": "Malware payload", "value": "8614baad7be3a49d0cffd279184cb229", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533948, "uuid": "7e6e0332-1461-4064-9268-d0cf71dc9f9e", "comment": "Malware payload", "value": "3c060e8c70da8634814e0d4560ca150e087cdbf62bcacf83dbf48559ca08bb89", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533948, "uuid": "90081a76-6ef0-4411-8068-6d404ffb5f6e", "comment": "Malware payload", "value": "38bb7bf1b9d99f7037ce11c4e0a0e771fb219c5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533948, "uuid": "8b251b2f-0f9c-4c77-8e66-3d4cb6ba16a4", "comment": "Malware payload", "value": "66071d13071e01d4c377956fb75c355de213090b0d7c75efffbe0b605ea97051b7ebaf1784a9b3bec5c20b10306948c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533948, "uuid": "122c0c61-de4c-43ba-ba2f-68bcc002358f", "value": "T173D3128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533948, "uuid": "da5320c0-cf69-4f64-8f1b-5b77e5bff2ed", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioX:p3lOYoaja8xzx/0wsxzSiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533948, "uuid": "ed249369-5747-4786-8334-d68c6ef36d6c", "value": 135785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533948, "uuid": "51296e08-d11c-4bd9-9273-ad9b8b4e5a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533948, "uuid": "7d8ffc1d-827b-42b5-be64-59fe2577e8aa", "value": "3c060e8c70da8634814e0d4560ca150e087cdbf62bcacf83dbf48559ca08bb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2c8972-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527629, "uuid": "fdbcb513-6a40-4e9f-a5c7-4ff2e0e42846", "comment": "Malware payload (Mirai)", "value": "bc9cb91abbdf6f5d47067537b44fc4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527629, "uuid": "402fc8d1-fada-49e9-a012-8602249c9717", "comment": "Malware payload (Mirai)", "value": "3e936d947f8994be48c2cd12e5fb0a8d1c4871f04454fa52c6f6e90f057810cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527629, "uuid": "4b3fa403-cf4f-40ca-962f-e04f8907d187", "comment": "Malware payload (Mirai)", "value": "b107f0e2c3208c50f22b783b0c1e3a28d2601462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527629, "uuid": "87ee531d-65a2-4414-bd2f-d0ab560001c5", "comment": "Malware payload (Mirai)", "value": "eceed279274b3ede2cb92f036866aeb21a87c94054eecf072f5d1abdccfd1246bff1177dcdbe7460851169a48ca9febd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527629, "uuid": "2e26f287-69e9-4445-aa96-9be2daee8f06", "value": "T13CF33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527629, "uuid": "0ce41f78-6613-46f7-9708-4d73a21ca168", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHefam:9FJMgWPZr8IaCWReS1WpPe37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527629, "uuid": "d54c26b5-74f1-4d93-bb04-243c0aeb322b", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527629, "uuid": "7e30f9f3-b530-43e4-923b-26ed61978154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527629, "uuid": "8860a899-5975-47bc-b9f7-5c13fdb559b0", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4bf356-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484526, "uuid": "a7247d82-5dd2-40c3-be71-817c38ae8e17", "comment": "Malware payload (Mirai)", "value": "742a153005c7df282f7e964b36c311f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484526, "uuid": "fa5b3660-42be-4ebe-a560-5b82ad601084", "comment": "Malware payload (Mirai)", "value": "3f25fea74e736100af364387b55a019b1de3f85f497692e848859b39bad52676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484526, "uuid": "c4af94d6-46e8-4570-9457-ceb69220d1ab", "comment": "Malware payload (Mirai)", "value": "0eb3caec567ac8d3df2f36f4aae1005f5115dadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484526, "uuid": "23f54c23-dd4e-4f61-9db6-20186f8c2c9e", "comment": "Malware payload (Mirai)", "value": "2235d6940102528c2cef1572927b5a467cdf69b31df02f6ed7e3ade6ae344a899ec62caeeb0fe631702e33dd49c8b619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484526, "uuid": "839fbb2d-3088-43c4-b372-89521c0a56ad", "value": "T1A34308C17881A626C7D05777FA6F018E37199798E0EA33538C291FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484526, "uuid": "fb9a25d3-a4f0-4063-9b19-30fa0f3edfff", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP88UapvTLwCVy/rCxH1:Nb24Th7ttujxynRPJU8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484526, "uuid": "9883b4eb-8592-4fcd-ae01-aa8977622d93", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484526, "uuid": "d7dc03e3-e321-4e2a-bcb6-a28e165587e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484526, "uuid": "273e6451-1560-4d59-ba91-3d21ad59259e", "value": "Josho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cede30d5-3b4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776532790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532790, "uuid": "c5ca7c5d-db48-4968-a2d7-bac8b8434878", "comment": "Malware payload", "value": "e1f4bef645eed9ed870ed3209c43291c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532790, "uuid": "16fe5827-e83c-4b60-abb9-e32ff1fac3ed", "comment": "Malware payload", "value": "3f57ab217e58e2bdaae00774a80805d03a9e32a4a9513ce0670b0eecb4dc71fe", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532790, "uuid": "f301c294-bf84-45e2-be50-9766a60d132d", "comment": "Malware payload", "value": "77ab1d1bf0705fd08b0a97ed8a4ea17da1f60b4a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532790, "uuid": "3a2e123b-c5ef-458f-9307-cd1825882a1c", "comment": "Malware payload", "value": "fcf51c6e913d7147114018505ab065c2befec8bb4707034892334c3779d98a1ff9f66811f34c2b13fa952f50832b69e8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532790, "uuid": "2b38309b-7c72-4f93-a4ca-51138cf55a00", "value": "T17FD3E0C9599AC8B48F1F682847AF5D078ACEB153061DC9C1BADEEF643F025B135B94E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532790, "uuid": "ab616a5f-09c1-4943-a154-137c33722a23", "value": "768:MIueOrYIN9Sg6sbTc+TXBRls4rR7Pt8HzGnDuPgx6hm6O646U6lGiF1m/nEs/zxo:MVrYw94sPcKXkjR7oKHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776532790, "uuid": "f99700f7-3228-46b4-8c74-1dd79c59a707", "value": 135015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776532790, "uuid": "1aff1808-1f3f-45c2-9343-a8a8c0a30db3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532790, "uuid": "713f2590-5759-4eb6-a58a-10b776bc2a97", "value": "Office_Archive_Clean_379.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8d9fdd-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537191, "uuid": "4e1a1f0f-31a4-47d6-a3a3-ffc00a84c8e8", "comment": "Malware payload", "value": "13649d4da08f8a839ffaa83e5ca4bd86", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537191, "uuid": "405af7ca-734c-43c8-8034-899919ec838e", "comment": "Malware payload", "value": "4198e0eead89de0442e42041c730f6478c5e761f65d33ba118b90f3936e51fbb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537191, "uuid": "69df9958-5ce5-4b8b-b70b-ce6804ef3664", "comment": "Malware payload", "value": "fc6f3739501b0aafe0b38999cbc49c811e69949d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537191, "uuid": "06dfb9da-b1b1-45e7-98e1-85131343427c", "comment": "Malware payload", "value": "15f0e7f509f910659e8e9574aca4f4d2a0ee4c21be11d2a3c7179ea830d1a14f3f20b04737ba982bea8ace3a246a3aa9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537191, "uuid": "9997bd6b-c4af-4052-9f93-e709c38e842a", "value": "T1F423F1B94B0CE92AC8D35337E18527591F0F0F4309DBAA45969A1E4709365CECB9BA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537191, "uuid": "6696eb13-53fa-4713-85c6-4d3e8ac5d923", "value": "768:QC9nasMjdcUwTz6SE9rAYCZkn9pq6YvL7NgHuj9b9MBh/FfRg8g7Aik/dzZ33:QxbpcUwTz+Ft95Y/+echtTll3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537191, "uuid": "e1df6d8c-06a9-4b92-9ea6-b79b8f2a825f", "value": 46230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537191, "uuid": "3289fa06-b0df-4901-a7eb-53d7057f5177", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537191, "uuid": "20db9b42-739e-4f72-aeb0-01c8c03f583b", "value": "Phantom_Mod_-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687b8e07-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530471, "uuid": "4a671829-c8e3-4d8a-bb80-6275f358be2b", "comment": "Malware payload", "value": "ce734ff5fb8d8ae9b0d7b11dc71fd2fa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530471, "uuid": "4749df23-dda5-48c6-b5df-fa0774639908", "comment": "Malware payload", "value": "420a6afcf054156226662941a20afb81d4ff2a51d2fbb96f5256d6a96db9468e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530471, "uuid": "47fa4272-119a-469a-ab64-1a2e5c4d89ac", "comment": "Malware payload", "value": "83d95cb519d5414d0799bf4b33b739539e49584b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530471, "uuid": "9dad98b8-6557-4b62-8149-36b83fe96eb2", "comment": "Malware payload", "value": "b2020d3162ea6f4c54bcc10ab714c68ea9ac243bfc1c6d325c9b3db90689b4e70ba4aef5e9b7e099d31c0f8af8355be9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530471, "uuid": "b445f73f-5f20-49aa-954a-6c981fa257b7", "value": "T188D4D0D6D32C4822C51B5B77E2C93879BEFB4CD0B403E16B20AC1987B5ABC95A67C714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530471, "uuid": "2786b73d-8241-444b-8e2b-cf236c877756", "value": "12288:wlIdYlrm3MdMAmZuGwPYoVzSvlocPraYHIjz7gynczQtEZ/LjXFv16z2:we4yAmZuUFPPraYGz73ntU/v1N6z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530471, "uuid": "59f7ac77-614a-4e78-8326-7635f72d5263", "value": 603211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530471, "uuid": "82d475bb-d734-47cd-9e59-fe29d24b78cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530471, "uuid": "58bd43be-ef23-4b5e-8dc1-3600d296a938", "value": "meteor-plus-1.21.11_1.0.9.5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb62e89b-3b61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776542663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542663, "uuid": "754235ac-38a7-4a79-a22c-ad72a51632e8", "comment": "Malware payload", "value": "d9476213a17d443e1055d055adcdbcb9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542663, "uuid": "bc3f7409-0be8-47bc-bc7d-3d559952431e", "comment": "Malware payload", "value": "421e447d78cf73246989a6fc980cbcfaf128655206baca1618f1a20edba88fd9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542663, "uuid": "b11211e3-50d3-46e3-94fa-aa8f0894937f", "comment": "Malware payload", "value": "469c6f7d92d60094a876c5df50f8eb0e3b0e7c4b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542663, "uuid": "cc85a514-a0bb-413c-9925-7f69ee148cea", "comment": "Malware payload", "value": "eec0e62ac21a58f2b9f6ac5336e992ef2862762800009b7a21821592ba269591ef2513c0cdb29791ec318eda850a4d40", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542663, "uuid": "21137a1d-8d66-45bc-b411-d4b52541cab8", "value": "T18CC53332B65B5A78D15BA134D4982862B81F2684DE0B3C2E7AF01BC75167ED9C7373B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542663, "uuid": "ca7f2596-1126-46b3-bdde-0be22753430c", "value": "49152:4nWUZ5Ru2MWyhaYesWgO8zfQ6iOCCv2yPT/EDGV6eCyRzf77MLNlfCGCA:4v5u23ywYe8O8DQ6H5v2yQDGQeCUD7kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776542663, "uuid": "cfa3521f-ea5a-4d2a-8503-dc2dd9685f0b", "value": 2674828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776542663, "uuid": "7d748862-9919-4813-b659-9b00a14038c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542663, "uuid": "d4994b83-8de1-4c40-bb5a-c2eaeccaacdc", "value": "MeiLaaPlus.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e908c7bc-3b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776555598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555598, "uuid": "aa3fe85c-6a3f-4d16-b3bc-28e5f40b8a05", "comment": "Malware payload", "value": "b2a3b965726fbaaf9f604676a0edf18f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555598, "uuid": "6a566b11-14e8-4819-a54b-7225d7b313c8", "comment": "Malware payload", "value": "4358d6592d05dfb4c311d9826e8fda4945c2abb0f2195b6e7d801b50d9f07fc9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555598, "uuid": "83986fb9-ebf5-4e1d-acfe-fb4321c59f98", "comment": "Malware payload", "value": "8794e9de8fe68adec1128a17136ed5c5483ab0d5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776555598, "uuid": "57f9fbc9-1d82-4f3e-a04c-12806a1abe0e", "comment": "Malware payload", "value": "198e311e83033a8e7f9e1d529709cb486a7d34159a0c19289d12d94ed9c6a6b9a78dce74ede518170757a57f3df8ce69", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555598, "uuid": "359310e6-f482-40c2-9169-268c95f1272b", "value": "T1ACB2E0643412991DCD4FF77CE1948E2BBC4F128B9859B15733B01C3F8942AB9AB863B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555598, "uuid": "b232b81b-9d3b-48fd-a07f-ba9395b25205", "value": "768:R9n99meVNi/PqORTlM6DcZJETZmiEuRuDaVi4TYW:nJwqGTlM6orET0i4aVizW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776555598, "uuid": "b5b173a8-a187-40cb-81ad-d08a37a2d077", "value": 25673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776555598, "uuid": "2d11b58f-f7d4-4028-8cc2-32d0e4c91d97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776555598, "uuid": "8c1084cf-46d8-47ee-bdb8-8e0a60a13aaa", "value": "Razle-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82091721-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527078, "uuid": "e0f2b2f5-78d9-4c61-bba4-2a2df75c5796", "comment": "Malware payload", "value": "2e4770bc02a9590545e46c39061e15d6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527078, "uuid": "8672f48d-be86-460a-80e5-d50253cfc6ce", "comment": "Malware payload", "value": "442ef978ec235870fbb56c5f63350c161c2e328653c3ba3b4044727990f767ff", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527078, "uuid": "7c98e6c3-1044-4084-b6f4-0bfafc407567", "comment": "Malware payload", "value": "25d62d247397402f4fbca5a6b33ddaf5054a6d96", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527078, "uuid": "608699cf-5c19-440d-ae1e-cc14f1adbe74", "comment": "Malware payload", "value": "0d1d0b78053bc0a2fac9c0462bbabe245e24118f18c08f8beb3a2fad6fd217087aa0ed5d9b3dcf1e48444106c7ed9878", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527078, "uuid": "9d7cbc59-e4cc-49c0-b35c-fd976b85fe89", "value": "T1DAC2D055D528AD7EEC07C536A6C3DD26988C0BF4C00EA72F2568CC2244B7DEB1F48AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527078, "uuid": "df8a24ff-6c79-4acc-ae8a-a581896c1ca1", "value": "384:e33w9gntgyV0g70tvuIrybHBsduiwxW6lefWoDER317hJxzkulV25m:eH9nLV5avuIrybmduiwwq2+/ZlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527078, "uuid": "39fd9401-8373-4e8c-8966-ae9f02fc7a00", "value": 25768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527078, "uuid": "d58e6635-d2d3-4826-9c8f-94e1bb25569f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527078, "uuid": "1ace5c19-e8af-4ade-81d2-fac339139ac2", "value": "Wypychanie-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e717f52-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484498, "uuid": "2031e40c-ad7e-4646-aece-84a76d1c1ec3", "comment": "Malware payload (Mirai)", "value": "9e2984a48f6726b8dab6b03cd7716601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484498, "uuid": "9df2d284-2477-4c10-9ebb-169a2930b8c1", "comment": "Malware payload (Mirai)", "value": "44b97a97d838e2de1e86196b2294ebf829406901345e44fea0f9821c74c050e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484498, "uuid": "5977cc97-010f-4238-a19d-6ac74fad1c84", "comment": "Malware payload (Mirai)", "value": "bf94f5432ad1391c5b02ecc9152afe7eb3c38d74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484498, "uuid": "a0a1b13d-6220-4e8d-be84-29a297debb9f", "comment": "Malware payload (Mirai)", "value": "465a2e27413ede381a5801c8120c5d018750af6755744013681c6e993a02605a2d317515b2c94a3b0acde894b150057c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484498, "uuid": "d0393571-3a1a-4688-82fe-c0df08619099", "value": "T1DE338DA6C5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484498, "uuid": "ef55d725-4f7a-43d3-af71-884e7a3a020c", "value": "1536:5aR5ewtQZVt8GdcPs3q/aKlMLEm0DOFCn:5k5eDb2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484498, "uuid": "37fd157a-396e-4183-895d-b188c906a95c", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484498, "uuid": "92fea5f9-5ffa-49c6-ae89-c7022474095b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484498, "uuid": "cd6af490-a208-456f-9bc6-2c45ff3bba09", "value": "Josho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6472ad56-3b33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776522733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776522733, "uuid": "13fd08c7-f98f-4a72-b090-7697c2ea6554", "comment": "Malware payload", "value": "92405b680fc8849c148cebb437300e1a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776522733, "uuid": "5acfe6f7-f3c3-43b6-b307-8c7401934f25", "comment": "Malware payload", "value": "44c171d1006bbd038774cad96aca4d537184f0b400b839ef7b099a4178c45f1d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776522733, "uuid": "b292dd76-fc8a-43f7-bc48-b054bd42b693", "comment": "Malware payload", "value": "a3bf2a1c3badb58b4f0dcd4eb7a825637dced5c6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776522733, "uuid": "cfbe9987-a831-4599-b876-bd2ae383acbe", "comment": "Malware payload", "value": "1134f2d281349e05165715ee54ba1fcbf800b5885478aaa11c1a809ed307588191cc3297f5062f00d9a087e09127eae2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776522733, "uuid": "516d70d7-48ad-4c56-8ea2-336f079e57d6", "value": "T18596339512086DD0E4EB6C96CABEF979E5DFB1F289D22EA58DCD02B04F1F4099C5130B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776522733, "uuid": "2095c349-a54a-4435-9fd7-c28320538b9d", "value": "196608:mdNz3OmWEArx0Qqr4wK5uWsgGKf7TIUgVRfWXxo7RH6RKa:qF3wES/1sgP/ITVQOl6RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776522733, "uuid": "8b109a4f-da7f-4626-b718-e203b60f333c", "value": 8703357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776522733, "uuid": "f80888b9-c106-4aed-bfbd-8e70ad2df5f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776522733, "uuid": "fbddc892-1e2f-4cdb-a22e-1a5c77ecc2d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e06cdc3-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486323, "uuid": "32797b57-d64e-4993-822f-194070f91bf2", "comment": "Malware payload (Mirai)", "value": "4c52625e2007a672330eb52619d9d352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486323, "uuid": "00896f72-0444-4bdc-b336-ac796392a49c", "comment": "Malware payload (Mirai)", "value": "46244e7b99f714ca794fba9b1a27a949db3ec135b82651115cabfa6bdc540b69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486323, "uuid": "b2cbf6bb-e583-4efe-bbb4-d8fec0372dfd", "comment": "Malware payload (Mirai)", "value": "a5b627f489fc1d0c2f437ef4c3e3d0dbf854d424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486323, "uuid": "2702d80a-c3c5-4aba-a55d-525066898c31", "comment": "Malware payload (Mirai)", "value": "13badc734c202a9c07652b6dcb2962d5903b43ad30b866930c0652f0ffe22939e4e4135b8cdf0b61236adb3a61989a67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486323, "uuid": "4c5e18fc-639c-4c3e-979d-7a724e7370b8", "value": "T13983E547B7118F11DB5AD63046B78B5B6AEA12C217D29946F32CDE103E6034C686FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486323, "uuid": "831bd307-04fc-404e-b7ed-097b98e00060", "value": "1536:Wv+MjIfNVJl+Yeg5GbHFF7ZSy/gCuZJICzEPi/+tsTDMuCJsLthmMwN:nHTGZjRFdezEPU5NLzTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486323, "uuid": "77cdb517-db07-4580-986d-a3e602a71148", "value": 88244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486323, "uuid": "1796801f-6119-4c56-a363-0ee12d2e0936", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486323, "uuid": "69736005-61ed-4d33-baff-734b80d81d65", "value": "alyssaamips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f760c8f-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533999, "uuid": "b5bb77d6-98e3-4060-8f6b-d2e9e3eba2d3", "comment": "Malware payload", "value": "6e222c3e913a95f6dbf3a07d3fe62c33", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533999, "uuid": "11ce739d-392a-4e97-8965-edf6dbfa3cae", "comment": "Malware payload", "value": "46a2649401a88e2f7750ae075acb62cbc49f60c0ae115ca12f5e70b06e9a8a97", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533999, "uuid": "34012f09-56a5-431b-91c9-6ca14f46e4a4", "comment": "Malware payload", "value": "666b4a9c5fcecca4758ced48fdae191079eea381", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533999, "uuid": "794e7fd7-3d54-4f88-abfd-9589e542a498", "comment": "Malware payload", "value": "b381fa90cb1a95a1a28c1fef7fccf5d872dbc3a21f61fed26645aefd13a456eabefd48639e2fb928298c46c665cb9f13", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533999, "uuid": "f975cd40-df24-4eb7-aefd-fcec1b015e0f", "value": "T1F1453370006841B7C8A193FDF7BA9273FE4EE7EC8EAA945C40E9164A065C14D2538BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533999, "uuid": "ed4b3d2e-01cc-47d1-964e-27a8627bb3b5", "value": "24576:piPjAdHofoi7JBjzoe7djwnFrMbQo5LcobQ93E4WNAUTpD8Ix9Pbt6pcS:pXo1NBjEedUVMbQodJQ56AU+IxBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533999, "uuid": "3782c6d2-d946-4004-9c7b-7612ddaaf0b4", "value": 1193505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533999, "uuid": "633eabd2-6b5b-4cbb-bf6f-ae3655f855de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533999, "uuid": "297079ce-f2bc-4957-8305-25eedb30f85d", "value": "BreadLife-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e754227-3b05-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776502967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776502967, "uuid": "4c9c1ad1-fdbe-4f16-80d3-eb680d9cb094", "comment": "Malware payload (NetSupport)", "value": "e9e84b505d59258541b971765ef0393e", "object_relation": "md5", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776502967, "uuid": "41292d4f-05d2-4b31-a825-99a64b2cce9b", "comment": "Malware payload (NetSupport)", "value": "46a3313052ca0cf714809fe7db5b728eb36070b3a63f5bf10f7b276433409a0a", "object_relation": "sha256", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776502967, "uuid": "208665ec-427a-4652-b729-22bb559ee27d", "comment": "Malware payload (NetSupport)", "value": "6b2b9c7bbcd5e39fb678aa6afdd7e7593c1c78e3", "object_relation": "sha1", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776502967, "uuid": "79c800fe-0993-4dfd-b978-04781ce62e6c", "comment": "Malware payload (NetSupport)", "value": "33d8698b8b4599aa682509c578d11985cf711116734b274b6b27288438e8ed9a9e1b466fa539ba6e9bc4be2d22ffccb0", "object_relation": "sha3-384", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776502967, "uuid": "72c5f63b-9e3a-47e9-9e85-2b18325383bf", "value": "T139647D16E6B614FDD177D578C9535406EAF23C4643A0AADF27D08EB21F27AA08E3D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776502967, "uuid": "51739611-2394-41b5-bafd-e8951c3fe386", "value": "4cbdb20d517ae984c2702904629931ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776502967, "uuid": "df9aa7c7-24ed-4fde-b722-e9c805357b58", "value": "6144:evdSf+0F9KeCKBOBQFsRJ/j5N6Q56DNi:e38K10O+F+176Q56J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776502967, "uuid": "fe5f0e07-2d5c-4a4c-a5e6-a994cb87e12c", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776502967, "uuid": "ed35c99e-8943-4a53-a116-3d8f632c3f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776502967, "uuid": "debe3c80-21e8-4d7e-95fb-762c3a100adb", "value": "46a3313052ca0cf714809fe7db5b728eb36070b3a63f5bf10f7b276433409a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8453929f-3b0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776505178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505178, "uuid": "0cf0a645-eb92-4510-80b9-1cd9fd2c371f", "comment": "Malware payload", "value": "b7a6a607e1c28187953f3ae5568c4674", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505178, "uuid": "5ebf466c-b9fa-45ef-b4f3-22cc811e455a", "comment": "Malware payload", "value": "46e411ee201466ddff777b7a5b506e290cbb85e16df89a25550538764f559f5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505178, "uuid": "db6dcf9e-1ade-4298-9da7-7dbe4ba3e081", "comment": "Malware payload", "value": "50754ab25f843a97c4323a878534a3f186dc7512", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505178, "uuid": "a6f7bb72-961e-4df4-835a-a6b9b914576c", "comment": "Malware payload", "value": "4a997b2858ece0bf21a9df7fbc19ba198855f0c74f576bdd66219d68a79a45b4f4eed8aabcbadd3a8160ba77e90e9ca6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505178, "uuid": "dad9d5e7-2f88-4e5a-8edb-8ceff493d682", "value": "T1E7137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505178, "uuid": "171dd4c5-c6aa-458f-8113-77bf33606d03", "value": "768:bQXRWNGxV+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bElxZcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505178, "uuid": "420c7b22-dd50-46c6-8e01-91ff2131d95c", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505178, "uuid": "bc6a60ec-83ff-4d3b-973a-761c54dd5046", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505178, "uuid": "bd467f25-a45e-4a2b-870d-b8bd0c41e121", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62931d58-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530461, "uuid": "dfcce430-8bb1-4211-9f9f-b3ea194ce24b", "comment": "Malware payload", "value": "91015e2c3c5f2c92949116a5b4fe86bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530461, "uuid": "684052df-1cf9-4d49-bf29-6313d8122dbf", "comment": "Malware payload", "value": "4a583d6e88bbd48d86d6f64312f30a3fe5ce392f1d62032fd501da19ef238480", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530461, "uuid": "e4b035a6-2186-4ee7-8cde-f687019995fd", "comment": "Malware payload", "value": "ba5f2ddb7307b1ff32ec34a909d9c4c0e7dad919", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530461, "uuid": "c22c64e7-faec-4612-84dd-340a96b31e49", "comment": "Malware payload", "value": "9bdd74aeb163ba2dc0b6a89efdcf9510c290c6e060278dfd1b5910f948422966815cc38bdf22d4d8697ed730f4a61719", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530461, "uuid": "6cc00aca-ec12-4744-b239-cc834a99391d", "value": "T12E041291CDD58870EA02773126E75E5F7AA3B5B5888C0857DDC48663CE3C6EC27BC268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530461, "uuid": "1314ebcf-96fa-4cd4-bd43-30fce141b411", "value": "3072:Knp8x2VBa0yaPiTSo/EiF99UiQgVvX4hDiJ2msSJGmO+WHqSZ9ffX3/owbc8:KKwVk0yaP8/EZiPVrJ2Qt/sF/Qwbc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530461, "uuid": "13dd318b-9a38-4434-8911-c3ec7cb35ffd", "value": 179377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530461, "uuid": "bf2bde7c-3e59-4f3f-a170-8d4ad807c4df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530461, "uuid": "bc3a1bc3-9570-44c5-9d9e-d2c39df3f2be", "value": "KryptonCracked-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea581fd-3b51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776535501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776535501, "uuid": "fc822042-a0cf-4479-8cad-22946a3c4ff1", "comment": "Malware payload (Mirai)", "value": "1427e39724e8a3bc4eabbc8704017377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776535501, "uuid": "d67f6d90-53d9-4a37-bcb2-4d84f6d77df7", "comment": "Malware payload (Mirai)", "value": "4a832f062624c08ef83d3643c1afc494633aca7c24ffb12e1434d043530ca882", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776535501, "uuid": "d1e31703-0454-4d1b-80fb-ce72c3a4cb38", "comment": "Malware payload (Mirai)", "value": "4b7230658b96a501d57aaf1c887c36b2b98e0f37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776535501, "uuid": "b0e17995-963e-4cd2-bb15-7aff0b2fc267", "comment": "Malware payload (Mirai)", "value": "ad91503b6dc9e1474ef9b67ffbacd9a53471445f42c0f7442e8544486e01bb9a58ab1713ea424d79a4c37bac21f9b74a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776535501, "uuid": "63932e31-75ff-4f3b-bc6d-4efc475be31d", "value": "T16DE3F749BC819B10D8DA36BAFA1E029933575B6CE3FA7202DD245F3177CA95B0F72601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776535501, "uuid": "e46deea9-b455-493f-83f6-3fadb5cb9dce", "value": "3072:nWDblb6kmLJRAPf6MSW2H0j3AgnaqKFyvo0ZVKW3A3jA5PeW:7kSPAX6q2HS3fnaqKFyvo0b3A3s5WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776535501, "uuid": "19457541-f4ee-4a4f-ab43-bc052c454561", "value": 150864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776535501, "uuid": "97b49e0a-6a6d-4503-be89-2bd8041a5cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776535501, "uuid": "ff01cfd4-892a-4107-ba8e-8e282795e7ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac4414c-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484492, "uuid": "956dfb2a-da27-481f-a389-d8620baf1574", "comment": "Malware payload (Mirai)", "value": "3311266872f5b72bcfc50f4a114e059c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484492, "uuid": "1b21d89e-b697-4fac-b817-cb8fb4f61221", "comment": "Malware payload (Mirai)", "value": "4b8439389ea3a12075d752b3c10a29095271bd56fb23bfa969d18ea654fe7271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484492, "uuid": "257911db-021f-4aa5-8149-8b04b39f1790", "comment": "Malware payload (Mirai)", "value": "ea17a8079d8723b29d8565bb6b9f7ccc8d1cba91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484492, "uuid": "5d4f5aa7-d808-4e8d-9b6e-662a070c62b8", "comment": "Malware payload (Mirai)", "value": "fe260a3afe50ce445c37e77297942077f12b5b76be9e9ebd30a1ccf7c38a48af67c5d55ae45e4ec669d52fb545514724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484492, "uuid": "2d7032ce-47f8-4f94-b92b-d33121beb0b2", "value": "T1DD63A506BF214FF7DCAFDD3749A91B05258C640B21A97B397E34D828F64A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484492, "uuid": "d8a74dfb-f63a-43fa-ae62-9582613ec0db", "value": "768:QxNCJ0EYlDYhHnKwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYl2FwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484492, "uuid": "498ed4c2-98d5-4583-81b1-4d00c70a8353", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484492, "uuid": "043e0fff-87e5-48ee-979f-62429dc88cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484492, "uuid": "08aca01f-0edc-4f2a-83eb-e5b499f039d9", "value": "Josho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a67f46e-3b58-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776538715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538715, "uuid": "c607c41e-f45e-4a0b-b90d-9e0f6374a8aa", "comment": "Malware payload", "value": "eeaf981cdb0f28a4a9764ec4620c93f8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538715, "uuid": "a753c046-1547-4325-8a12-312fafebdb39", "comment": "Malware payload", "value": "4b8dbadf34c600b1716de7e9684630f1d2152d70d14639de3169bfb36188a721", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538715, "uuid": "5c420577-0c41-401c-a6f9-f9d6bcd3a68a", "comment": "Malware payload", "value": "df6db7dc0d1612b07c84b04d47e25d01fef62738", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538715, "uuid": "9a2034ef-3b15-4d1e-b82e-c24b2b75a45d", "comment": "Malware payload", "value": "16a6eb8ce8d9a600b4d515551dd9d2831ff61052aeae20a45f8cce6329dd5c067cebdfef0e5320baea2745715317d25b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538715, "uuid": "c625e04b-f0d8-4121-9f18-018f618ff196", "value": "T17692D72238159D7BC092E260ECDB5901B7A5A1C760027FC0B6DF30A563779CA973DADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538715, "uuid": "5b82c2e6-e383-4f64-ba9c-12f8c4fe1626", "value": "384:GrDYO/DMdq9Lh2zuyzqlBj/vBTQIiSgjGir+FZjcXlWhW+9QNNoHvyHWmoOz0rAQ:GIOj/7cpgahr7NQOBetEDdwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776538715, "uuid": "27fb953a-5e7f-4f20-b0bc-6aba1656da91", "value": 21148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776538715, "uuid": "c3899075-34cf-470f-a3c5-f992fcc53093", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538715, "uuid": "ecf7801c-46d2-46b2-bad5-075ddd49c717", "value": "File security(1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5b85a2-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545646, "uuid": "a5fd19b8-fa3b-44a4-bc92-29273db03997", "comment": "Malware payload", "value": "4607970d801d5ad4d7113157f7ec67a3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545646, "uuid": "5868e653-6efe-491b-90a2-539d163676de", "comment": "Malware payload", "value": "4bc2b8a90403bb567c259709d7102bf6856c64935021a2595406128a7d4f84a3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545646, "uuid": "85572b18-ede0-44a6-b478-47d8fe529953", "comment": "Malware payload", "value": "f503e748e8e4d678f4f70f86c8e38e7860bd1c69", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545646, "uuid": "95ce6553-b906-4e0e-b174-3cc784285945", "comment": "Malware payload", "value": "79cf286500f3cdc07f22464ac3165f0a5a1364cc69c0f19e36f8de4f3329483c739a7201af7c385bef7a8fe6f0607e3d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545646, "uuid": "fb81476e-010a-4577-8525-34df2b3fec39", "value": "T16A84231FF8D3B6BDB88760784BF27687E35E2B97E171D15CA80BB793082139A5204463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545646, "uuid": "f0d50035-a524-4058-b0fc-8eb8e4f9f5d0", "value": "12288:u+XkhA0ICol07C1Y8FfPkDgLMtY5Vfee9bFSIQTU:NXkhIFYL8K2M+5V39bFZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545646, "uuid": "ba938312-9636-4d1c-8f11-699aa1e28548", "value": 394463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545646, "uuid": "7e2be4f8-92eb-4925-93ae-4f71678cab6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545646, "uuid": "17cf76ef-5087-4b85-98be-3fa023083794", "value": "smarttweaks-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239b39cc-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492989, "uuid": "50f487b8-5f07-4913-8909-231e459ec8a3", "comment": "Malware payload (Mirai)", "value": "2715f0eb96cc683e6e5eaafca7f185f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492989, "uuid": "e17314cc-f963-4332-a3e8-453a1aecc7ef", "comment": "Malware payload (Mirai)", "value": "4c24ffc09a1e90cc4fa133ed3eb1f7dc57275ca4b8abdf3e17af67875ea7ce0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492989, "uuid": "e9ed1a72-34ec-431f-82be-690344d0c798", "comment": "Malware payload (Mirai)", "value": "8494506739f1a791765e7b4ab371ce24db826c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492989, "uuid": "07f20f63-e783-4399-94de-c660a0f6faf2", "comment": "Malware payload (Mirai)", "value": "d4d758805ff60df4b445b7672270e487d5384f244da8692c640357933a11eeb8270a2dac0d157f029b9943b073eb06b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492989, "uuid": "ee79adde-d073-4cdd-9066-d2c50d11dcd0", "value": "T157634BCAF983D5B6F8970930107AEF639DB3D6BE21A8DA43C3A455369D12503F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492989, "uuid": "82776e55-5196-4bbe-b141-fb6016f13899", "value": "1536:TtWvgqAcQQsTb6vF7lOvZOWsIyq3XkZSQN:TtDqAasn6NJOvwfIyq8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492989, "uuid": "45cbb3cc-da03-4c6c-995f-bd8e29b3c40d", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492989, "uuid": "6133997e-f016-4939-ac26-a62088066aba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492989, "uuid": "0edd06bc-f767-4a7a-a91e-65ec2c20e009", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e617bbe-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530454, "uuid": "9b6133fb-4287-4543-b039-ea18a8a5612c", "comment": "Malware payload", "value": "b9f307ee6747c6e2bf56b55e7a414f7b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530454, "uuid": "9135667a-f801-42a3-b981-7dc410d19bbb", "comment": "Malware payload", "value": "4d306f7a630176a6d32806d65d500adbd9f796784c31ebd6ff56ee3064d5d9fa", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530454, "uuid": "033263ce-dcd1-490a-8bfe-ff1ef61b9d15", "comment": "Malware payload", "value": "61c1b98c89abd4e2650e92c192a461687a0db10d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530454, "uuid": "2aaf9571-c059-4424-9272-f99f6482b816", "comment": "Malware payload", "value": "b151e893e71c1c8524ca5b0750d1ca8ae46929e5cedaecb5a0fdb0e0c8cea28a1ad33ab09930387454ff10f9373b2ddd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530454, "uuid": "f0d4d3bf-e6f3-48d9-9bef-e22838ddf420", "value": "T13B45F163E32E0966E42B8D3AE0861D233EA546F5930BB43B17B8CD5748D79CD7F44298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530454, "uuid": "ec320572-c133-46a6-944b-f5de5b69539f", "value": "24576:sdynMTFDgaCK4BmcPSsDMd2CNeo2byyxt69C3RRm089xyt5XNhCjpcK2kq9D:BStgSNcPSs422eoWyyxtt+xW59I52ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530454, "uuid": "c55e356e-6ebe-4305-aca7-c3de0992a9b0", "value": 1202050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530454, "uuid": "4c301948-d382-44a1-af00-15f7f47eb894", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530454, "uuid": "01844d52-e5af-439f-90e2-a05460659c90", "value": "Krypton-Client-1.21.10-V6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcf3b5d-3b7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776554237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554237, "uuid": "66250930-b73b-450a-9111-7b15e3672338", "comment": "Malware payload", "value": "f776dcbcaaa9e6e18e0b57c5723ba6e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554237, "uuid": "fd78e006-9681-40ab-b921-bab8b8ff9ad5", "comment": "Malware payload", "value": "4d4191cb20686fdac643e121ef3f63a4c9a40afd28a2f512caa2ce5ddb1b836a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554237, "uuid": "f01d2b87-8417-4000-b518-a67549f1fe63", "comment": "Malware payload", "value": "f7588a71983b8fe0ced724574663883e9c10c5ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554237, "uuid": "a75e9669-c995-431e-a92a-fb95864eb43f", "comment": "Malware payload", "value": "24f97d51861083b93309a56d4ba36de14cebb2ee02e34e356f20e1208557f730be7e53fe7936ebc1a0e4e0e3c6c41f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554237, "uuid": "3a86dc2a-d4c4-413f-8b37-f9928ae26d6d", "value": "T1C4434B26BE610C1BC8C8657A65E34731F7F6834A24BC4A1A7D614E8CBF24E8072577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554237, "uuid": "982bd797-4ee9-4871-96d2-84d8d4d84827", "value": "768:UkOXhv5S6UodLSmtrPn3pO+o+IEC1A0rV/5d/bC71tdixo3Io:U/hv5S6UKfPn3po+g7rF5lKtt3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776554237, "uuid": "a32d28bd-67f6-4144-8a47-01a55a2955ce", "value": 59436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776554237, "uuid": "7219eee5-807f-4f43-ac26-8d0265a768a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554237, "uuid": "3ad26d9e-21df-4151-a39d-847167540bd8", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817e25fc-3b71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776549411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549411, "uuid": "22b06af7-e9e9-4de2-830a-aadebcf8f597", "comment": "Malware payload", "value": "8be059eb69e48c71563dfa68399e92d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549411, "uuid": "6da8323b-eae0-4c94-a2d2-65f06f5581b1", "comment": "Malware payload", "value": "4d8c02745ed4c2bcd9bdb425d5763ebd1e6da459c1877fe9d0005e477622aa6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549411, "uuid": "443c0fbd-23a6-4dfc-959c-7916b6f98bd0", "comment": "Malware payload", "value": "ec1e6ca4065c304c30100c530c69a0edaf60effb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549411, "uuid": "156ab380-5b79-4098-8618-43433e1d1ffc", "comment": "Malware payload", "value": "4750619aae673eb26928bd159a8cfe0eef0216921830e453d79a4c07aa14f2b5f9b27bffb7df45039a1fd57115990cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549411, "uuid": "04d1b33a-8b35-4e12-bdee-15aaeff41ffe", "value": "T175D4EF83F7451B8DC9AFE63AC912237FE67275925710871B63A05B272F276701B2D382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549411, "uuid": "d1db0fbd-f884-46e0-a5f0-c95e8548aacc", "value": "2ce12fb918ee1216cb238b4c8f20b6bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549411, "uuid": "0309973e-bcf5-4e48-acf5-29e5e0709138", "value": "12288:nHNdZk9cGXijuual+gr1KsGYohM8bqSbCdkWdVD:tOcviuySbCdkWdVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776549411, "uuid": "cc56f7ae-a598-4644-9dd1-3cdc0212c6f5", "value": 637176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776549411, "uuid": "e05c08f3-a697-441e-9c16-01d5c2879b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549411, "uuid": "4ab5cacb-3252-4297-93b1-88036b6b95f2", "value": "photo0418699.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19272fd1-3b69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545800, "uuid": "d6adcc28-8070-49ed-96cc-2f4e9a68311d", "comment": "Malware payload", "value": "2e73b1ac0694ed5ecd6e0d78cc25dfc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545800, "uuid": "1a549e06-7f19-4fa5-9614-b27c48b9c0db", "comment": "Malware payload", "value": "4e41307bbd5325150f48a5b79144f48f733d94804f8a958ffa81386f7322effa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545800, "uuid": "09892336-3deb-4114-be57-8d86c234ad04", "comment": "Malware payload", "value": "73f79f542eaf0839f2f850ec2240e3542d20a43e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545800, "uuid": "7439e83b-3d86-48ab-b494-295408f1d118", "comment": "Malware payload", "value": "0967d965b1104dd72a7608dd4a8531544d49bfd66daeb07c55966e73eb4ceb5f39d78fd1232e8550c1703f6633213a64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545800, "uuid": "92e761a0-d7c3-44bf-a7f7-68e1b445604d", "value": "T1D6D623EDA1E922E0D8D34680B28753DE72C0255D46ED4C2C39DB1D812F12D7FA64ADBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545800, "uuid": "0dace595-d09b-4985-b970-ffd71fc30c08", "value": "49f672576a1d2e85277440214dff6b1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545800, "uuid": "c82cec7d-2310-458b-a927-02056c2c8ea2", "value": "196608:Vz9GLLy2Qw1Bov0x1MuYCD8aT7cRNXTsMDGOZF1+GrPY0BMxvsi9jKVph5MoNUR9:Vzkadw12MJBvcDDscGzGrBM/9mUbA9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545800, "uuid": "a71c9772-7242-4d3e-b858-9d96e9ba111a", "value": 13583792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545800, "uuid": "d4697269-bd9d-4770-a394-2924be299029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545800, "uuid": "792a7634-d0b9-4da6-bd87-10d0056e67e4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3b916b-3b77-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776552164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552164, "uuid": "da9d487b-8d22-4cd3-a2af-7a97174299b1", "comment": "Malware payload (Mirai)", "value": "47f83028439efbc1987a64757e97a1f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552164, "uuid": "ea7cdaf1-f616-4e19-a8b2-ac3f9b3b90ab", "comment": "Malware payload (Mirai)", "value": "4f2276b4001e5f8a71c50324938fe3305d6f1e52facd1229a964a6cd58d5418f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552164, "uuid": "8fe05b52-2c05-4cb0-96fc-b3dccce5ab6c", "comment": "Malware payload (Mirai)", "value": "7c87ae75161b176f719c5502bfd43f5007349c8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552164, "uuid": "9bfc0805-e743-4afa-992b-3b6c2784ec9f", "comment": "Malware payload (Mirai)", "value": "b86fbf6c560930dfe34867bec909d9adc2c4d2a1284a935f2e46ba7b82452dfada3a1247d2ce4f56864911211da8bf6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552164, "uuid": "66c9726e-becc-4ebc-ad02-e867d498ab33", "value": "T1CBB21B81B4D68F4AD6C16676BA9F57597302E3C8D2EBBB13D40857107B5B21C8E3DB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552164, "uuid": "7c44c567-2c8e-49b1-b667-68024bdf6ed7", "value": "384:a7rkB9gh/unlN1dFtV9lN1dFtV9lN1dFtV9lN1diKyaCqS6iKyaCqS6iKyaCqS6R:8reo/unlN1dFtV9lN1dFtV9lN1dFtV9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776552164, "uuid": "311767a2-cb0d-42d9-95b4-bddeb56a80d1", "value": 23924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776552164, "uuid": "97ec42cb-bfc4-4cf9-8655-fd07993cc6a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552164, "uuid": "b62132b6-d680-464b-8d51-ffae10eafe77", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a13932-3abb-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776471085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471085, "uuid": "7ec09572-8aa8-4337-a7de-787b5aaf53a7", "comment": "Malware payload (WeedHack)", "value": "4632377a294908485d45aa584d7e4aa1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471085, "uuid": "79a6a396-d5bd-4e02-ad3d-cc7ea13d3815", "comment": "Malware payload (WeedHack)", "value": "500a4bd3ad5c9ed876efef90e0f729afc7e926b7db21f03526bd6e0ed380c283", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471085, "uuid": "a6c10cc6-923d-4209-ad55-8fefc7ffd6d1", "comment": "Malware payload (WeedHack)", "value": "51fd8bbe012207e58db29e6bf53bd3e6a1d0369f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471085, "uuid": "ba0bfebd-00ab-4619-b665-ec73b2f034f2", "comment": "Malware payload (WeedHack)", "value": "780e7eb7d0e68f98c0c8eada97cfaad3fea8ee443747e5a1ff25fe8251136dd4f315e78459702eeff877d4ad145f05db", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471085, "uuid": "4e21c66d-ddbc-452e-a463-c87ff38a422c", "value": "T135C2CFA6C715C923E557C23A848D0EB82C7D23D0FD9F29A72880964F8A634D4F7DD7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471085, "uuid": "de479c89-b3c3-495c-a9c1-5874136e7f88", "value": "768:E9n1s2lXT8pKNpBBh9yYCJIlj354ZsvdYZEPtQuDJ:F48yB9iGLdYZuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776471085, "uuid": "74e1f1d6-b376-4fda-aee5-ac9550d8fcd2", "value": 25743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776471085, "uuid": "c73e2117-5817-4f9b-b338-26f0e18fc2e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471085, "uuid": "8ac21089-3ec4-43c0-9339-26eea0e89db7", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f49f0a-3b06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776503350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503350, "uuid": "46540e51-1b02-4886-bacc-e779f6e0b7f1", "comment": "Malware payload (Mirai)", "value": "825caf027236ff87dc4bb5ebb6aa76a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503350, "uuid": "dcb8a213-6d68-4c81-9c75-60ee3a645f12", "comment": "Malware payload (Mirai)", "value": "501a3926bf5424354cfd62842f224c741f4f75b3ffcbb21c4f8081f17b248da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503350, "uuid": "b8264a19-a0cb-4bf1-8329-c7a8f7b347ac", "comment": "Malware payload (Mirai)", "value": "c69822bb5033e844a14f86e914f9c4c08fbf91c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503350, "uuid": "d0ba44e6-fe8c-44b0-987d-d11d57361dca", "comment": "Malware payload (Mirai)", "value": "e46d9b5cc8bb9311d9effa8a942817840b9813e3974a481d2a050f0ea786f3c66a084fd43c5f461229a7dce50e50ca5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503350, "uuid": "ed13e142-97bf-4199-9174-4b0628a3cb08", "value": "T1B6B42955F8809F61C6D539B6F74D82A873074B79D3EB72069A244B343BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503350, "uuid": "33536083-eabd-48f9-b255-956aa86b617c", "value": "12288:5DgV6ZEroebHKdCqMqDrJ1BFDTv778pBPE0:dgVr3bqdlMUrJ90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503350, "uuid": "a609dcd5-5dc7-4804-919f-50d2bf210d84", "value": 510352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503350, "uuid": "9a8e4161-dac3-4cea-8d5b-d9503f2f6e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503350, "uuid": "b13c72e5-4696-41b2-ab7f-698d2b75e489", "value": "l_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e8938f-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776527410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527410, "uuid": "7ad3ad32-07b7-42b4-836b-6b7367fd9925", "comment": "Malware payload (NanoCore)", "value": "58fd5cb197a2133aae39ee180b32e858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527410, "uuid": "723193b2-1ac8-4e83-94d6-92901c7b0536", "comment": "Malware payload (NanoCore)", "value": "51a5a9e0f2f500a5f296cf3cfa45576bca995f0eeb5d4d263630902cd1c2fd73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527410, "uuid": "0527f51a-b04e-4e3b-919d-6d4a3f8647b9", "comment": "Malware payload (NanoCore)", "value": "3a59606f4ee47b2757a40d9341fe96ea1a43cd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527410, "uuid": "a3e5f5e7-8df7-44fe-84b4-8415c0ab5e20", "comment": "Malware payload (NanoCore)", "value": "226b8e13716d6dd107d42ac81bb8c73f4b78a29d69ba3981c114ae9421896b16e12158b5b1ec95e9ccf4abf974ba7a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527410, "uuid": "749824fb-b708-4e7b-bb21-87040ded8ed3", "value": "T196649D5537A4B52ED29D467867116172433889E2ACC3F3CA24C876FB7B7EAE00637193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527410, "uuid": "d2da1bb5-de24-44d0-914f-7305c1f78c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527410, "uuid": "756c6d55-7a78-458b-bd66-eb8dd71b62cf", "value": "6144:aLV6Bta6dtJmakIM5e+2IOGRFAWLQWId3ZOpD:aLV6BtpmkUOAe8gd3o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527410, "uuid": "2b91a2c7-2589-4f66-aeec-1390b9e0de94", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527410, "uuid": "c462cabc-db84-40e8-823b-33377d71f639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527410, "uuid": "13bcf8d2-0659-4d7f-bf47-a6018936f1db", "value": "project1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf51752-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537107, "uuid": "6d453f7e-58db-4bd0-8b11-341df12e9840", "comment": "Malware payload", "value": "c585317adab1c7a3e8a4053fdf165414", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537107, "uuid": "91fab0a4-f824-4b56-803e-10d2f267008e", "comment": "Malware payload", "value": "527d54fcb6d94fb90342b20ee98058c209fbae8f6744e3f8cfcac662df22b0e4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537107, "uuid": "8992a8c5-7cad-475e-8956-822e94f2778a", "comment": "Malware payload", "value": "51d73b7fdb6a5dbd054ca4d1850e0218fdbbdb39", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537107, "uuid": "af010801-d853-4bb1-bcb5-2b0c098277ca", "comment": "Malware payload", "value": "213aa898a0b0ff1ff514231b1544f3b960be285efcda7f05acfbbfae5a4368b42d8e6986c57d7d8f8394b285bf49db00", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537107, "uuid": "3ecd6b10-5d2d-48ce-bf37-2c91c0db8c53", "value": "T16E142263084F8267D40FAD102A4BA8F205F2E5E10D57477A297FD6EC78848F5EA50ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537107, "uuid": "db88bf92-2f89-4e1b-a11f-3890d97d3acc", "value": "6144:VCNvZAN4y1Fw7Fu1A6tUMV5s3kCd986sL:YNvZAN48FwEyU/s3kCdGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537107, "uuid": "6b294a0a-5867-40cb-b1ee-0d47024f9fd4", "value": 199836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537107, "uuid": "1853910c-b6c4-4abf-92ac-bea76bda7637", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537107, "uuid": "e52cb4ec-19ee-4d10-a228-14b53450e50e", "value": "Krypton-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ee2d13-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537119, "uuid": "d212c63a-3368-4617-b90e-d2d56b38ca91", "comment": "Malware payload", "value": "97524243bcdf9201cca9835cadb03665", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537119, "uuid": "6ad5f902-a7cd-44cb-a102-87a2c5ea8df7", "comment": "Malware payload", "value": "52b3f614ffaad4757849f34c8e85ec8c539b34100a5fcefa1948083660c46752", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537119, "uuid": "f621c2d3-5ba9-484b-839a-756a924124f4", "comment": "Malware payload", "value": "905874b91711e8cf8f932b97acead993b1333c39", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537119, "uuid": "75b38b43-60be-4d4f-a17e-4a07facfbd33", "comment": "Malware payload", "value": "f1ad992c6787659cd4cad488dfb41c778cad5a1a26b27745bcbcdc29ba286e7a7cd9a5ee13d9ab21cd9a96ec489ecc5a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537119, "uuid": "92871862-f52a-41e3-9280-0376804c9920", "value": "T1AFC2D02AD925C861E1030A72E4983DF29D0F03A1298B759754FF273750FBAD7560FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537119, "uuid": "d0373cfc-f495-4404-811b-d368123d74fe", "value": "384:6R3w9gnt/TjD7lRStK944Am36c/cB2yAHuuPoisRwKqcIjWjk8A1Xq4rIMkx8qRK:s9n9324jd6ruQisRwBUkd/rqRin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537119, "uuid": "0eac72a6-a7fe-42a2-a95f-c04c4cc083db", "value": 25796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537119, "uuid": "480d8693-9acc-4fb3-be08-a33e05015262", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537119, "uuid": "980720ae-d881-4a27-9620-1fead6316b0b", "value": "LSN_Utils_beta_1.2-1.21.11.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed42c597-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492898, "uuid": "6b6bc8e4-439b-4218-814a-cf938c5f3c10", "comment": "Malware payload (Mirai)", "value": "a30ffefa8f87b0362058a2141fb26ffa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492898, "uuid": "c866e41b-fcbe-42af-9008-17c420dfdae0", "comment": "Malware payload (Mirai)", "value": "52f03690d6310989c61e729a9ece751827c1f334b09f6131740e68b1c0b03d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492898, "uuid": "93031d26-b3f5-4c9f-bd37-75cdf0ee022a", "comment": "Malware payload (Mirai)", "value": "7af2d30034be8b441fb4729981bbe39a435dd32a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492898, "uuid": "537369a2-c2a1-4a2e-81e4-6b4a0be5d36e", "comment": "Malware payload (Mirai)", "value": "f271cbbe38c2e6acaad752735ea203029d2bec3af1d5eb328f4f56b3852bb497a73c3c3e8939563343a758ddad6c3282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492898, "uuid": "26b152be-b34e-420e-850c-e42ee333dda2", "value": "T10A734B31F9390927C0D4917A61F74723B5F297CA20A8861F3E720F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492898, "uuid": "d3625069-6c92-466c-9785-7f02dbbea8f6", "value": "1536:U2kN6QCXbqt5guvvF7tR7SYm5BHxS1H1tTxfT:HhilL7SYOBR2xfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492898, "uuid": "6fed11fd-8267-4dde-9220-3cff8bfc349d", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492898, "uuid": "5f49a877-6c21-4cc4-b36c-ca6399ba4f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492898, "uuid": "653a6ca9-d263-4e50-b7d1-fa1924322832", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74449b8-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476997, "uuid": "fd679390-472b-4188-a538-6c2febb6dc21", "comment": "Malware payload (WeedHack)", "value": "c932b2eb8c0d729897b34c705479c329", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476997, "uuid": "f08c34c3-bedc-45c5-95a4-9e1767f8ddf0", "comment": "Malware payload (WeedHack)", "value": "5422253b06484be228481ea0b59a9b981594067b692a25aef7bfdc649a6519c9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476997, "uuid": "e5354348-ebde-4c16-a1e9-91ec720d30d0", "comment": "Malware payload (WeedHack)", "value": "e7d4e739c45bb0c2e440e340cf4d5fd2f0cd4610", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476997, "uuid": "915b4deb-5425-4706-9aa0-8453c43f7937", "comment": "Malware payload (WeedHack)", "value": "bfa1f4ca6b046bec9c4174c5557cd44678e311b254fc3c46e7d5eab5ad4e5935f01ec64d66279c2f025151aac7c81df5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476997, "uuid": "5915ee99-7468-4d67-a393-1ae3616cb1c2", "value": "T19A963373A0194914E87FC2B6578B4A9234AC12D9E50770E613AF862F1BFF4C6CBC4E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476997, "uuid": "60b6a780-4e16-47f1-9e97-3647eb6418b0", "value": "196608:4+gQA31W9Pwqq1ry0LsIcbWAwJ81wsA1B99jsyQrbsmEI:4OWGPwPOyxc4J8SsKrv+bsLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476997, "uuid": "d68ece9b-144f-4b42-818d-db023faaa913", "value": 8649564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476997, "uuid": "601f31c2-938f-4c27-b6c2-8bf40780948c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476997, "uuid": "5d738151-ff04-4d55-8c9c-4774ef5c9fa7", "value": "Grim Crack 4.1 - By Oski Configs.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7883fc1-3b66-11f1-a769-42010a9c0008", "comment": "Malware payload (Vi)", "timestamp": 1776544831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544831, "uuid": "acbd7f53-67a5-4327-9722-485bb8509b51", "comment": "Malware payload (Vi)", "value": "90c2baed190a494f8ade35d9e9208bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544831, "uuid": "b9d1d8f6-373a-4498-a4a1-a2738da472f8", "comment": "Malware payload (Vi)", "value": "5441a232db086ab056cb951f963bf3eddb67b117379cf43b5d53d91f633c48ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544831, "uuid": "e8960b72-385f-4ed4-ace1-f8c6a20e6374", "comment": "Malware payload (Vi)", "value": "1228ce4172e372428471f1f7140615d6dc756577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544831, "uuid": "d38ad7c0-d348-4f33-8ad7-1c69610193d0", "comment": "Malware payload (Vi)", "value": "fdcd5b375e6202055b3c273a4a3996527719349b7ba3e1383e526a8d66f73f25685f52b6b3263a250e776e6f15c324a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544831, "uuid": "090cdf7a-ad01-4521-a98f-7e5860294a04", "value": "T1FDC57B07AD9118B9C86EA375ACB612A13B35FC58073623D31B53B9386FF27E01939758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544831, "uuid": "92bbfe72-4fc4-433c-ae51-2ba892886944", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544831, "uuid": "8b2858c7-dcd1-42cc-b5d4-c00ff72d480f", "value": "49152:OVIqYy+beey43Y2SKrx/JXDXQPXl2hDWiTpWIHTJ6FS0:OV8NKSA12hDWiTpOS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776544831, "uuid": "8170d6a4-1f3e-4c8c-85b1-11de536c3b83", "value": 2661277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776544831, "uuid": "38749acc-8837-4468-b4d8-ea774de7186d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544831, "uuid": "c3e757c6-b18e-4920-a75f-3a4d9d6a76d7", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c230cde-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527498, "uuid": "cec3adf7-0df8-43cb-8a5b-c6466d0b2e37", "comment": "Malware payload", "value": "cc0ce6e03bec7400a038262f2b2065f5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527498, "uuid": "6490b954-7cbb-4989-bbd8-2c7678133407", "comment": "Malware payload", "value": "547408592909b01781caf568307f415fe324530680dee4592fa8f93e71b37377", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527498, "uuid": "46e3bb2f-5e81-46d8-9a41-f418db307e4d", "comment": "Malware payload", "value": "2a11d6568801442a2abb4dc6b7c1ba7b1cc3797f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527498, "uuid": "90d804e2-b47f-4702-8f55-f741f92752e8", "comment": "Malware payload", "value": "556890438bc1401a6c99e4b384279bccea9f9307df3669a49b26401aa704b53703aa3da33f935f7ee8dd4ca3d0c32e59", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527498, "uuid": "376d70c7-5820-48f9-a268-ba09258d41de", "value": "T10997132A7985B419D11748BB4681C1F2A83E3BC4BC85743F62B4355786EDCFB070AAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527498, "uuid": "40bafae2-1e98-4ddb-aeb4-8119b1ba6335", "value": "786432:5L1JUQ/sNY0bclmf0ucGdavgr5ENLxqWnZ6SisRhTsUUycW4:J1b/srbclmf0tsaGIV69sLTZU5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527498, "uuid": "fdd06bd8-cd5f-4859-8bb4-eb22aeb5a1fa", "value": 39768584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527498, "uuid": "7f53ab3a-ae5c-43aa-b21d-ffa604b0eae9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527498, "uuid": "980f856e-ec8e-4264-8afe-542d77f3d4fb", "value": "SkyHanni-8.0.0-mc1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ef4ed2-3b05-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503031, "uuid": "33cd764f-d308-48e7-a875-be0b2d0a2913", "comment": "Malware payload (NetSupport)", "value": "ca52354c3a99d1e1676080212922605d", "object_relation": "md5", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503031, "uuid": "d0f9b713-4efa-4571-84c6-eda2216b8217", "comment": "Malware payload (NetSupport)", "value": "552bb1aca55bbf903fc7da618e87799caad53ec8df879b89b4ad2f4f77785709", "object_relation": "sha256", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503031, "uuid": "27440847-1ef0-412c-8208-7c54042d81dc", "comment": "Malware payload (NetSupport)", "value": "2f1f27750aa9045191b602b338759b51c8f5593f", "object_relation": "sha1", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503031, "uuid": "d2ca5b91-0362-4e1d-b928-4d9075b49dc5", "comment": "Malware payload (NetSupport)", "value": "fb10a7f9570b3595d61fb971d4c9370565976bf2b047c248fb237d58eb0ad871e345050bf64c0e3947561a22d26e4769", "object_relation": "sha3-384", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503031, "uuid": "f85b903e-b044-4719-acde-1a8951090d80", "value": "T19EA533E32286CF4AE84305BA8CAB915FB62FAA7C44F2F0F54023479F4153F9A5146757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503031, "uuid": "aac497f2-9479-4e97-83dd-9086eaaa49bd", "value": "49152:YlEDThXBJOhHPpGUNIzPUSzcCeIkGh+UJ9fX8r2WD+kVbCSlCsjxSEfbK:NFXaaVPU0c7IkRUJ5o2WZrUsRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503031, "uuid": "23b9723a-89ca-4e86-afa1-bff7bd9ec9b3", "value": 2249310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503031, "uuid": "6379006f-9c6c-4a7a-b311-54f425d9fb7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503031, "uuid": "46421bf4-cdd7-4bce-ad03-6bb950dd19ce", "value": "552bb1aca55bbf903fc7da618e87799caad53ec8df879b89b4ad2f4f77785709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d689042f-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476969, "uuid": "95f56a0e-56e5-42b6-98fb-d1a6bd490475", "comment": "Malware payload (WeedHack)", "value": "c86f3dd8e0167ab6869331448d97e757", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476969, "uuid": "5a2adccd-d9a2-45b7-b6ab-e4294bcd3235", "comment": "Malware payload (WeedHack)", "value": "55d1d82e138ae558d9356ba9bb8c2adcf7c24d9ffcfc8f42049e536eb46f7035", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476969, "uuid": "f5f20d24-b967-40b8-b65a-b82e05b6dea3", "comment": "Malware payload (WeedHack)", "value": "0256c7c1d5e782e0f9280eab31f664f1c0e85f20", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476969, "uuid": "4aa9b4c5-f3cf-4d0d-bbfc-56aa3ca11386", "comment": "Malware payload (WeedHack)", "value": "7ff573ff5a1b8de28ca7acbc5a6dfa5d10cbda725345205042912276d6a15e6ecfd703cf06f9281f292c92ab8f0e1515", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476969, "uuid": "85587edd-13ac-4878-9faf-414453c92a3d", "value": "T1B9C2D03251694F1BDE076AB08BCB7B65342F878562867A63487D459F48BB4ACED00A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476969, "uuid": "2f108ac5-ca7e-4cf8-bb23-6d90742a82af", "value": "384:hr3w9gntuoT16/kIFdxEEvT62R7upNEuIKAg6wvaQePl4cW+j1o45M1aWgWL9yR:hT9nookTx3WCaAKv68Rc3o45jWdpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476969, "uuid": "f5ee5468-2e20-4d5a-9da9-08cc1bfbec9c", "value": 25726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476969, "uuid": "8dbe6392-ad17-453f-aedd-9a463dd713af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476969, "uuid": "224cf8d7-fa8d-4596-b73c-decd3502b3cb", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b99849-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530485, "uuid": "a3008850-88fe-4841-9d68-ad08cfd38f80", "comment": "Malware payload", "value": "6a08fa866688e7fe1b95201cc899f362", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530485, "uuid": "cc99d1d0-b738-404e-88af-84726a4c02b4", "comment": "Malware payload", "value": "55d82308d1a4926611af87ce26918a20c0e88282a711f4959811788e4d446574", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530485, "uuid": "c06722e6-270d-4874-92d5-7ca4e46708f8", "comment": "Malware payload", "value": "ff6369c91ac866c78a0dce86966de757f44f297d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530485, "uuid": "dd3b0101-4466-4258-b1c1-a153e154f07d", "comment": "Malware payload", "value": "dbe1de9ad5e4a5ed26f647daa611b0335b2f2d5fba013238447ea805447bf5d356c55ad0f78e6de5676705c4ccdac266", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530485, "uuid": "3276c72c-adaa-459a-9887-75d0be1287e7", "value": "T1957633FA9F30B232E596F4B8AE48F745DC4252D6A632D621773DD0A2B147CC711CA18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530485, "uuid": "123aebd8-404c-4818-b293-299c19d0b3f5", "value": "196608:2EBJmggIetBYCQXQCVh4/oNjy3RZYXvfQJLfdnJL1vECZ8nf2+Ot:2EBJmxpYQCVh4/yMZAXQJBvcCZ6f2+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530485, "uuid": "f08560a3-3520-493e-9230-74a53de89248", "value": 7817148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530485, "uuid": "0b0d7c61-f89b-40cf-bb25-79b9d2bd3d34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530485, "uuid": "394718ea-6cce-4023-9061-18b868b2c1fd", "value": "MeteorBypass.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b821d-3b53-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776536566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536566, "uuid": "8166902c-5085-41d6-a0d9-0509a59eefac", "comment": "Malware payload (ScarfaceStealer)", "value": "9e26f2b663b3b43408de63c3a598eefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536566, "uuid": "0fac7ca3-5cbc-4c25-9dfc-1b8a819def6a", "comment": "Malware payload (ScarfaceStealer)", "value": "56e45c04a9aa6652ad240899e63d12d71180a2b7dd06c723910f20a790f3f645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536566, "uuid": "fe468dca-9d09-444d-88be-9f284943249b", "comment": "Malware payload (ScarfaceStealer)", "value": "0bbaf5a7fabab06f49d5d1bb2dfff33308c969f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536566, "uuid": "4f80cc92-d08e-401b-a119-1c3c72eef927", "comment": "Malware payload (ScarfaceStealer)", "value": "ab8e9f3a5cdab856268e7d1349e257f8c666e19cc5e6a5a6feeb305a40c03680e54b8fcf38e3e538e7a7245d9f782aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536566, "uuid": "60232c92-c903-4858-9c30-2d3a44dd4483", "value": "T105F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536566, "uuid": "841ad156-17f9-4630-9e58-944fb51a4464", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536566, "uuid": "d36975f6-0d36-431a-9e4c-9f64aeaaedcb", "value": "393216:An1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:A1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536566, "uuid": "a0e96cd1-1e26-4e17-bd3f-f4f51fab21ce", "value": 71431680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536566, "uuid": "c0d224a9-96ce-44e1-a3d2-65294330a2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536566, "uuid": "284464f6-dfbe-4a87-ad34-c646903d8b61", "value": "Spyder_Source.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c04a5d-3b21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776515105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776515105, "uuid": "1e598b0d-e9e5-46c7-b032-c935ca324801", "comment": "Malware payload", "value": "706eaf9607a469db8ee3d8cd979deda2", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776515105, "uuid": "e243096f-5a6e-4827-9a35-87777cf59057", "comment": "Malware payload", "value": "57205c24b759f2ca83511bf95e1f2e8300904fb8521300fa5113ecb83b020f73", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776515105, "uuid": "15db3e14-2335-43ba-9e2c-a53d7132f014", "comment": "Malware payload", "value": "4acde32a123f41dc34014a6d602cf670a9dfe3cd", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776515105, "uuid": "bd9ad26b-6e83-4fe3-8cc6-d6d76462171d", "comment": "Malware payload", "value": "c51b07f40b22ef7a7a7874668e0d71b49dd7c86b35538abc49fc30b21bcc261416ae9d531734f2f8c860f2b050c109f3", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776515105, "uuid": "4b188e5e-6de1-4411-9bfc-9287705eed31", "value": "T14CB58C1BACD518FAD86A57358CB621927B30BC190B3263D72E40BAB82FB77D05DB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776515105, "uuid": "c491ba14-d378-48f5-838f-952d9767ad6b", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776515105, "uuid": "826ef0a7-1dc6-446a-8404-a733c1297f0c", "value": "49152:Gr1rWPK7z0qbXxH4BeCIejq6h1hzAoFkUh:Gr16Cf5YT5jqa1JkUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776515105, "uuid": "c79fa947-82f4-4e03-9b68-1c46209aecd7", "value": 2353880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776515105, "uuid": "38e316ab-6b0e-43b5-be21-513a2468f3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776515105, "uuid": "3c8e4c49-7212-4a06-8b2d-e09db5f22edb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e01616-3b07-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503870, "uuid": "69b502e0-d51a-43df-9ac7-af2ca3669e14", "comment": "Malware payload (NetSupport)", "value": "2c4ea285f1afd2268435039543d7a11b", "object_relation": "md5", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503870, "uuid": "4cd77dbc-fba4-45b1-aa43-efa8f4cc1237", "comment": "Malware payload (NetSupport)", "value": "5731bff20795e8761b3940470af5c26e2793c3d37a4f1e83ec396de0d975cef3", "object_relation": "sha256", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503870, "uuid": "1d4a8459-a3a2-4084-8df8-8f528e8934e0", "comment": "Malware payload (NetSupport)", "value": "f773c641bb8ee1e91da494d1d5acca00e01a9527", "object_relation": "sha1", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503870, "uuid": "1e7ece00-0792-4e37-aa79-72095cbf25c2", "comment": "Malware payload (NetSupport)", "value": "6ec6f459610625782faca3eebc8e37757af754cd1f11e4660f9b7ef51eaff813bf929e5a22c847417c39c81012ce1639", "object_relation": "sha3-384", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503870, "uuid": "5c6a182e-d299-4430-9c8f-bb82f13317ac", "value": "T126967CB88784975EBE6E1A07E078571E67F37F26D09271FC5A62370B266FC086239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503870, "uuid": "1a71104c-62a9-43d2-8fa2-83ae294b423b", "value": "49152:j3uk6B9r3LXTKKuaRGw66Q7b0AI5saq14VZEUCOfxzk:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503870, "uuid": "f13a668b-5304-419c-a27d-c712e501a327", "value": 9430310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503870, "uuid": "6c404e8b-9711-49ee-a935-4dae9ceebadd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503870, "uuid": "30d8378a-0563-4877-aff9-4d0e93a13540", "value": "5731bff20795e8761b3940470af5c26e2793c3d37a4f1e83ec396de0d975cef3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d2fbbf-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509252, "uuid": "d8bf0d4d-70e7-4f77-aedb-fb5a40f21417", "comment": "Malware payload", "value": "3073f874395c5fee164a99563055796b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509252, "uuid": "7585b3f0-579f-4330-b2a7-317e73e904df", "comment": "Malware payload", "value": "574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509252, "uuid": "7b107ed1-8adc-4c58-bfb7-72ba0e91d721", "comment": "Malware payload", "value": "e36a6d5a9202361ef7baf9d1e56aee0f1b2e1de6", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509252, "uuid": "364c8f19-e16b-4edc-8653-7211ed9a0f4b", "comment": "Malware payload", "value": "e6a44386c7a854e7763301d1a741a659d3923ecc6a7e748c8592f18fc477e6bdefaff703e49f24b8381c996d4faa7571", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509252, "uuid": "4af69968-d47b-4944-8a86-9f08261a4906", "value": "T1BB900214441014FDBA05C2B8A214428454336505949061E7A1148525C591A64955D81B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509252, "uuid": "c958b3fa-6efb-4f95-b738-e114ee765be1", "value": "3:VSJJFIqF1F65IFcDfZ30TM:s8qF1FuzZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509252, "uuid": "50d4e2c2-6c2e-4ec8-bafb-2687eeb7d58b", "value": 54, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509252, "uuid": "b7b8f9ea-d27d-453a-9575-aaa0a9a11efb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509252, "uuid": "f5a8f993-a03a-43c0-9b47-ca54c72dd5e1", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75479ed3-3b0a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505152, "uuid": "2517bade-1930-4209-ae32-120e0016faef", "comment": "Malware payload (NetSupport)", "value": "660b5a921c0658c976a446eff94b9a20", "object_relation": "md5", "Tag": [ { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505152, "uuid": "7481679e-5b19-4ad3-8419-13101a270be8", "comment": "Malware payload (NetSupport)", "value": "57c5d4a142876c40797013d92c0a19c0550b66e235e2c0051e2c5156e16b8012", "object_relation": "sha256", "Tag": [ { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505152, "uuid": "9cbd5061-8947-46f9-99aa-dc664a8e2254", "comment": "Malware payload (NetSupport)", "value": "77c4d4a42013173e3640c2a5db88a59ab66df396", "object_relation": "sha1", "Tag": [ { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505152, "uuid": "8bfb2cd3-8cb0-4fd1-9847-ada5ab70ba3e", "comment": "Malware payload (NetSupport)", "value": "cb01634b673b580ab17e3fc2817a8ae71f00b0f79fdf57a93be60af761db09d7c06fa6764df0731f4ea07b234ac84d91", "object_relation": "sha3-384", "Tag": [ { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505152, "uuid": "e4f1f3e8-1709-4d1f-84f9-39ef22c153dd", "value": "T16AA17365EC45297ECFA7C95B580DE169EE9E416B422C0D88BACDC0886F0871C4E6D1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505152, "uuid": "2aa66030-2950-40bd-8585-5c0c80be13d8", "value": "48:2YI1Prb0iWuN0f0NhyqoFyOOtiegQrNMGY2uQzHWgsMaMNbpV19dWdZhHhkFGbmF:TQDVdGyOOseGPQzbaAf9dYZhC8SqCFsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505152, "uuid": "f0051a8a-44b5-45cd-b293-037e1196c99f", "value": 4652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505152, "uuid": "d8f54a14-4aca-4002-8652-d40ea6a8880a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505152, "uuid": "0012c174-326b-43b8-b23b-ef4b992db993", "value": "57c5d4a142876c40797013d92c0a19c0550b66e235e2c0051e2c5156e16b8012.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df52244-3b57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776538050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538050, "uuid": "d102a856-ab60-4036-9036-51e6beef339a", "comment": "Malware payload", "value": "80dc36464afa3df2d8adc83c0ff6112a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538050, "uuid": "0f961e96-0ac2-44d1-b55a-810ac220b6c0", "comment": "Malware payload", "value": "5c778d3a5686726391299ac6fb7b450e18de409a86f9d16096a0cd8e139f8916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538050, "uuid": "17e11417-102b-4355-8677-cf002d2a617b", "comment": "Malware payload", "value": "1ba2379f791b112c4ae5592014126e499fe3d1d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538050, "uuid": "3028b766-8ed8-4fa2-beed-8631115bf30f", "comment": "Malware payload", "value": "2c2ae736e0d5ab4889b903d454b96c171b6668b2f7816c71ab6acd6872977d5b6313ef47b6ebfe9a8258a0316dc8bb61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538050, "uuid": "da58e4ac-e0f5-4bbc-ba5e-1471a754387f", "value": "T1EC068E2ED43C4B8EEC51F2391809094217A59E4C0575E3EDFEBF9DAF658B1BB02B0664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538050, "uuid": "9482aaf0-c292-4c03-973b-03873ac188d6", "value": "0de8734c7c7e79546042492cde5159a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538050, "uuid": "176c64f7-7399-48ef-a3e8-44cf33e01feb", "value": "49152:PZtN14vP8m6G4930Lp/R2WkaIiOgttSqbe6dIz5GnuILHtX5lCzLJ77FwWKejDAc:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776538050, "uuid": "3894ac48-c29f-4e23-8253-527c0053010f", "value": 3832848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776538050, "uuid": "a1935a85-729a-4efe-ba31-b902d1d01b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538050, "uuid": "75e841b7-317a-4232-a6d9-d3b1b40bc91f", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c30f5f2-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776472979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472979, "uuid": "efc2ac23-5d01-43a7-ad54-c2ad0bc76d04", "comment": "Malware payload (WeedHack)", "value": "c726967d0f5e378efff6b914faf89a8b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472979, "uuid": "0dcfd9e0-a316-4c25-b5cd-6d127f4c41ae", "comment": "Malware payload (WeedHack)", "value": "5d1e9efc51aed15228001845c72613f1099ebf7260b7840dcadca95bf40bd0e5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472979, "uuid": "d42cfc63-7c99-4d22-ac94-b00f1f09d0b1", "comment": "Malware payload (WeedHack)", "value": "10a04805af6ff2e999744d864de839376de3371b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472979, "uuid": "6e45256b-8630-453b-bb40-0ec9c0e746b8", "comment": "Malware payload (WeedHack)", "value": "d505f902070019383b4631f643c89d88fdbd4397b29cdef2f9a4d795a2b58b9510397aae0b81e892dda2dff0d0dff2f1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472979, "uuid": "f5a07c61-e77f-4937-a433-ae77817f3681", "value": "T1F67302BB53600B9ED8C6AD38C3EFB182A0597D5604979B3357C919378FA2C25870DB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472979, "uuid": "c36c4dfc-ed9a-4acc-8156-dc11ea689c77", "value": "1536:Qdmph520+tsghvFqJKQYD+qYaI9iY3XL7glKFXvggmcbom0yg3UL+:cm7UvtnFqo9+IyHLk0F/3w1ygkL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776472979, "uuid": "653f978b-04f5-4d50-966d-74e4320c2164", "value": 76946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776472979, "uuid": "61202eb5-1096-45a3-943d-41e79be0db7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472979, "uuid": "35b8530a-eec6-44ae-8bd3-459a2621a2c9", "value": "deepslatebypass-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c548d50-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486293, "uuid": "607abf9a-b65f-4011-ac34-bdf40549bc24", "comment": "Malware payload (Mirai)", "value": "d3f9f282a5a5e5e941875dca19a31b15", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486293, "uuid": "ba3e850f-7491-46f5-88b0-f32aea1fbdf1", "comment": "Malware payload (Mirai)", "value": "5d1eccb213d13bed8f4c0ed2adbcbff8e9a1ce8a6f6306a3cbc7dad21d905ef0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486293, "uuid": "ddf7a0de-51dc-4444-817c-6f57ecce2933", "comment": "Malware payload (Mirai)", "value": "1812efde155c5466b67101111d62fc7379258fb0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486293, "uuid": "a9aef42d-0445-4747-8946-93deb3ab2214", "comment": "Malware payload (Mirai)", "value": "1caf691225eed4cfe9abea7e40c9420c385ba37c00974f871fc9342ce368dd289de9e3d1f760477b794262e47ebbe0ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486293, "uuid": "2eda10f5-c872-42e9-8a14-1e3513c545f3", "value": "T17B41ACD9109553306CF6DD7272E79468718190E399CEBE84D4DC78EDC8DEE44B082B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486293, "uuid": "bdc02bbb-1a48-4879-b6d7-c20cc7e5a5b6", "value": "48:vp2upZApKaOKaupiSpj+9pOYpNop5HQp8YpIypjcplopMp:vzQPrg9VgMjZyoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486293, "uuid": "d4bfb95c-0a00-4e49-bf87-cc2a35f55977", "value": 2204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486293, "uuid": "48466090-106c-4014-856e-7200ecf728e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486293, "uuid": "89941c5a-7852-43cc-8733-96c72b1900a7", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb130cf2-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494210, "uuid": "4688f264-1119-47c4-b00c-d15e969398dd", "comment": "Malware payload (Mirai)", "value": "5af7ed8b68c6ba0cd7f4efaed4f4c606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494210, "uuid": "6ff89a16-bdf9-4bec-ac6b-0b687134c821", "comment": "Malware payload (Mirai)", "value": "5d5077c72d638baa0a33a1cbb7fdb499d5c83e57483f9d8c880bdf17228643e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494210, "uuid": "3e430f4d-aff3-4476-b6e2-a1f5b8182da1", "comment": "Malware payload (Mirai)", "value": "dc184783d76366e3bc46398a527432a84589c348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494210, "uuid": "a2f7c559-6be7-493b-9d56-3d9524dd1098", "comment": "Malware payload (Mirai)", "value": "f3b975a80ff4551917cc01fabd175a1e892902b1663b5a1f114443b90730eaa6c2caebd27d0f94e52c51d8cfd76db93c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494210, "uuid": "99f27b6d-fdc8-4374-99cb-f4d86ac54b78", "value": "T1A0E2E1D545B2A8B9CEB10D7AFC634B4E2529C6FD86FB11226BF4373417B099A4AB0043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494210, "uuid": "be5c8005-ea50-4baa-94ec-1d56cb5206d3", "value": "768:n8Lm6COq1fewdHy62pud4yNOYSOyB8Lrag9q3UELdU:8LJCmjpkcMKUepLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494210, "uuid": "addd0d7f-7be7-4663-a99e-f6af444b3ba2", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494210, "uuid": "721266d4-bf90-44b3-86d1-3228ac56d8dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494210, "uuid": "754c4483-25c6-4741-b7bb-315623f82e9c", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cdda00-3b07-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503856, "uuid": "db4eeb90-cc29-4ec4-a4ce-e2f12f964d97", "comment": "Malware payload (NetSupport)", "value": "9e4bcf729581d294f3d8e390404929eb", "object_relation": "md5", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503856, "uuid": "a6f76d99-6f3b-4212-963b-fe19ff6e187f", "comment": "Malware payload (NetSupport)", "value": "5d6cce58939000ea22f7441bbf4b1dd96fb21e1542ebfca5b0f6753f55909a77", "object_relation": "sha256", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503856, "uuid": "7a23d771-1300-4d9c-bf62-e892871e5326", "comment": "Malware payload (NetSupport)", "value": "b0f7011fad9c1b96f0ad4412e3852658358672bd", "object_relation": "sha1", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503856, "uuid": "de68fba3-71a6-46d0-b8c9-7dade218c490", "comment": "Malware payload (NetSupport)", "value": "e3e704c821eb0e0babada2987bd05966258927191a38ef43d951a9178072f412e6223f31f7510a610f1bcadff53065b9", "object_relation": "sha3-384", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503856, "uuid": "822ce1cd-35eb-441c-bc83-72442014f70e", "value": "T179D6AE658B84975EAE6E190BE078571F27F33F66E09271FC566337032A6FC04663AC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503856, "uuid": "b2decc5c-7cc5-434c-8ea4-4773c85f964a", "value": "49152:JD+ytGXEAcIqi5toSAjSngwS0GiJUqWW42ndegEiSOJ5q7x35AiIol6+2dNNoTsV:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503856, "uuid": "187f26b8-dc48-4124-b222-56ac670dc8d4", "value": 12894917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503856, "uuid": "ae7d4d85-057c-49b7-a6de-8ebe004c5822", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503856, "uuid": "78992763-43cd-4c46-8112-3aea4ccd5b53", "value": "5d6cce58939000ea22f7441bbf4b1dd96fb21e1542ebfca5b0f6753f55909a77.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b3b70b-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486331, "uuid": "ae2b1dd4-09e9-4243-aa25-da4e29a5806d", "comment": "Malware payload (Mirai)", "value": "5a48ecfd08f6684879ee63d11fc4e268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486331, "uuid": "cf198996-3463-4d94-92d4-c0aa8b676365", "comment": "Malware payload (Mirai)", "value": "5e5639c19a142a24b70f3ca27b9ab2e07d184d0a5048e803c831ef378389fec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486331, "uuid": "299b1f7f-efef-45ff-bd1b-e951094e7354", "comment": "Malware payload (Mirai)", "value": "a3415ee1598fb2dae5c3c241b3922cdf879c22f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486331, "uuid": "7a5de2c8-160e-4f29-976f-b5f1de7d454f", "comment": "Malware payload (Mirai)", "value": "43ed65292e117f8a64bcb227fa110fd434301f454a9afdc6e56b2c2e2b71e488a2e1a2455d38a5d76b8bb422b5bedf77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486331, "uuid": "3a3762aa-775f-4e15-873f-eac63791079b", "value": "T1AD433A50F543E2F0E5874270015BFBAB1F30BDB15229E5A7FBD43A72ACB1A854843A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486331, "uuid": "8bad6fa4-b32b-4be6-8493-dd203196fc6d", "value": "1536:r2sZ0kaHlP805u99hTIM2VYUZWOr+h/U:RZ0kaFP8hRAVYU28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486331, "uuid": "810feb83-9ac4-438e-9559-a38cb48c28da", "value": 58516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486331, "uuid": "a89ed7e0-e92e-4e42-b941-3919e0bbd12f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486331, "uuid": "87fa4b9c-0611-4249-9c8e-590433dcd4a5", "value": "alyssaai686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8abe39f-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537048, "uuid": "252c548a-f712-407f-8deb-c8170e833db9", "comment": "Malware payload", "value": "85d373ca29a37bc6d559e224c29358ac", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537048, "uuid": "e09a0ef0-788a-47d7-a970-8645a8c632fe", "comment": "Malware payload", "value": "5e68f2c707155c7f7fe73b2642eafc1f135274a83f15f74753bfe2c69f9d55a8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537048, "uuid": "42b4217f-9f2b-437e-bc10-95dfe4c7e2a8", "comment": "Malware payload", "value": "476f6cf7e32d3188a0482736a60eb9d9eb1f4f72", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537048, "uuid": "08210296-8216-495c-a05a-64cddf1367dd", "comment": "Malware payload", "value": "ef81ad468936d60040a2e34ec0d50e87fa5378d7ccf47a0805b4cf225bdd2ab5d799345e75082efa28bd1ee377079c0a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537048, "uuid": "fe4c8c7d-6fb1-4138-b6d7-9807f28905f5", "value": "T13E9533914716C4F79D00DF99C1A1586546F9F43ADD3A8ECE03AD5BB2802B4BD3E5CA28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537048, "uuid": "dc9b528d-6736-4b0d-aa03-3ac7dcef9efe", "value": "49152:uKn7z4piQrQYYNHjx52wT8Vb2uOE+fkxPbWJB:rAiBYGHjxK+f7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537048, "uuid": "69128fa2-a106-4d2a-8fc8-a6f557d53313", "value": 2043686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537048, "uuid": "0a63f39f-02a6-4ea2-bb9e-28e94c245164", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537048, "uuid": "a1d46c70-3ddf-49d2-a4f2-afdc45c4ceaf", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4237e44-3b1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776512559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512559, "uuid": "d7f00a7f-e326-43b6-8b7b-dd313f4ed007", "comment": "Malware payload (Mirai)", "value": "5ec9d25242e39af9dfb408f1848b4b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512559, "uuid": "05ae7bcd-3f09-4c64-a493-4323085229e4", "comment": "Malware payload (Mirai)", "value": "5f320c2c06b5cf0d494f311cdf118e294868d0181560104c02d6f05eef1e9e3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512559, "uuid": "49ab9f06-d239-430f-9393-740040c96248", "comment": "Malware payload (Mirai)", "value": "b43b6270eaea82d08f5c5865126fed001a3cbbbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512559, "uuid": "fb0b7ef4-bb20-46fe-bba5-c3013e698193", "comment": "Malware payload (Mirai)", "value": "2d960776037e625b09533e0154d50e438eeb55d035cfc932ad9d7bec2c6c5698bf7149548d81aa22bcd081f7bec3c33c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512559, "uuid": "be8e3543-393b-4e0b-9f62-aa6f6226d987", "value": "T112730250F69CF5858DCC4D7821843E638EACF68190751FADB7EEA8C2752D90F38958B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512559, "uuid": "ffff1d66-457c-4286-bd86-e7bb3266acc0", "value": "1536:RMdpqmmVD63pE3HyF8+z4tGHrlztKIfHnONW1ikX7VBotkWVH26:RMdsHDmbYwhKIft1tX7bkkW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776512559, "uuid": "3ffd27d4-4ca0-4c93-876c-820d5a796563", "value": 78616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776512559, "uuid": "881921d9-3c2d-475c-b5b5-2db0b1146e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512559, "uuid": "fc30b652-cfac-4f11-b5eb-fe694b792b61", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8dc9d9-3abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776471155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471155, "uuid": "56a8ff5b-2140-4f13-adad-d8a4dfa48322", "comment": "Malware payload (Smoke Loader)", "value": "0f77927e8c8bb00f4ac815f5e24ab277", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471155, "uuid": "aaa60a3a-071c-49b0-8a5c-2b7f08d860c7", "comment": "Malware payload (Smoke Loader)", "value": "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471155, "uuid": "cd7662af-d21c-4d16-ac9b-7bf0d0aa2622", "comment": "Malware payload (Smoke Loader)", "value": "09210eee3a96dccdf339800a81b1c440ee8c7ecc", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776471155, "uuid": "b6a73e87-fac5-4818-9a64-bf437ae3df4f", "comment": "Malware payload (Smoke Loader)", "value": "9184e05fb5fd96cf5b3512fb6f741d8beeec87ee02bc44a288683614797cfd8a99e0f9d44ede3180938777b691c6c32a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471155, "uuid": "379c409a-fb45-4094-940e-8d007ede791d", "value": "T142956B0BACD508F6D46E97358DB725827B70B8090B3263D32E41BAB92FB67E05DB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471155, "uuid": "c015e11b-abb1-4e22-abe7-c103eb02cefd", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471155, "uuid": "8ea6c765-c599-4592-86de-cd0a838e56e9", "value": "24576:eWVlvo0ZMvx0ppPpHwtVdDB6X9CC7pMEUrMTAAOtP9glUn:eWVFo0ZMvx0ppytVdDYX9CC7pME0A+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776471155, "uuid": "81f1551b-16c4-41c5-b53e-c882c9680b0d", "value": 1931992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776471155, "uuid": "a7a842a9-2118-4ab0-bf85-c223101b3f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776471155, "uuid": "b0ec622b-ff9b-4541-897b-dacc144622fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e625794-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776497812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497812, "uuid": "0560a61c-c3ba-4372-b646-0f2792bc1408", "comment": "Malware payload", "value": "cdb846a03fb65fb37f96c1b76d43d030", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497812, "uuid": "7f1c75fc-7df1-4286-a22d-c6613407d97c", "comment": "Malware payload", "value": "5f870f209bafbfb3d5cf44bef6d29b85d837530de5874f83aa1844c8cd310b63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497812, "uuid": "e101833c-0a7e-4705-968c-b43c406e715b", "comment": "Malware payload", "value": "ad659391592b9f476b5cfb220fc06db705f92efd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497812, "uuid": "5a1b6ed2-097b-48c9-b726-af19468795f6", "comment": "Malware payload", "value": "8ab179f684509d7e6a4be2d4472b2b998a91b672d0ff9c9d073506c9508bb0405adb467b187ae752bdca610d31db6152", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497812, "uuid": "4eea3597-4462-41d4-ba03-3d50d758cafc", "value": "T1D7211FD611B6C5313CA6BF577679860830D291EA64D79F18EDEC34EA48CCE147450FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497812, "uuid": "c038cd9c-29b4-435d-b636-8ec6e87c8d0b", "value": "24:vUmchfUmohuYJUuSmsUtnLUbFbWCJUu2UD5LUfNIlT:v3chf3ohuKRS3OnLCb1J32y5LxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776497812, "uuid": "b2c19754-5695-4916-868c-1d319360958c", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776497812, "uuid": "ddf3d4d6-258f-4827-8123-baa7fb3b62ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497812, "uuid": "b5a0c27e-ffa8-4fc3-a515-b5639f2d891a", "value": "skid.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c334aa-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776472963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472963, "uuid": "a7256b08-afc2-4057-bba9-2b7ef05453f1", "comment": "Malware payload (WeedHack)", "value": "36c24accf315a6cea89eb17ab79a7205", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472963, "uuid": "96829508-42dd-4bb0-bbac-a0876e233032", "comment": "Malware payload (WeedHack)", "value": "5fe312f1da155d0a6c4fb35e1e5e28f64af9e5c384aa403835e550f34e0fe23c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472963, "uuid": "4640d1a0-e037-4649-8cbd-07003f8ae578", "comment": "Malware payload (WeedHack)", "value": "f230c1ac98dc114fc93ac3f49df711996e1ba3af", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472963, "uuid": "aef09098-70da-4588-baa9-6879b8014645", "comment": "Malware payload (WeedHack)", "value": "1649a4c98c2f3b9e1302f5d03382f040531561acf0905a9b770231bb1e3392014ee87845023cbb27f7dc2a57087d38e5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472963, "uuid": "b664fcf1-8dfa-4882-9edd-3aa2af421aaa", "value": "T1A9F433EF8D737620EE42967C7CA80D7A2A5F8E05BC1930847CA1AE96375D7C3156B702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472963, "uuid": "207956c4-1878-40e1-9835-222d86c9bfaf", "value": "24576:zjXKRt9fNMLzZxwHK33ywr6NbZZR50AlgNCYMSROcYi:3XKRt91M37/33t4Xrn0CRSyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776472963, "uuid": "0631820e-007b-4cd6-8ad2-2ec4ed27dc38", "value": 793865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776472963, "uuid": "34e199ec-de1d-4ad9-9875-505126cb8806", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472963, "uuid": "420f2cb0-085e-47af-90ac-f42f89b1d80c", "value": "1ihzika.exe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a553db78-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537016, "uuid": "81685e34-53bf-4ccb-97ed-581d3666db6a", "comment": "Malware payload", "value": "3062dd155d9ee7c82a0a33a9669432f9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537016, "uuid": "3b2b2351-f5ce-4e37-a866-c9efe870ac54", "comment": "Malware payload", "value": "603540b78ad6da4128955767212cac7d0e610dea99ccdf9146edf834a09bba94", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537016, "uuid": "da90c6b9-6f6d-45f8-8060-235e3cb76e6f", "comment": "Malware payload", "value": "0e2ee7dc1e295fb217b0b5662d84a7161eb237f3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537016, "uuid": "8e5f3675-83da-43a1-9875-d2692ec373f2", "comment": "Malware payload", "value": "3e0b1c4a62cc8a9cea456da7799c09d511be71f44174691133b7d72eda293e45beb29e1e026ea7d76f4212ed1c6ccb46", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537016, "uuid": "f43b4308-a437-4f2b-ae54-79286c2475bb", "value": "T1DC463379B67D6734D9E3A276FA156933352C82C4E4EB383728B104075FB7DEA8309258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537016, "uuid": "b8db080d-b205-46ca-b7ec-0f0ac9535a6e", "value": "98304:cYAQ8DCUl0tj2j3EP36vxa1ZGLIAF20GGe8mCIRi2j3EP36vIbt:Fv8eBtj2nxYCDi584i2nGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537016, "uuid": "cff0c772-23d8-4218-a27c-43be6a5b07fa", "value": 5561477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537016, "uuid": "62ec11dc-0581-42d2-96a9-ee953a62c4b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537016, "uuid": "96a3ac55-3355-424e-ba25-5b0cb994563c", "value": "Astralux.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b5a4e5-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492933, "uuid": "3fa69c60-287c-4cb5-ae73-cc24a3d4452e", "comment": "Malware payload (Mirai)", "value": "7cf638d9c8d6da5019e93cdf8796a001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492933, "uuid": "11ad8062-8140-4577-977a-2842341ea1ab", "comment": "Malware payload (Mirai)", "value": "604febb6e1dc95bd349c839c53bcb2a2a1e809234e763754f7d98efe68518a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492933, "uuid": "4eb403a0-e53f-46ea-898d-171a2447ea49", "comment": "Malware payload (Mirai)", "value": "443c7dac0faea9ca3fa0c17d1a69cdf0353297b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492933, "uuid": "ae200464-9aad-4cc0-820d-ab9733229769", "comment": "Malware payload (Mirai)", "value": "93aa02f5bf202ead409534316e917d43b343007883622ff3322310ced24e1eb276a98f9ded7c64817b2e388b80956c55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492933, "uuid": "bafc11b6-61c8-4c88-8f92-adb1a366840d", "value": "T16EB3AEEBF64715A2C85243F013C79F8E3E232390AE57A4E76D1E267B15760DB1D06B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492933, "uuid": "c02908ed-3327-458a-b4f6-eacc87a9ed31", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJh/LWW:6fIw3e8ZE3MYlphDgJhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492933, "uuid": "603dc113-5b77-494b-b548-f4ea2dd5766e", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492933, "uuid": "e5331597-111c-4cdb-86cb-8a09ff80caf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492933, "uuid": "314b4ebc-b0fa-423a-8ee7-ba1d573b3f44", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b0e5da-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776537500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537500, "uuid": "20ff0221-d422-41e8-b03a-9f6351bc23ae", "comment": "Malware payload (ScarfaceStealer)", "value": "b10b737971f11f161dd66b3263bc72b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537500, "uuid": "efc0897c-01fc-482a-8e74-d6edba8b71fe", "comment": "Malware payload (ScarfaceStealer)", "value": "609ec88f79675ab9355bcc716adfcd84833de2ff9217a6ea153f38e489b3bc24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537500, "uuid": "3cab84c9-1f80-4da6-806c-8aa0cc3e44a6", "comment": "Malware payload (ScarfaceStealer)", "value": "9eaf38d774dfb2a3f0336d5e1e739b6f7a6cc801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537500, "uuid": "80573c90-9c12-4a3e-a973-4ef3aa793fc8", "comment": "Malware payload (ScarfaceStealer)", "value": "4d74e11c09f39cee530280e7b0cf23bcb729a6059dbef08c54c9b47fd26406f09b03c544712ad9c3584f8415e1381d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537500, "uuid": "056c7943-ff8f-4f37-8bb6-1465d4256797", "value": "T106F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537500, "uuid": "ffd8ef23-a4db-468a-9500-a0ca68f688e2", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537500, "uuid": "0f747bb8-7746-4d2a-8782-44dfe7cda658", "value": "393216:yn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:y1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537500, "uuid": "f25511cd-e96e-4bc0-a298-e81050e206d5", "value": 71420416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537500, "uuid": "02fad133-0af2-4e2a-9883-f368392f48ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537500, "uuid": "1e0bc93f-e25f-4fb5-a239-034886466d18", "value": "NS_GameHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd781548-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537164, "uuid": "ee9574a6-5f80-4287-af35-59a089321cb3", "comment": "Malware payload", "value": "341e4d1b6af0978a95b96025226bbd52", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537164, "uuid": "6e2cf70c-39e6-4e0c-9ac2-86c2abe59c07", "comment": "Malware payload", "value": "612323dfe15d5833124c4dce8b19b84debddeb734cf9f1aa83b4ef915b6a5da8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537164, "uuid": "786f5d55-9935-4e54-8f31-7f57f0c5516b", "comment": "Malware payload", "value": "8e7b0c6b00fc846e626e071ebafc2a027b819bd6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537164, "uuid": "437a25ea-1f13-45df-9b36-1dd40aae735a", "comment": "Malware payload", "value": "b30f50d6cdae1da6970b9b5fd88cb256d6c3d2057c8260dc1cff34a9e1721f9ba9e033d59f15fabf358aae697227ea23", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537164, "uuid": "343cceb2-cc80-4f1d-9ba7-1510093f159f", "value": "T1E1E51233A5E8C87BEC97A332D5022561F99D06F3E00630B764EC0A7BD4A69DB7360795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537164, "uuid": "c8b41015-3381-4aa3-aab4-d16933f296e4", "value": "49152:HnG9IGZZKhWFx5gkYUwej0rcJEr8XJb0lySeki5EG57TmWFR8rPvuj0QigJMCmTC:H0bTFvrYJe0TrYClyOi51mTr6xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537164, "uuid": "f8267fda-6c5b-4387-965c-0aab1bf0c656", "value": 3145600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537164, "uuid": "83d18cd3-d744-4886-ab0f-dabe2ebe5fb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537164, "uuid": "1b6c7e8b-4884-4487-a039-2a91b29e26f3", "value": "Meteor_Rejects-0.3(1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5bee01-3b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776506481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506481, "uuid": "8e5b7157-519f-4ac0-978f-ca56c48a026d", "comment": "Malware payload (NetSupport)", "value": "57005c1c04688ed6d70aa17ee597dc0a", "object_relation": "md5", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506481, "uuid": "b912b88c-c01a-4122-9438-4a909426847c", "comment": "Malware payload (NetSupport)", "value": "615903079f3e0177207f91ef4888c27de1b083e6444122ba69906e4d73d21764", "object_relation": "sha256", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506481, "uuid": "d014113e-8a7f-466c-84f4-1cb082d03aae", "comment": "Malware payload (NetSupport)", "value": "384b2961f594baa39c0ec6b690b473c41cc59e69", "object_relation": "sha1", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776506481, "uuid": "9a859f40-4451-45d7-9618-0d4354369a54", "comment": "Malware payload (NetSupport)", "value": "22290b3181948db3f4f80b3737c092f44d5bef3a18a26d2ce4bbc17059cebd6f6b1dba7f691ca703cc071e376166be8b", "object_relation": "sha3-384", "Tag": [ { "name": "Alfacoockie-com", "colour": "#159C32", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "Storiealf-com", "colour": "#161D5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506481, "uuid": "03cedb4b-faef-4b09-afe9-3fb129d831dd", "value": "T1B131E905AC30EA4CC6D9AF7C9B59E526073F3BD94C20525764817324AC4B747AF0B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506481, "uuid": "4a5b1ad7-4e4f-4a07-97d5-ed5c7d1f81c6", "value": "24:9G56z2jVunh+cRrM1Nw3t3oZ/pOLzjYBNRfzRRL67kVBgzNbpP5A:9MiKVu50Nw3Fu4fkN/LY/RpBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776506481, "uuid": "9d506c89-c4b7-482d-b7ea-2f6397294dc7", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776506481, "uuid": "0ff0606e-d261-42de-9edf-877b638ab5e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776506481, "uuid": "b32a6ecd-6c90-47e0-984b-0c7aaaf9137b", "value": "Regions_estate_04_07_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c07692-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534017, "uuid": "2556b7a4-26e6-4c6a-97bc-b38ae35f5829", "comment": "Malware payload", "value": "19736d11315ceeecdb834bb166042c59", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534017, "uuid": "6c7c63e8-1b80-449a-86e4-e3a9ec9cb073", "comment": "Malware payload", "value": "618508ce76f451d4d383840bec95f07eebc026b853836efb18cdf62bbbefb38a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534017, "uuid": "f1c895a6-a576-45a7-97f2-ab6ac50c444d", "comment": "Malware payload", "value": "a0fdb65cd0770c74fa2da35702736cad9acc33d0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534017, "uuid": "d5835462-74c2-4929-bab7-fdb7c65cb049", "comment": "Malware payload", "value": "e8cb585095bda89824d7fbcc376a93a37637d0b85e49375e17c831fb2eb7f2efb17d0bbf37e03b8ac8833e8246507860", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534017, "uuid": "f30196ee-930c-47b7-a45b-9566f0303c1c", "value": "T1729533CAD11ADEF4C9074E2FB64FC9488FC148F2EB9239546611432FE5EADEC908D859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534017, "uuid": "184ece97-ac8e-4541-9535-68eb2d344121", "value": "49152:bBzIw4BAXz4IsVe9SZ4WtAojJFlxeDOLe6qv18Mu7KK/of8EgduP:xIw4izbeoHsXl8OC6qviMym8EKuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534017, "uuid": "77e7e0f7-5081-4ac3-99a4-97ba7dab925f", "value": 2043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534017, "uuid": "3a6f2c1c-5b87-482c-b28d-2302d8ad0f36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534017, "uuid": "4245d230-4e03-4dee-91c0-fd671495f9e2", "value": "dupe 1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7471525-3b81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776556454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556454, "uuid": "8365064f-339e-4562-b6b9-b6b21ce470f5", "comment": "Malware payload", "value": "36dd5b799b5bf443d1f9e499a7b3d35b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556454, "uuid": "05e6eaef-4de4-477d-a321-5eb48ce6e844", "comment": "Malware payload", "value": "61dec2428d3b22f91626fd317f96b9a538aeabfd9088cdcb711061424d53107f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556454, "uuid": "d29fc4b3-cfb9-40c2-8082-e4d67d826636", "comment": "Malware payload", "value": "6450e492d33fa367dbe7c6a0eb9163d574713641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556454, "uuid": "bcfe83b7-0b28-46ec-8847-5bc75c148566", "comment": "Malware payload", "value": "dfbf9c31679da4da1a87b0c17ff5e35c9bd0600bd8e2c82f0bdb1b90d027e3e69fbf1df9f9de068f708ce6f796cbca14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556454, "uuid": "c038ab18-ee30-4942-b109-ecc954e3f5d7", "value": "T1CE632857BD819F11E5C1127AFE5E124E731317BCE3EE72229E24AB2477878670E3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556454, "uuid": "4a24e5fe-80ae-43cf-a208-f0107d83a182", "value": "1536:Xon1lwNigJDkYdKBEtIGikZ7t0naNScgxPN5MYBR:mlwNHaqZ7t0naNB4PN2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776556454, "uuid": "8af5a5a6-4341-4950-a6da-a01963cf9151", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776556454, "uuid": "3e5ca34c-94f6-42e7-ac80-3a7c87b15460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556454, "uuid": "1e558554-8d11-43e0-95e7-0c770ed3425b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ada8aab-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492975, "uuid": "4b545f71-5fba-4010-a06e-ea99e8d64372", "comment": "Malware payload (Mirai)", "value": "b90733c975fe935e0fc37f0b47b11151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492975, "uuid": "4f22127d-43f4-4cb6-afdd-1f9560f54157", "comment": "Malware payload (Mirai)", "value": "62881883cf60ec2ed1ad7f05230139e8611e0f2802fe8e6af9bc1558207cf33e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492975, "uuid": "13d4b86e-68ee-4150-a735-7fdabb176946", "comment": "Malware payload (Mirai)", "value": "96a278ef40c292960a17d6007de62f20a44b31b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492975, "uuid": "2557b431-ced6-4546-86bf-e016e13d7982", "comment": "Malware payload (Mirai)", "value": "24265b8f5271b646da6872568f8e2bea3f5439229c66f74f210661dcf2b47e96249bc61d3586a33f0f47af34a0a9b38b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492975, "uuid": "37cfe05d-b120-4bb1-9595-d94ffb7a2694", "value": "T189A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492975, "uuid": "255a93f4-26a1-40ef-a2a7-551af49139ce", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7qZr:J0DOpPRWu8ERZ+0u8vjhhqZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492975, "uuid": "b6f91030-0b78-4945-bebd-f356023a94c7", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492975, "uuid": "4cdec022-56c6-4f60-be75-ac9c12dbe8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492975, "uuid": "2d159ebd-a5a2-4ce9-86e3-1624cc68f3db", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8e5568-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492954, "uuid": "221f5108-da57-4b50-adee-3be0cb52f59d", "comment": "Malware payload (Mirai)", "value": "5215da95356dde636bcc36342b0fe542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492954, "uuid": "6dd5da88-19b3-405d-8283-3e1e0ee7d6d8", "comment": "Malware payload (Mirai)", "value": "62b40ad07d7aaf24f1670a5d8f88ad179c426cd0c659ddec616fc03030e646e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492954, "uuid": "f157aff7-5163-42d6-9cc9-30fa3bed6651", "comment": "Malware payload (Mirai)", "value": "b7484c29c54c7e0201ffe1daa8c334c42aaf4c84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492954, "uuid": "e557ca5f-5b01-478c-b88d-9f1125200e75", "comment": "Malware payload (Mirai)", "value": "657fd0eab4df30d37cda8cdba7c4ea1f89b70d676c3ac700f2bfe8894f4695429fe3e7f6f77f513a41752d262813ee31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492954, "uuid": "583d91fb-52fe-4bc3-a206-765f61e50e7c", "value": "T1AA03F1BC214DC126DD216C77DEB207C26EA84B70D1D79006DD6B86AC8767788F68934B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492954, "uuid": "74865eee-bd9a-4326-90f9-95b2e7eb2fe6", "value": "768:xGPjXBOTsh1aqh3kosh+IkLpFw71qB7IuszFKwMKBJjrYM9q3UELyG:0LYptVh0whqFIlQ/kULJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492954, "uuid": "a7e3d330-3dce-4ab6-b80c-e213d48c6d77", "value": 40340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492954, "uuid": "ab5f4048-15c8-45fd-acf2-cb7dcfbf572a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492954, "uuid": "12b4c80b-0be5-463e-beda-aa26929240f6", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3793005e-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776537261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537261, "uuid": "962302aa-0d70-4f32-bba8-fec2105d8a19", "comment": "Malware payload (ScarfaceStealer)", "value": "5bd49a3f3cd445b3e57281c830dd4051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537261, "uuid": "ea56d910-2bac-4688-b927-208ac55d4475", "comment": "Malware payload (ScarfaceStealer)", "value": "631582f669cf0f8eb640db85ba0572ee8c25318dcf54450d906494027af0e7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537261, "uuid": "407d63dd-6c3b-4cb9-ae17-a4995c8bff91", "comment": "Malware payload (ScarfaceStealer)", "value": "5470e5850c48b1cb8417600532b997344b806b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537261, "uuid": "a418ad62-ce49-46d1-a4f8-7bf10b9d1df4", "comment": "Malware payload (ScarfaceStealer)", "value": "f0f4fe4d2c25176f8fb5f266c909ce8494c2abf1e6b509a6fb9cf50f99733c26ba9a92d382a16560a9fa7c011174f31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537261, "uuid": "db9f9b0a-250f-4055-9534-8d2cbc640454", "value": "T1DAF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537261, "uuid": "42bb7d3e-251b-4024-a49f-68d91b7a4b48", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537261, "uuid": "54cef94d-6814-4c4a-aa03-df99475d158e", "value": "393216:mn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:m1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537261, "uuid": "8d01a513-0a24-4e8c-af61-4b41a8d8efc9", "value": 71461888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537261, "uuid": "ab7db6c6-c474-40ac-b126-cf60fcb4abf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537261, "uuid": "0857def3-6c45-44a7-9ade-8eccc889c6b4", "value": "VioletHUB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e000437-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527071, "uuid": "06775140-633f-496f-9114-f851b7f01396", "comment": "Malware payload", "value": "a864cf86b6e22e8839aa7c41a776581b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527071, "uuid": "e62d7e3c-0d3c-4650-a4ad-60df9962728d", "comment": "Malware payload", "value": "637d554b3a4ad1232194aacc5fbfa339c32f056d875ac6de70bbc90564cbcd90", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527071, "uuid": "ce92bc17-448a-42f8-9e5a-6aea5312117e", "comment": "Malware payload", "value": "152db14909765e2b9493ade9bab9cf5ae9933c8f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527071, "uuid": "41d903e8-0f78-4f05-935e-899fdbcbd9b3", "comment": "Malware payload", "value": "4a356c35007af9207b9891a5ecfb906bf0746e946e60f9b3434ccc15878e0e2aefb2c2ab17448ed55e243cb7f58314d2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527071, "uuid": "73c4f304-e535-4364-a6b9-9f6292d42c24", "value": "T12F33E034F6AC0527E41F9075C8522D212E0D1782E816B32ECA6A1FDE09E7D4E33DDA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527071, "uuid": "cc7660b0-0e62-46f7-904f-5744790b3266", "value": "768:4HvlvMt66xaz9XC2RdtINYKdYc1d1JVnOLAufxWKEH+YvvvRVlSq49R:4Hvlvg664z9ytKgY8VOLAusJhVlIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527071, "uuid": "ecc30d61-7253-46b4-a274-29a45687192a", "value": 54426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527071, "uuid": "e8722385-08cd-4359-8d4c-a5b6be7bba97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527071, "uuid": "661d33c7-bf40-42fd-865d-8bc6606bbdc9", "value": "wspeedfeather.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64044d3-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776498067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498067, "uuid": "5dc99731-8ae3-4068-9d5d-908fd44c2265", "comment": "Malware payload", "value": "86372bb5e310764078d5ef4010093744", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498067, "uuid": "d4baefb9-d0e7-4380-a09d-0b35991c17e0", "comment": "Malware payload", "value": "63eab83b27473d16dbfec96f1d425076ff7a105d86983af5f679ed7dfd9340ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498067, "uuid": "885f4fa9-18bb-4a76-9d16-205d14f498b6", "comment": "Malware payload", "value": "f4ca2c16fbbb9f35a9690ca21fc35ca84947497b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498067, "uuid": "bdc905ed-132c-41cc-8628-c593236035ce", "comment": "Malware payload", "value": "642392ed38ee9d5b108c80e8a0adb5072cc433e22ecce31cebe03beb3896a8747df0eec2d408c158c4835580459dc05b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498067, "uuid": "50c091ee-2a86-499c-a1fa-278291ec8e01", "value": "T124A30AA2FD01EE66F00A9D3A07D707247633FB670F8229253267365ADAB52D4B517F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498067, "uuid": "6ca9643a-cf0e-4990-9eaf-20434ab8f0c3", "value": "3072:SUH9wCtg+UBiMJdUyhgLAFm9T2q2/5jAoc:SIy+UBivyhOum9T2q2/5jAoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498067, "uuid": "1eb126c1-92a3-40f4-b7d4-4833f0f085c1", "value": 105644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498067, "uuid": "43fec1fa-1ca8-4c45-a107-5785264882c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498067, "uuid": "4b68006a-6184-4b4c-a68a-2a531017b44b", "value": "Demon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb91d43-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776526913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526913, "uuid": "7b9e5209-01cd-4560-9642-ee9c0096f827", "comment": "Malware payload", "value": "792d3059385bc64e4538c799a464a910", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526913, "uuid": "58f7a06f-818c-420b-a7a5-5b6dc47df50c", "comment": "Malware payload", "value": "65abaca075a7bbec8d2df89e7a632992db74f471e535e3aef00d3b04abe44ed2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526913, "uuid": "825061e1-f24e-4edb-9a6d-f7cbe7c55701", "comment": "Malware payload", "value": "04cad1b12302c6501134510d8a2acdef1df5c620", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526913, "uuid": "f9b805ce-407a-4e60-8512-2c2764d19c51", "comment": "Malware payload", "value": "4c14b91a1a03cc722c79bca872e53b612bbd0289a61cd2a82f5f61a0671057c479648973eab30e21875e868d82669972", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526913, "uuid": "a7945ed4-b592-4e1b-9b6e-8e1e7eb432fd", "value": "T1BBB2E022A4565F35E907C2BC3DC76DB2641C469543CE383AE422C32B48E757A370D3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526913, "uuid": "5a45d781-36fc-4f9d-98da-1ba3c31a3d49", "value": "384:Z3w9gntOSZ3BVgE4ELxfChgiz6upx/bPib/5QQNWT4uXW/Kc0VawFu1oqD+:x9nQQzgjyGnpFbPgSWm4uXW/K3WoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526913, "uuid": "29b5abc5-6735-4b23-9334-674e3c7903f2", "value": 25687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526913, "uuid": "10b43238-799e-484e-bd10-275823ff6bc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526913, "uuid": "b9fae8b3-c5e5-4f29-8bce-b913fe101b6a", "value": "krypton-client-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa25b54-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477029, "uuid": "c098da9d-a6bb-40ca-a555-6d364b41d0e4", "comment": "Malware payload (WeedHack)", "value": "214d3a9a4c6869d04e117b7728472c9a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477029, "uuid": "5d051cd8-c6df-4d6c-8728-aef567f512fd", "comment": "Malware payload (WeedHack)", "value": "65e9ac317692930fc598840bc604139b2e074dbc6db4890b1b24133365e6222a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477029, "uuid": "d3a7c9cd-a62a-4559-ac58-10142fbe0abb", "comment": "Malware payload (WeedHack)", "value": "dffa836e4fcde321788051a3a385ae32887e992e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477029, "uuid": "d58ed415-0740-40d9-9af6-a19d73a4e2d3", "comment": "Malware payload (WeedHack)", "value": "c38211a1ba9ceb26bea00841ed0d74292ddbbb436c677773c575dbfb0b9ed1d8a19f64a644928b5987a215ad216079fb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477029, "uuid": "5175fadb-b1e1-4d34-9d19-b140d2ddb68f", "value": "T1FBB2E12573828231ECC216756AC62D75B62F9CC730CFA2AF72E16D1B4417DC2E709768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477029, "uuid": "bd46d1f9-d704-4078-a2f4-76510c615b5c", "value": "384:zDw3w9gntMERT/ABYHs368TC3AV+iHVEchQwJt3W3NhrpnolzIXs71KruSf3RkfO:zDa9nrrRM3awQiHAw2hoikodf3y/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477029, "uuid": "c5d56a2e-128a-4d6d-b4c3-0e91a3b2e899", "value": 25615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477029, "uuid": "8dee5fd3-1952-4501-a173-1f56c517080a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477029, "uuid": "5ce7d674-f598-4599-8465-e44b49bf4aa3", "value": "PaperRig-1.21x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bbd2a1-3b72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776549816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549816, "uuid": "478dc95a-f1c5-45b9-b622-1bbe1e435db4", "comment": "Malware payload", "value": "e9c2e5612bd252993a9f14930ecc44d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549816, "uuid": "5c96c8e6-76ae-4f9b-bf78-efa5275133ce", "comment": "Malware payload", "value": "66b9ad148665387fe0d9041c2d578c89e922ad8a5a7ab7bbfd7fb8cd4ed63a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549816, "uuid": "55eee9c5-be58-459d-9004-4a9219828820", "comment": "Malware payload", "value": "d4fdf6ebbd79bed2c3c02ecd1f18c38a42af0af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549816, "uuid": "eebc254a-6097-4a46-9afb-2ad74a78c86f", "comment": "Malware payload", "value": "25debfe715b99dfd73adb74e868a288e6832aacc4530c28093b7461060170084e5e86b82ca5d03f677839b4e54f73b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549816, "uuid": "86812f3d-c6e6-4df2-b0cd-82beb6b40e3d", "value": "T16F033A577B6000FCD87AA3F8C9A71755F3B2B8550326ABCF03E090A60F266D1E97B951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549816, "uuid": "a7e52a33-3139-416d-994f-8da53bfb5a51", "value": "e0c9e970a0c40529d984b396b0767ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549816, "uuid": "344174f3-57d7-4c75-805f-484a0bab3154", "value": "768:yzsDrehbAmzWsZ9h/Le+3aqd29hwELmH/wq:yGrwjWsZd3aqd6fLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776549816, "uuid": "774a2f44-431b-4dba-a11e-5c39026d8236", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776549816, "uuid": "3b1e3c5f-9913-4f29-b0e2-f876ebc160cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549816, "uuid": "454263e3-0e58-4257-b6c7-ada83b3ef4ee", "value": "WindowsUpdateService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97a6ed6-3b39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776525426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525426, "uuid": "92f7bb43-12d9-4079-92f0-d94edaa1b753", "comment": "Malware payload", "value": "c911a331fee6f6561be7f89accc30201", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525426, "uuid": "f6c6e20c-f093-4b61-8ac8-8f6da1cca0d8", "comment": "Malware payload", "value": "69bf25ec3b6de3167c108b6aefbc19b53f6ac2222b87dc5ff87a050dccb7272a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525426, "uuid": "9f752634-7293-430e-98d2-1ddc4a1e299d", "comment": "Malware payload", "value": "73b8bf839a470ba008e19433347a67d1343b783c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525426, "uuid": "44e06709-f50e-4c4b-af16-6b2299862baa", "comment": "Malware payload", "value": "b2515e221f3f805b7d4535d4e542ee5f8c35a4fc72afdfb6b952ba875237ec4c692cec109d16fcec2016d873e47a5be0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525426, "uuid": "d5927466-e5d9-4a3f-808f-abeb8ffdd607", "value": "T1AAE0C00C74900433BD365CB9B6C711C4A10FC35B3C0FA69DC695342BF0F48809010863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525426, "uuid": "3354e7f9-01ef-45d1-8e8a-ab6fb0be45ba", "value": "6:/24J+d9FENsRV6M5dOuRVYrW5YQIe3FsDKVKhOXqIKLsVKhOXqIKa03IKa+IKq1P:/24J+zF8sbYuREcYjWghsOLsghsONJYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776525426, "uuid": "9b110aa5-201e-4c3d-8457-f21d0a9d43ae", "value": 358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776525426, "uuid": "a6a0309a-2ae0-4487-b51f-a68603c8e632", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525426, "uuid": "f76ddd21-b9f5-4bc2-84f4-6a377aba4106", "value": "O.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61ca1f7-3b81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776556452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556452, "uuid": "1e427769-d23f-42f1-8034-59957b52cb45", "comment": "Malware payload", "value": "062307d42bb55c7bf610ca4164c71bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556452, "uuid": "7967db90-e923-4bb4-997d-be16a264653c", "comment": "Malware payload", "value": "6a9739e17ca61e473b1e069ca06e1c488a507b033234c0f162842fdbaca0f191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556452, "uuid": "78c93e01-d815-4e84-9526-8982ddfc1169", "comment": "Malware payload", "value": "05ab304d992c7d51755792ea512b19b31f8fb5d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556452, "uuid": "935e15a8-cb02-4969-98a2-ed430c3bfe04", "comment": "Malware payload", "value": "783a0fb89f490a581e7ae4bab4b487d8705e78d9316accbedd58ad2c6edb2cc0f7b490762f2c43d620ed3eaa5e5febe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556452, "uuid": "b38c1c18-31fa-4fcd-9916-b0477d6b0425", "value": "T18A5319E7F800EABDFC19E73B84570506B131F3A506520B773367B82AED761A5046AF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556452, "uuid": "efbda7f6-8173-4938-97d8-6f1573111ac3", "value": "1536:r8SpO+bEJVS833Dyb1waxAEqcEwQcSRZDBK3P5JTd5o:rBO+Yfyb1FxuwjSRZDu7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776556452, "uuid": "3f1844e5-513c-4e61-8115-b8509b2476e4", "value": 61632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776556452, "uuid": "de3a9992-fe26-412b-99ad-724363b768ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556452, "uuid": "969782ad-ef1e-4eac-ac10-6da4d9e16a54", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c576cd-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473023, "uuid": "53a81a83-cc76-4d6b-badb-d14243ea0513", "comment": "Malware payload (WeedHack)", "value": "9d8005162a08043cd4701853334a7d87", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473023, "uuid": "cf2aea71-21b4-492b-b97b-cd1e6d6f83b3", "comment": "Malware payload (WeedHack)", "value": "6abf054e63c7f733e6cd77cb824ccf41827a65c9e89852083c5bcfc9219e1ad1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473023, "uuid": "a3a34b78-5b0a-4623-bf11-e17cda1c86b8", "comment": "Malware payload (WeedHack)", "value": "f917e77ea1dd7acc26730f4481cacde9f67efc43", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473023, "uuid": "8634462e-f8e5-42e5-8838-bfa61a050cf2", "comment": "Malware payload (WeedHack)", "value": "e7bb8446cd8c49afe89cb8a319089b4b631ed793ccdb3a31a63bf2bac7570b568aff169474143f2900b81642a02531f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473023, "uuid": "6afd50d1-48b4-4e6b-8854-62a6bb5fae28", "value": "T16E8533579E15C7126F2764BAD3828FAD123710D8B1C7FA5839774E5FAB0681CFB2402A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473023, "uuid": "5649d1cc-7b05-48bb-818c-31b256e8c3af", "value": "24576:YtRzgHlmFbg2fTQN4z/YGxTO355lNYJ9whUsWU/L/dpFcOdBJ354U7JTWHJjMU9S:ez8c5pfsg5xq3/LW9DdIfGOdPCqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473023, "uuid": "1de67c0f-946a-4093-827c-3a2842e4d032", "value": 1767033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473023, "uuid": "2172345d-aef7-4f49-a687-25a87efa5b70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473023, "uuid": "50153d3b-e684-4df6-94a9-2b60a9d5c347", "value": "Kryptonclient1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb9004c-3b0a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505329, "uuid": "115e017a-3c85-479b-995d-0bea0afa939c", "comment": "Malware payload (NetSupport)", "value": "a250aeb8ffa0e327d7467e7c31baaf65", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505329, "uuid": "f295646d-5598-4fcf-89ea-3b54f235a876", "comment": "Malware payload (NetSupport)", "value": "6aebe04fe140e9f5b993575b6d774217a5c49096fde5c3d3a079d9a258653df3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505329, "uuid": "01ef5b40-83e4-4132-b793-003d70a18e04", "comment": "Malware payload (NetSupport)", "value": "a1a9d230e447d1fbfbcad132d9790d086fa63780", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505329, "uuid": "2b5e77d3-5245-4582-80fc-78e4723702fe", "comment": "Malware payload (NetSupport)", "value": "f0d201e0a37ec1ce686d2ab79e45cdd38aebdff61ab1c1b69181b9203a5672a0034abadc2d7e1e0b9e23d88e932a8d5a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505329, "uuid": "179bb43b-49dd-4bb8-bae1-6081c542f609", "value": "T16465335C0BB9C619E38DF4C6BC529B3A39582A3FA05DC7460BED1E26E6781EC7D62014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505329, "uuid": "a0c634d7-798a-4649-86c8-c52af1e298e5", "value": "24576:9I/7r/h/VdGNtz0euxT7YrAgGU30srsI2LJYyIvNAvKh+yJN9XfoMPWp33pmS6nI:ez3KzeF7RgPBmJG1AvKh+qN9vM43I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505329, "uuid": "bcb7d101-af29-4d55-9a18-5921e668c5ea", "value": 1506287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505329, "uuid": "72aa10a0-866e-4318-8d89-c7596bda7c8c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505329, "uuid": "76ff798a-2a41-4614-b91a-145497b1373f", "value": "6aebe04fe140e9f5b993575b6d774217a5c49096fde5c3d3a079d9a258653df3.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d997ed-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545680, "uuid": "fa7ace9a-dca0-49fc-83c2-d76de922a720", "comment": "Malware payload", "value": "fecebcd81c20541de548c02a602de903", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545680, "uuid": "b7b444e6-56f1-4adf-9786-44f932ecca4e", "comment": "Malware payload", "value": "6baa0309fdb2c87578fc2e2f4e167697c625cb95c294af931230a9a28e77af58", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545680, "uuid": "77569243-187b-4af7-933b-1f8f3d875df5", "comment": "Malware payload", "value": "84c3a9077cdb6adc2b8e77ff04436e2a7a97d6f9", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545680, "uuid": "97fffb1f-b257-41b7-883e-1a45e479517c", "comment": "Malware payload", "value": "acc6fde80cebf607f47bdf7a2438ce4ca2d9d8da0c4bea01dce027293df8fd77da7a42ac85c903572ca696247676a595", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545680, "uuid": "f210c136-3476-4170-b279-7bc556ccfeeb", "value": "T151859F028A5A497FDD1973BC98DE4766513308884170DEF2F1B6E87E1485FE2A9BCD8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545680, "uuid": "e1edcf32-535f-46a3-af87-1d8dd65ad198", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545680, "uuid": "7effd47a-5172-475d-b608-11224fb5733e", "value": "24576:ew35uhQSDgOsUm0uVJd73oYSZA9mhZ0GQZpHKETrBcSGNrlDvSmAqaeCHl4sN/Zn:/uGh1Ff9t3HTruSmklBKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545680, "uuid": "a7278ad5-0cb6-4fc0-8314-8107a9cbf1ce", "value": 1831592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545680, "uuid": "86ac6658-9f71-41b0-ab58-633dd792d44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545680, "uuid": "4293afeb-3c2e-4fce-a9fc-cbbca7b9e7c2", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a91ca3f-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776498960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498960, "uuid": "803c2896-e218-450c-a8d8-227e51d79a63", "comment": "Malware payload (Gafgyt)", "value": "15acc5c7be94f30c019d7d0673e3acdd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498960, "uuid": "b3266807-5cb8-4d71-bb76-7914b7350946", "comment": "Malware payload (Gafgyt)", "value": "6cb4e6a744312cd67a9397badf246a8343c52fe4abd84467ca02c290ee9752d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498960, "uuid": "ecdcab69-5933-45ce-88d6-fe0e0eec2ddf", "comment": "Malware payload (Gafgyt)", "value": "de823604122f0839b392f826444c58c8bf61372f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498960, "uuid": "45cbf356-5ec8-4519-b904-76df9c9c03c1", "comment": "Malware payload (Gafgyt)", "value": "36743080feb7a35c0caf05260bd1b65b276f28fdba71d8075fb5697c6e3d10bb3a53cd74cdaf26a71e39c7a33d292643", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498960, "uuid": "ddddfcb1-a696-4f44-8ed6-7078f4bb248a", "value": "T1BCF30945EA906B33D1E23F7AF69A82CE7322479467973346852C6FF02BC5BE84D36111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498960, "uuid": "833c0d93-5c5a-49fb-917a-d535dbb44844", "value": "3072:nhUY5EXPjqqmJEFBrFvY1P/atlb21hynoT6ovy+5DR1IAqd3DcpSwJ+RqvyiQUPw:nnfldHeajSniZyBkMMshQm7aBM/9mmTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498960, "uuid": "f5d53c9f-7b75-459f-a788-c0517bcaa800", "value": 166069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498960, "uuid": "cd3bcfb3-a735-4a06-9d1b-39879be1bfdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498960, "uuid": "e97dc01f-92a6-4d3d-b1ad-3f50c21283b4", "value": "Demon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c900377-3b67-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776545161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545161, "uuid": "a39f2e35-4d6e-4505-9096-f8ef2aa36acc", "comment": "Malware payload (OffLoader)", "value": "ff2054737127955e755959ca96e642eb", "object_relation": "md5", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545161, "uuid": "693d77f6-9a08-4147-b045-ecc0dcdc63ff", "comment": "Malware payload (OffLoader)", "value": "6f6d172d740d61bd7455e09b188fce1be4f2ebbb0c5450c40a778438a7366f4e", "object_relation": "sha256", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545161, "uuid": "e6334507-f96e-4dfd-af56-755da3680c28", "comment": "Malware payload (OffLoader)", "value": "91de0462ef409b3ac6c57f1906ddad0aae39f1bb", "object_relation": "sha1", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545161, "uuid": "66a1ee62-2327-40a6-948e-66b562444f5a", "comment": "Malware payload (OffLoader)", "value": "7da8e9736d45669fd9c9caebceeffc55e5abdc14cde347f41b4c53c96eaaf37c84eade312ef9aba2dd3eb3f6619cec47", "object_relation": "sha3-384", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545161, "uuid": "85eb657a-9883-4961-b152-9bd4cc76f57a", "value": "T1E9A5C03FF28BA13EE06E1A367972A110553B7A61A4128C5296FCF88CCF255701D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545161, "uuid": "59222930-7a69-4ca3-b249-b6adb9b2324e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545161, "uuid": "c81a807e-1720-4fea-898a-adeaf59ccae2", "value": "49152:duI5hRMs3WcUUMxuUO6QQNJ8cOxqDNrlHgVs:d5/z3OnuMNucySNrll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545161, "uuid": "7a354814-7d56-4075-a7de-d80d03d17509", "value": 2098152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545161, "uuid": "21fe191a-8c01-46a8-badb-77e16835f20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545161, "uuid": "cc3c8199-e073-4cf8-b43f-2e8e6d0bf7c6", "value": "Lift Everything Script Best Auto Farm Auto Rebirth 2026 - .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a111660-3b57-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776538232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538232, "uuid": "6d8ff0b6-59ec-4337-9de1-b027860715ca", "comment": "Malware payload (NetSupport)", "value": "f8f90c2210cd76a47c52e311633f61c0", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538232, "uuid": "0d2b03c5-5028-48a0-ac0d-5d70a35148e2", "comment": "Malware payload (NetSupport)", "value": "6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538232, "uuid": "5bcea417-7fd5-454f-b48a-7fcbb29e2557", "comment": "Malware payload (NetSupport)", "value": "dc26fc71b669b3496c827341fbd34335dd17a502", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538232, "uuid": "9e6cc2e6-2cc2-4cc4-adc4-b8ba712b1deb", "comment": "Malware payload (NetSupport)", "value": "a0efcd1059037fb5c26a5cf365620314e2dc4070365907f6c61d7657c8331c2baefddfe3a5ec4f6b73fead84a4dffe46", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538232, "uuid": "21f251ab-3794-40ee-89a7-d4e868128797", "value": "T1B5B67D648B84975EAE6F191BE078572F7BF33F66E08271FC46622743256FC046639C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538232, "uuid": "501953d9-3c89-4ecf-a362-1c49b10c5730", "value": "49152:qQ8hy0MNVQ3tlRGXEAcIqY5toTw8BFYje95R4z/CM14Lbe0d/HxCmdY:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776538232, "uuid": "819ebff9-a82b-4d4a-aefe-6bed5cdcbc16", "value": 10760021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776538232, "uuid": "453ef02d-b4d6-4383-8a1f-58d8488d56a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538232, "uuid": "fa27b08b-29b0-4708-9ed0-21eabe3e3f25", "value": "f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5843d56b-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527438, "uuid": "5edc1fd9-2bcf-4d45-ba8f-fdb0320fa3ac", "comment": "Malware payload (Mirai)", "value": "965e6d847c3b39ba1e9fb5f345835587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527438, "uuid": "485cf43c-6ec2-4659-a70c-9a26efeafe2b", "comment": "Malware payload (Mirai)", "value": "712b18cdb42791a55fc508d16c120fcf7ed2a5eba7cf3c424a7cea2ec42ebb85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527438, "uuid": "1a5c2c5e-a583-4311-bc87-677fa7f2dfcf", "comment": "Malware payload (Mirai)", "value": "f3c3339e28aa21c45490bbdea7da741fb4a67842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527438, "uuid": "56d8e1d7-1d35-4c50-a070-f218901c00a7", "comment": "Malware payload (Mirai)", "value": "9390e16da33e160b9173c56598eef1e65250c5c81feb6c39534a50ace088748a55f2a3627acf480b2336751bbc04e1e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527438, "uuid": "caad970d-6d0f-40ea-9ef6-c187784f554e", "value": "T1BA5302F6A0E47ECDC25A5334021F0A473EC2B7B4608A662AB5D0B6694BF1740CFD8BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527438, "uuid": "b7b895b7-8520-47d8-9ed9-f3b70b64a990", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASeULkg4azHg:CM5az1Fy0oPgdZX6hTo8R9LGazHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527438, "uuid": "55253c01-9e46-45ae-aa17-03d3f782c2a2", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527438, "uuid": "1f6cf808-e710-4e15-a6d2-1b49663bc2d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527438, "uuid": "ed38447a-e756-496d-ac69-210f8cb198b3", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c13b95a-3b69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545966, "uuid": "6e0656bd-bf67-40b7-899d-b5bc0e321e99", "comment": "Malware payload", "value": "38ac13e89b0cff299a5a50f62e9ed2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "Ukpa", "colour": "#5EBB77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545966, "uuid": "dff3b104-2235-4f71-848e-0d2b447b0b23", "comment": "Malware payload", "value": "713339b9b9977ea62cb5c56837bfba793fc9b4415d5822099b897d34c9e9873f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "Ukpa", "colour": "#5EBB77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545966, "uuid": "e2f46db4-771a-4e12-8565-5a281b3c60a1", "comment": "Malware payload", "value": "5a4cd786d457d7bf840da19c053a98303fb0307c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "Ukpa", "colour": "#5EBB77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545966, "uuid": "16774a44-b376-4a99-9475-2d406f7f982e", "comment": "Malware payload", "value": "f7fa1b65fb5ed41f3dd6777a0e8475fe29e054d90b26e91c5cadd977bb13e336798b7e37106da32e6f56c6da269cd571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "Ukpa", "colour": "#5EBB77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545966, "uuid": "8028df3d-7edc-4fbd-9baa-cd1011ef335a", "value": "T19606F17134D638F1E097E9F20C2BB9DE982BABC351F1266A25C9CD4B072617C67C3A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545966, "uuid": "bb1a4efb-29df-43f6-a474-ca1ca8783ab1", "value": "1d0c7294ab5e562b94c47e5bc4bc5c4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545966, "uuid": "efd30ded-bda7-4520-8b61-40ef2b64bceb", "value": "12288:em16epthok68tA9D0uvqnS4ZCz04Lhah4MziT1uqaK6/ZMcFVMb8wEJJMwQ0HZao:LHht7ATn1u7MHUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545966, "uuid": "46173b15-df67-4613-9f1b-9bbc43ada98a", "value": 3888128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545966, "uuid": "f0f3c230-db5a-46e3-9a90-b581652e9ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545966, "uuid": "a25f76cd-5170-469a-acd6-69a1f6f47953", "value": "msys-2.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b3196e-3b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776526675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526675, "uuid": "458f8fdc-dea7-48a0-ba98-69431e9c709f", "comment": "Malware payload (Gafgyt)", "value": "c15e1e5c19a3f351ee1530625b677de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526675, "uuid": "84cbce99-c27a-4dc9-b920-0499c40afffc", "comment": "Malware payload (Gafgyt)", "value": "71bb0cb1b7ebefff0433ac36de167d00d0ee19578bbe0316f8c10734c56fd014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526675, "uuid": "9968fdc3-938e-4937-a403-64c14854c715", "comment": "Malware payload (Gafgyt)", "value": "c28f624908d22b23ec4716ffaa719e37f867c599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526675, "uuid": "a7c3f64a-d74a-4430-a4be-921d6a5641de", "comment": "Malware payload (Gafgyt)", "value": "6cdbd910e18fc55ef8411af5d0bdc048793f54a796cc1f54ec062c1fb42a6e43b8bfcfb638b901f8daebefdf04d8c44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526675, "uuid": "eb3df090-06c4-4465-87c5-a784bd4e12c4", "value": "T179E3971E7E21DF6EF559833047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526675, "uuid": "75a3af31-69a8-4e14-8680-185e44246592", "value": "3072:i7qBY8ikREm96cPXqF9udnUawzlb6jHkkG2AgK6KM5hspZH:i7qJikREm96cPXqF9udHGW7hSD6N5hWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526675, "uuid": "c2d14a12-e2d1-4f12-bca0-32fae3c0b88d", "value": 148080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526675, "uuid": "4b04bf97-320f-4c3c-b10f-98e59208b5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526675, "uuid": "264ec247-2d3d-4488-974a-6f3a90595b82", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fc0576-3b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776553249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553249, "uuid": "bc02dcc9-5de3-4915-8489-a22ed26ffda6", "comment": "Malware payload (Mirai)", "value": "2848440d37f38768f83d03ea906c0cb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553249, "uuid": "ac831778-1140-408a-9b93-94c26b208c28", "comment": "Malware payload (Mirai)", "value": "71d65b2a192c0c540af0aa118215c143c815d23643ff09a684052b951b0e5abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553249, "uuid": "eaacbc5f-b999-43c0-89b8-14a3785428e2", "comment": "Malware payload (Mirai)", "value": "4a25ad513bd7fb10869a17ea428f2b44745f1f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553249, "uuid": "0adb9791-7236-4033-9b31-a1dc98455b50", "comment": "Malware payload (Mirai)", "value": "82a0e471378ad918d10740a4234afacda284f5799b9f035d68944fe57f714b12a1a765ffe7f6e1f68583425056b04d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553249, "uuid": "d548c6e5-3eaf-4230-b902-efb07f156c88", "value": "T1D4F2F1A74EBBF1BEF49147765C18EBD4B596B5CB9C081B6F8011339D08B37493901EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553249, "uuid": "40e949d0-71f9-4dd9-8c72-fa5e8ec47c94", "value": "768:ckjvsa/voIruB2NUJfVB5F7n/gcGgg8cFY6BiziJ3ew1hf5eHg3HYUx0nZu:XzHzxUrBPnJ7lAukCYRMZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776553249, "uuid": "047d87c8-0497-4bc3-b94c-566ef02698d7", "value": 36932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776553249, "uuid": "8bdef3aa-1d0f-4c3c-98ae-10314b17e659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553249, "uuid": "e40a1325-1e89-460c-ac23-6aa821af4efd", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb354d9c-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534073, "uuid": "57f43aa7-43d5-4f5a-9609-345279290c11", "comment": "Malware payload", "value": "f19d0613eb64741c8159d47b0b192d64", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534073, "uuid": "73a3dc6f-e33e-464d-ba88-916d8a7aa039", "comment": "Malware payload", "value": "71e4b44393cb994fbe103c2d1fb599c047e495778f87a292fea2ff1b5403fd3b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534073, "uuid": "b11f34c4-106b-4e3b-b5d0-99060920100c", "comment": "Malware payload", "value": "523c077a1fdc7eb200ef0a03040b9c9a8169cbea", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534073, "uuid": "ccf0d7f4-b1b5-41c2-8c00-937c791fc75c", "comment": "Malware payload", "value": "a28ea23620b008f5d610e007a48b41c85781f1dcb43c207e5e4cb292610405b4fd1a29fd63d90a9b97274e564aa2984f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534073, "uuid": "f6e27373-e17c-4ad9-89e3-f5589c1c37ce", "value": "T1E7953368AD335F22AA578EFC9943D08D6609004BFC21677142E4BB53ECD4ADA125E3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534073, "uuid": "961be610-07f2-4cd6-b3b2-23d61f76e258", "value": "49152:uDhhqR7V2LID0njwa141AfmzRdmY8R3hl0Zt:uDhcD20Dps8Af2Pmp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534073, "uuid": "4ce5964e-6f61-4901-98e0-fb49fd765997", "value": 1910456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534073, "uuid": "a2457b95-7c9c-4131-bdd8-07381800f76d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534073, "uuid": "f3a1e898-8f75-42f4-a1cc-05862b678665", "value": "XenonInstaller-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c40929c-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776526907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526907, "uuid": "36345edc-7967-4134-96ef-7ffeb024f867", "comment": "Malware payload", "value": "ced2f138fef8fcc5144c4b9fa1f857b5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526907, "uuid": "f0cdc4f9-9563-48be-9479-95a5ba6c5a41", "comment": "Malware payload", "value": "721ad272ba7f15ddbbad280b13801c0db4e8e4925cf819ddcd3d64f0640cd631", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526907, "uuid": "e9242369-1701-456f-ad52-2a7feddd4efc", "comment": "Malware payload", "value": "da1d25697729c171f7f882f92e119fcc63906aae", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526907, "uuid": "7d5b48d7-9ed3-4c36-9251-9d67389a7fcc", "comment": "Malware payload", "value": "c874cb11d8d19c32b0dcc926b744363f3052c912b89eedae1c39ff0fe7646ebd61663a674cfb1e58630678a098a5ec10", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526907, "uuid": "2a9c88d7-711f-40b0-842a-c3380bd72f69", "value": "T14CF4027196BD44B6E78BB376E11608112C5FC1CEC80E601715AEC5BB8C8BCDDAB743A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526907, "uuid": "c24e273f-b709-467b-996d-a7b270a8c2cd", "value": "12288:bSWpPYdL3w0zbz6Ctw6dpJiw4r85zqYR4KDdgaRQSFVwyGVxyBlcM:bS7bw0zbrWzpI5rDgaCdy6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526907, "uuid": "c007641d-2be8-49a8-bd27-70722f1f8e0a", "value": 734053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526907, "uuid": "dd576440-d106-4521-b53a-2589b644a922", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526907, "uuid": "5aeb8e4f-0b5b-472d-a704-a37d8bc4ca10", "value": "KrispyClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd31fd41-3ae6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776489811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489811, "uuid": "0b3d7c47-743f-4cc5-bcab-a859a5248849", "comment": "Malware payload", "value": "04490a21f25ec9ea1610812ffebe71e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489811, "uuid": "47ecbeae-7b8c-4adc-8a1a-ab8ca195aedf", "comment": "Malware payload", "value": "72d599ced8b50dd5eae0788e43a68e6d0b1f41fe7352ead93135f64b2a789709", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489811, "uuid": "974089c0-2cb2-4e6d-9d77-72f101864598", "comment": "Malware payload", "value": "1238828bc6fe8d9b80b3a2a27ae593ee9ad871be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489811, "uuid": "4eef6f1b-ae77-4ca3-9168-2de9e58a6e9e", "comment": "Malware payload", "value": "89ff98dcce3ce33e4a7a3edd5d004b124d50c9bb63b043dbc77630f7668fae289e84f023155952b80a32f924df89b4da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489811, "uuid": "b4bac78f-d290-4051-800f-5164d0339b98", "value": "T1F8137D6526953C24AE99883B5D7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE618B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489811, "uuid": "85d8ebd4-87eb-4cdd-adea-ce62f84b808d", "value": "768:b7s9NyXsZztC69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bQHusZqcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776489811, "uuid": "a894fd81-bede-4712-b12c-a57d6bffdb0f", "value": 45519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776489811, "uuid": "bcdd60ac-6981-4321-aae2-60730a3b37a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489811, "uuid": "898c078e-3f5a-4e32-abfc-d3a2f6686f41", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee7fd7f-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527449, "uuid": "97af4c91-9ab5-457b-a157-e9d7ee25a9e7", "comment": "Malware payload (Mirai)", "value": "da12aab138492ccfc1f1b0c1f139c0d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527449, "uuid": "63638d46-ea31-4baf-b0ff-58edde83aea7", "comment": "Malware payload (Mirai)", "value": "73830590924e03abbc9a62033ab017f1fb4252ba5ca97a54867a450b61774b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527449, "uuid": "caa3bdd4-1e15-45a3-9e52-57812318c8a9", "comment": "Malware payload (Mirai)", "value": "6f3530835584fa810fa5caba1bb6c11c1db8541c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527449, "uuid": "b69d3df3-309f-4dbd-887a-95e47df13308", "comment": "Malware payload (Mirai)", "value": "b228696df27c09062ea546c1b26076b814b3065b8af04431854bb3e555d9ce685f46ea3544b19449e784c78bec1ff37a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527449, "uuid": "3b6e2c1b-a03e-41a4-8070-cc4ea908a54a", "value": "T17D631297FFCC1B9DFCD91AF807AB66D72322943554B341A809E59882816FDB111EACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527449, "uuid": "3a409549-4227-456e-8a3f-8eb0eb8db8d5", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDgSIJ1QrPJ:27Mbp2L+Xqdfoz2srI0rPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527449, "uuid": "4f2aa8e3-914d-4d68-ae41-42993437cbca", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527449, "uuid": "310d99c2-6730-4bab-9cd7-8a762eeeec9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527449, "uuid": "f86bb8cb-42a8-4f89-ab94-6ac11d0e8e63", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eb72d9-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776498756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498756, "uuid": "62700dee-aad9-4e46-b318-41b1cedc6286", "comment": "Malware payload (Gafgyt)", "value": "40726e8d22620b73b39532f00a30b2d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498756, "uuid": "0ed34c32-e5ac-43ad-8436-e7af0e900e16", "comment": "Malware payload (Gafgyt)", "value": "739135066c762d50a9542ff91c094e7a53df452ad188821a34dc05b5c9c35f40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498756, "uuid": "7184f285-334b-46f4-9c35-8ad12ad57c87", "comment": "Malware payload (Gafgyt)", "value": "2a43394e9f1b35dd827ec2f860b666ed8e88c921", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498756, "uuid": "7814cbc3-b346-4cea-bac3-a0626c961ab1", "comment": "Malware payload (Gafgyt)", "value": "bbb98047cc690b5f67ab4cb86e772035fec280730b37dded665755e4f4b6cd2e9acf411f1349efc4ea75f5fcbd275686", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498756, "uuid": "97f8a164-7d53-426e-84c7-b6a487cb508e", "value": "T1E43171C971A20851F8A0A916B27BA88435B696FE90EE9F59EDDE3C39C44CC48BC04E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498756, "uuid": "8dccc825-a270-4f26-8a5c-2c8e8ad66d1c", "value": "48:gX3KjHXVQXPOXiXbCXaX+X2XS9XTCX+X1MXsBXDyZo4:gX3KjHXuXPOXiXOXaX+X2XS9XWX+X1MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498756, "uuid": "ef2fb02b-0c93-4856-90af-b57aa6094abc", "value": 1630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498756, "uuid": "7012fda8-18fd-47ca-b147-f530b38a32d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498756, "uuid": "8100ba17-64a1-470e-bb57-7f2755d9995b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c77ae2-3b19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776511547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "6c62b4be-9732-4cd5-afca-4a0cea15e615", "comment": "Malware payload", "value": "6fda5fd10b91738bac7fbd9139f95944", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "0d118ecb-5f2e-403a-895c-2c7bcd1d8204", "comment": "Malware payload", "value": "7442852efb8cc84ffed7011fcf8dc2428ab84344a040e5ec2c05fb0cbb7b273a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "5ec97ea4-2dd7-472c-8157-abb24dbdff42", "comment": "Malware payload", "value": "d43f909a658d8d010680b2176be045358c8a741e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511547, "uuid": "d9cba23b-f739-4b07-96d9-9db0f23028f1", "comment": "Malware payload", "value": "96a22f616aa1fe73637985819d8a07cfddea1f51190d7e5d943444deba0aac9d170147c18a6f5ca1d69b2c63c0d73d9a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "a77dcab1-684d-444a-b138-4f6754b5e01d", "value": "T190B58C0BADD508F6C46A9B318DB761927B71BC090B3263D72E41BA782FB2BD05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "acc25223-eb71-4035-a16b-4a43d8f0c94c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "8a86a80e-447a-477a-bee7-009ed3175995", "value": "49152:SoBEeptkSnUD38XihcUXklSPdiknqlrrpA/V:SoHDXZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776511547, "uuid": "39264cb2-6b3c-4cf8-8202-d23003cfb648", "value": 2372312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776511547, "uuid": "26d6dd77-4932-467e-99cf-49c457581e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511547, "uuid": "c729c34d-1fd0-4264-9917-34e37b09c6fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4feb75bc-3b0b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505519, "uuid": "f483aeb2-3892-490b-a56b-b29caba88656", "comment": "Malware payload (NetSupport)", "value": "0eb65d2f0885e48fbec672463d2bb569", "object_relation": "md5", "Tag": [ { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505519, "uuid": "f17681ab-4861-4e2e-b8c4-8917a89fd6ea", "comment": "Malware payload (NetSupport)", "value": "74df5abaff4ebfcff85701f4d41c6145381bbb8d439550f367f2d49430d83af1", "object_relation": "sha256", "Tag": [ { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505519, "uuid": "bc34c568-0d27-4eaf-a714-8298d8ef24f4", "comment": "Malware payload (NetSupport)", "value": "4e6ab4722bf5a8ae245e1c4aa859a8ad9d52e23d", "object_relation": "sha1", "Tag": [ { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505519, "uuid": "307d86d6-3758-4058-86ad-a851336db168", "comment": "Malware payload (NetSupport)", "value": "c7c7454c2ec0d9cde1fbc29455d4dba28cd25c3b451f69a458137560235707b686ad9f31cf083eb806ac4e38e5b19c78", "object_relation": "sha3-384", "Tag": [ { "name": "dravonixu-com", "colour": "#22E68B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "praxivono-com", "colour": "#9AB02C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505519, "uuid": "42c0c457-f320-4135-ab43-4841edbd61dc", "value": "T180A68CB88B84975EAE6E1A07E078571E67F37F26D09271FC5B62370B266FC085239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505519, "uuid": "f7df35d1-2a32-48b3-8fe6-70ea9e6d39b4", "value": "49152:T6+ySk2B9p2FGDRISMvSgjV9xwSjAfV77u2zAxN9hv:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505519, "uuid": "0bb3d466-c570-42ee-b0dc-ff050f35e4e5", "value": 9620554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505519, "uuid": "91aaaf20-20ce-4ee1-82d9-f99827306c57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505519, "uuid": "7d902146-9cd1-4ba6-ac47-f1e32daca641", "value": "74df5abaff4ebfcff85701f4d41c6145381bbb8d439550f367f2d49430d83af1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04a97c1-3b5d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776540953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540953, "uuid": "8fc39ef6-eadd-470a-a575-6dae65c7e86d", "comment": "Malware payload (SalatStealer)", "value": "3263bad6871e024d5d903028ef24af39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540953, "uuid": "3017351e-14b9-4e48-8d57-61fd598d113f", "comment": "Malware payload (SalatStealer)", "value": "76ac7bd21164ed324bbbe9e47cba90e1b1e5f830bd2afb9a3503a54c698231c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540953, "uuid": "0c6c34d0-8ddc-434a-b68d-a3b43bce74e8", "comment": "Malware payload (SalatStealer)", "value": "05e83cc3773f84f286d83f56bf6e2378a2c0393c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540953, "uuid": "7207d960-57b1-4f61-8d7e-3bc6ec62f8b5", "comment": "Malware payload (SalatStealer)", "value": "ae2db9db6718b739ba8056ccb37ffc0ee19d1ba7f77b5eb27f653a0810842d09540ec3382e08ec4e40a80642e34e2076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540953, "uuid": "bc94a65c-65cb-4cd5-a8e6-cc17ae7c59ff", "value": "T10617338962B0896BF724863113364C95F13BC570B1BD183A3BA5F387715F453A8AEE78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540953, "uuid": "629fa015-d320-495e-98d2-4cc5a04f3b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540953, "uuid": "0135051d-ac26-4798-9c7c-621dce5c00ed", "value": "393216:4a1UmvBqf/cA/4e0e0cZVICIYaiNlYJTVV+k+gwnjdhSaBMTg58a3uVuhCS:4Nmv0nclFe0MV/IYKlVck+gwnBhSah/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776540953, "uuid": "748b756e-7847-488f-bf79-85cc7a9bcf04", "value": 18570240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776540953, "uuid": "d10fcd4c-394d-4bf3-92fd-a2c67104d85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540953, "uuid": "32c20d9d-7731-480b-bd66-197a80056b2b", "value": "kickbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92249105-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498758, "uuid": "01a0cafe-87aa-45a3-b1db-0261d2ff860e", "comment": "Malware payload (Mirai)", "value": "b2e3fbe65afdbd32b854ba15e5bd2d29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498758, "uuid": "da4fe9de-03f6-4fa0-b219-f0779496ec48", "comment": "Malware payload (Mirai)", "value": "7865347f9e0acc3ab9bfec7eab56bb9875134c93ee7e6ca0cacbf4eef3e97d9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498758, "uuid": "61ac056d-4a54-4c79-a479-03a459a57ea5", "comment": "Malware payload (Mirai)", "value": "bff41b6aadc33f24858630e3839a62f5250c647b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498758, "uuid": "f1da7c68-2091-460f-800c-eee82c6e4d71", "comment": "Malware payload (Mirai)", "value": "d64cdcd3dbc9e95c5f72bbbbce0dd646b8fe5e5195b320f1ff3ec5e0783fb3d2e4858cfa0ef535d9af9ad18e73665323", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498758, "uuid": "de953ecb-5725-4356-b8e4-a3a0117b9043", "value": "T1A2C43955F8809F61C6C539B6F74D42A873074B79D3EB72069A245B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498758, "uuid": "dfcf726d-70d7-47dc-b53f-8329923f498e", "value": "12288:WdNYe/3V/X/dr4XQxuYrLFcQ5bNAzPC2sCqXc8pdP1cl:qNYeBPdUX6uYPFZ5bNFfP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498758, "uuid": "878dd1e7-40f1-44ff-a814-a483a6253788", "value": 571948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498758, "uuid": "4559c0b7-5f09-4ff5-801e-eabc0b270089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498758, "uuid": "07ab8d3a-9dcd-4736-9703-2c968aa7054c", "value": "l_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e2dffd-3b69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545868, "uuid": "29ee007e-a25f-4650-83a7-b41520508667", "comment": "Malware payload", "value": "670ded42c7ca725a43f4a66b77c808ba", "object_relation": "md5", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545868, "uuid": "cbe221cd-dca4-404e-8f50-de19a667f568", "comment": "Malware payload", "value": "7917b0b734bef9a3d0a5fe39f7b173087dfee37a08e9d8020e9e0cb567dd2698", "object_relation": "sha256", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545868, "uuid": "0dde2bc4-560f-4a45-9fa9-dfadb276038f", "comment": "Malware payload", "value": "96e3c3286e3329a7cd637758e641ebecd354a9ae", "object_relation": "sha1", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545868, "uuid": "807a424b-b5c0-4be6-b77b-ab2387b5a595", "comment": "Malware payload", "value": "d885c2b141188b0af237b46427732846554a98f1e7ac65e767dd6be40211a0566f219b63db722f7fc68197158c637d41", "object_relation": "sha3-384", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545868, "uuid": "3681395f-7d54-4503-b06e-fb3de50216e7", "value": "T15EC64B03D386A59CC0ABE373C28E17737327F9A843247B5B5C516BA13D26AE45A6F314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545868, "uuid": "5dfd08cf-31f7-4f52-92df-c8c609862704", "value": "04d9a980eb2007a7b415d6774f075a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545868, "uuid": "2a7b089a-aa94-4047-a789-18ab7e8d2d6a", "value": "98304:+alaavS0FR2EX0FXHmCpOXG81RxEVvZtWET8o/RtaVdca4ONOCQjxkUlkO0juJpQ:hGbpO2gruvXRJ/RUXcaFOChUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545868, "uuid": "325427cf-f650-4f18-bcdc-e63d0ba99852", "value": 12209841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545868, "uuid": "5b035d9f-45c8-4695-9368-a786cb08866f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545868, "uuid": "b7a38dec-5bd1-40ae-b8ba-c12d3f48bc5d", "value": "iviewers.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cdcec9-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494203, "uuid": "cd55b3e2-46a4-45b3-946b-ea9339a9a959", "comment": "Malware payload (Mirai)", "value": "95d0b7a9a2be1773871104caae9404ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494203, "uuid": "caa2d6e5-0166-4cb0-bd82-d9cdf9ffc5e9", "comment": "Malware payload (Mirai)", "value": "794639f0f4b89e1bcd618ff1d62de51ac69a3229cbcc73f27d044978759734b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494203, "uuid": "1021f4cb-a6fa-4954-ad43-182ddcca9dac", "comment": "Malware payload (Mirai)", "value": "cc31b5886b159e243e173e1b6e10f1958fdd7035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494203, "uuid": "01c5a56f-2a1f-4732-b649-5c09d53e7be6", "comment": "Malware payload (Mirai)", "value": "1c31bce2ef4a18af581c0b75cefc5cec3dc7116e7d2aad8c7b0c31161f11795c1bf63e521539943fad16780b064df733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494203, "uuid": "aa24f138-46cc-4df8-a241-ab8e4059d91e", "value": "T15AC2E160F8C1B9F2DEFEED74885085C03BF21E4937E1CDC6204EEE525222D329A68A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494203, "uuid": "5fa3c8c0-a4de-4c74-8aa8-c6b7880a39b0", "value": "768:7KnqLiChP7gI5gBZw+LajRvZ4uVcqgw09C:7KqL1h4Zwa6lZ4u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494203, "uuid": "001b3ac6-d992-4307-bb25-62c84f1ceb3e", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494203, "uuid": "012cc236-1a71-4dbd-9910-2fc4e45fc4ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494203, "uuid": "e3b8d4b4-801c-4bb7-8f8d-13782979a377", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32e54b1-3b1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776513014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513014, "uuid": "8b95e968-be0a-457a-a24e-31186b2defcf", "comment": "Malware payload (Mirai)", "value": "aae8d0fe3edf5b6fafe9b4e31b8f79ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513014, "uuid": "b6ee6eeb-c50c-4807-a6fe-d521770a600d", "comment": "Malware payload (Mirai)", "value": "7a71a50005dfa90d36e25147c9ee7718e9f650f1af14bc08a1a71e59df3b61b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513014, "uuid": "fc4c0b81-4007-4a28-91b6-7f64ceedcc49", "comment": "Malware payload (Mirai)", "value": "f853f5035561229f06eb1bcddacc4318f55ea9a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513014, "uuid": "8ba8c4ce-63c2-4db2-805b-6bb8a9b8b52d", "comment": "Malware payload (Mirai)", "value": "46a5db2196e78a785c9bffb26aa7c48c76e8ca432626fd4a8145ee8ce55f9635af38661dee7ee88074e9a9e0e32b3af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513014, "uuid": "e0258aa2-8402-4708-8d39-6b1c6c2034a7", "value": "T1F14302611C742336EE29437BD5BF6B89507096298840787EE5E970C727EE7317F1A8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513014, "uuid": "05bf5d93-76db-4c73-b7df-f344ce48a11e", "value": "1536:Oqx3kottijLmz3Tb3Schwlzvqkktf08nouy8tyj:OqGiA+r3nhwVqRscoutu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776513014, "uuid": "5c0272b3-3946-4bfe-9389-2272ed5c0980", "value": 59212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776513014, "uuid": "3ea9e87b-ee62-407b-aa36-ece9886db282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513014, "uuid": "f24de9ea-29ff-4792-96dd-7715eb462d7f", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b061c7e0-3b09-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776504822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504822, "uuid": "028b65fd-f423-4a30-8a7e-5eca30028458", "comment": "Malware payload (RustyStealer)", "value": "23539c1ab5c2eeca15131638625ccebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504822, "uuid": "f7aa8d69-45bc-4719-acb6-207ec6907042", "comment": "Malware payload (RustyStealer)", "value": "7b44dc819f9cece531efdd6dc47ff8ff22ed3e215e1f638f3b983b4cf993b096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504822, "uuid": "79684f26-b20c-4602-b37f-5a2e419e0f1f", "comment": "Malware payload (RustyStealer)", "value": "262f5502c6064c8f0966637df7926cabb7b55540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504822, "uuid": "32b6d81e-a118-4eff-a0cf-80f1366042bf", "comment": "Malware payload (RustyStealer)", "value": "3fc1e961d6a75f443fb32dbc6889010c4164ad141f272f43c776efe7e459cf9a5f95d46bb6276588bbf287299fe706b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504822, "uuid": "4447c1ee-ba32-49cb-823a-adba6b35a14c", "value": "T1E7658E42B4B46A6CDE4BD274429FA236777978490333EEB7053A86701E47A939F0D34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504822, "uuid": "8de4b834-cef5-4c15-9be8-a8f9e3a0426f", "value": "a292dee0a8b7dfdc02ff33494a90b5fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504822, "uuid": "b4d4b568-8e7c-48ad-a0c8-fe9e04ecdc24", "value": "24576:sbiZZoQZYY1mNgXzzbc5sG4s22oe3NKx/9o2Ccjv:sbiZh5IgDc5VYedK/9o2Ccjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504822, "uuid": "04e9ee50-a7fb-46de-9719-056b348561b7", "value": 1538393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504822, "uuid": "997ce5b3-d899-4fd1-911c-5ce451e3721e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504822, "uuid": "42478469-6a48-47c5-a7d7-468b2c289808", "value": "resume.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313c9ce7-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776485711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485711, "uuid": "5f9d61df-54fd-4f16-b4d3-fb4bdbec60b6", "comment": "Malware payload (Mirai)", "value": "8345dc6d8d4bbc75bb9303470c5e5e3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485711, "uuid": "75222269-2d9a-4e80-a90e-50ed2a53f167", "comment": "Malware payload (Mirai)", "value": "7bbed4249c5ca3a7b2c185087596522195ba7d1e8a6c3f485a19bfa5c44e1807", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485711, "uuid": "e73dd79e-a650-4389-b977-eb9d364bce67", "comment": "Malware payload (Mirai)", "value": "fc70b344deb4b562430b3a40a1d2cc75ebab1cdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485711, "uuid": "09fba8c4-d164-438f-aee0-7bf42908562d", "comment": "Malware payload (Mirai)", "value": "4e2b32729e41eff46b95a49d4b0ea6abe8f18b2b9de181b8a4ee0334b55221ed70977e61bed4d6260614a89e8084c9c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485711, "uuid": "d6ea89a1-7383-4ac5-9bfe-49ebb3ac7c0d", "value": "T15E1106DD3CB86A762A0FF9C8B06E81087943CFC5E877C780B26844A550C7D10FA65BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485711, "uuid": "5bfa6fa3-918f-4148-a7c1-b844d42c44e4", "value": "12:3J3zqYIQzq3ZabQzqRNNIVkvsBAQzqoaqK0HQzqe5EQzqcy1FqQzqHNAWmqQzqTe:3J3PNNIG0FK9z+F2NfmZGftHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485711, "uuid": "cd3e0085-c7b1-48a2-aa43-3c3c82d8a54a", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485711, "uuid": "f1104895-1d2a-4d98-b384-1021a004d15e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485711, "uuid": "7e0af450-6c8f-4e11-91cb-6697a64fc15c", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25e17fd-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494195, "uuid": "0ebd4653-c6cd-46af-b810-a0e610d54b7d", "comment": "Malware payload (Mirai)", "value": "4f776ed88df59b6651f363e2fa29a831", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494195, "uuid": "d5304286-fe8b-4c91-989b-8ba664794069", "comment": "Malware payload (Mirai)", "value": "7c66410bef86d9f38cc0ab2607c84a12de0f5225d3fa6edecbea0c5c77bf6616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494195, "uuid": "98793f22-ece5-4df5-bb58-9a452b89ffcf", "comment": "Malware payload (Mirai)", "value": "1a8b74226359268969aa141c5c5021578ebdc241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494195, "uuid": "334790fd-cd64-4873-90f5-6e09e3d3ee50", "comment": "Malware payload (Mirai)", "value": "2fc106383e8a4f995e9346c95011e0f3cfa0125ed243f294b9b4fa0c20e52212d5e2f9d6859095b7feb2551d8307ed15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494195, "uuid": "b0a4be8a-744f-4c45-83a6-86b12da929e4", "value": "T160C2D1222AFF38B0C2A470BAFD78C9DB624F0FB925F15521365057A1CEE200352758E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494195, "uuid": "f5739281-cda7-4a10-a5ee-855db9ebc473", "value": "768:AjKX9vt6GqA3Q0jzV7EUyUq9E/Ys3UozR:AjqtBqoB7EUBxlzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494195, "uuid": "d997dfcf-222b-4bf9-8b3f-66988ef6826d", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494195, "uuid": "c18a1fd0-7667-4f0e-a6e9-70e0ed8d50ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494195, "uuid": "1d32ba3c-064a-4dba-b97c-deb4c086b732", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f47a7a-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537096, "uuid": "7c76bf02-9753-43fc-97f2-94949f8464e8", "comment": "Malware payload", "value": "64d863b892ba3d63f11b59c473043e11", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537096, "uuid": "6d3539e3-b3dd-4c74-adf1-2291451c9f00", "comment": "Malware payload", "value": "7c813b42a8a32572790a9941c859438d47dc86553a25671923f7e6bd112a7056", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537096, "uuid": "55143f8c-c70d-40f0-b227-6361d4620a2d", "comment": "Malware payload", "value": "46907f59cd711790cfbc0481e9ea7585f7252cfb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537096, "uuid": "3b22aa00-2520-484e-836d-d1609837f0ed", "comment": "Malware payload", "value": "a410678860e2d54367f249110e3e5f042770442cca503e3b0d15fa059b1a79246c9514445eb2eb2257bc86fc4f19c17d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537096, "uuid": "012ecdcb-dadd-4a99-8d42-2e23a0c682fb", "value": "T1438533A1350699107F633F358F5D78339891DA9131ABA484E39E170FAA5F4FBCC22B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537096, "uuid": "7489e549-e655-4c64-81c0-b492268d0a12", "value": "49152:aKTd6OxbnW6G8H9uY1/Y0OrmGNbjJM77kGryyi8qa:aS9xbnjGEt1oxNbjJa7Zyyila", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537096, "uuid": "8517fd62-7c60-4cfb-8b10-14d164ba53b1", "value": 1787477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537096, "uuid": "765169a2-7cf4-4406-882d-2fa4809ea0c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537096, "uuid": "2d5f044b-4de1-405d-afbf-1effc8577653", "value": "Krypton-1.21.11(1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960fc41d-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776533984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533984, "uuid": "95d2883a-5559-4062-8814-61fa77ada9e0", "comment": "Malware payload (Mirai)", "value": "30f52c64bf9ef56bd9850544b1d78d99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533984, "uuid": "2c33c257-7697-4c71-97d7-3ff7a16493eb", "comment": "Malware payload (Mirai)", "value": "7e23f5102584a559b3731854d02338343d0d9a9cf2e49c144220375adfbf5667", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533984, "uuid": "70337805-080a-4ffa-9d51-280b980abb88", "comment": "Malware payload (Mirai)", "value": "80613ef0855fe58a1866f24b47eddfd5077aab73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533984, "uuid": "57361ac2-a6e9-450b-935a-da44a22203de", "comment": "Malware payload (Mirai)", "value": "6f31aaaadebf007853608f04bd02098e1effe4f5f5146207ed0d535a13cf38f8908d9f4d3d00bf1538feedf06ea0ad78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533984, "uuid": "3de1f1fc-c406-48ae-9fe9-1213bc2d35d5", "value": "T19AD312B3C639E3EAF471E4B0B66C23CC101462D9C958BAA0774C54661B5439B1B6F3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533984, "uuid": "50627ded-15cc-42f9-8821-0a52dd35647e", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtou:2IIKXhZtL7jOTyIG87X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533984, "uuid": "a1e5c6cc-d550-43f4-84bb-2dbd59537aaa", "value": 135473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533984, "uuid": "287444c1-540b-4fd4-a080-969b4ae8da3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533984, "uuid": "d73b51bf-033b-428e-a5c0-c15e45d0cefe", "value": "7e23f5102584a559b3731854d02338343d0d9a9cf2e49c144220375adfbf5667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e97f50-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484512, "uuid": "4b9076a6-b02c-4a36-af0c-8ebb57946baa", "comment": "Malware payload (Mirai)", "value": "d6e8cd5cfeda0bd17d4f776a2e51367a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484512, "uuid": "c4ed3d66-aa3c-43b6-b7e7-ebb8525fcf44", "comment": "Malware payload (Mirai)", "value": "7ed6f137d6e1a635a6206ca4a598ff17363f2ed95e857b5d27a29b74e831aa7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484512, "uuid": "56e1ac34-3b78-4a6a-86d6-fb108654a707", "comment": "Malware payload (Mirai)", "value": "cb456257ac5f12bcebb25835ca9809bc866d3e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484512, "uuid": "c2f0e996-a297-48d3-b950-715db598c784", "comment": "Malware payload (Mirai)", "value": "3e0cdbe66f5673a1e892a044de3c7432bc41f6b376f9ef1574c2e5ff9432f80e2220275283a1ae52346a7c0f83038b03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484512, "uuid": "2861fb0c-5535-4a77-8ddf-82ce92e2376d", "value": "T1EAC32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484512, "uuid": "6d1599a0-4f8f-48df-9b28-fd9fad3d59bf", "value": "3072:IZMu4C+u2iLhLRE90bYK5h9T96NOh+5/YtM/9gM/:eMu4C+u9RfbYK5hb64+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484512, "uuid": "e02f2447-f1d8-4b0b-be5f-a55b558fe952", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484512, "uuid": "52186a05-cf6c-4818-ba69-205cf7407e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484512, "uuid": "d16868b8-a7c8-4ce8-b966-5c188dc07ec6", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01f30d5-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492903, "uuid": "ce0098ce-6be1-4cfa-9502-ce3bf035abea", "comment": "Malware payload (Mirai)", "value": "1339eab3adda27f2ed53217e7ce242ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492903, "uuid": "dc3ac5b1-03da-4ca7-9bf6-d2d214309640", "comment": "Malware payload (Mirai)", "value": "7ef1aad978f81b91405e4a0001089edea23a17f6acddcc62abc7edd136d97657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492903, "uuid": "27dc0e66-8056-46dc-afa1-cf20b6b0e882", "comment": "Malware payload (Mirai)", "value": "73e6a7d78f61427e56e4cabfb3b445679c4cde47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492903, "uuid": "bfb0103b-6177-4dfa-8f18-e8ba7f395fe8", "comment": "Malware payload (Mirai)", "value": "89971c2e496be12de3f9572fb905e79137780ffd3e1d419a26f0e0d6786a223b03e80629f5cbfc6190111581ed8b6f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492903, "uuid": "e7b27f6f-06f2-4cb0-85d9-359e8cdd0d8a", "value": "T18DF2F0702745B8A2C9605AB7FAF2CB46F35A9378D0FE306912050A54E8E162358FA3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492903, "uuid": "0ae462cb-9162-4e65-8efe-d708f2bf7ee5", "value": "768:EJTKmOVP3WWkPgb7lPBIqxwQEECBah3zGKpZhRrjcs3Uoz9:EAmO4POPN5Evo3FpPdjZz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492903, "uuid": "4f7f6ca7-df03-4d6b-945b-d0857da348ae", "value": 36832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492903, "uuid": "e1c29864-d058-48f0-b3d1-7455c37bf78f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492903, "uuid": "a3ed4ec5-df8e-4ace-a64d-d4becbc347f0", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b0ec67-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776498065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498065, "uuid": "97ad086e-b79c-4e10-b9a2-2b704cd9d991", "comment": "Malware payload", "value": "6016d6281d21a73dc3db2f05faa1c504", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498065, "uuid": "58ee394a-77af-4071-bce0-0e34bdc01312", "comment": "Malware payload", "value": "802e879bbb2dcc50c2acb90b64919d200e0936c6056db4f7514ce601474e798b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498065, "uuid": "442eecf9-b0a8-4a36-a1b7-cdb078b6dd52", "comment": "Malware payload", "value": "b2e214ba4e4af545f4a2231484ccb9b78b7c2e90", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498065, "uuid": "73531438-75ca-45d7-b92e-43d9830f9cab", "comment": "Malware payload", "value": "8d73558804f5fa9f290164be913d3bbde4110ec1d5b226b4be1e8cc7f0e03c9337fb11aa43f838b443e99e95dd8e3591", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498065, "uuid": "ebac4da9-900f-49b6-9040-a5fd3c075abd", "value": "T18DE46B233B11DFB4D324D27009F3CA555AD529A20AE25089B278D71C7E6162E2D6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498065, "uuid": "2dcd81bc-5f21-46dd-ae29-82e71ac56a63", "value": "12288:gD74LzvsEEBLM1AStHLI4G0NHqGk2xNp75c++zcLGM8ppHhXBXZ:o74LzvsEcMdHc4G0NHbPpFctgihRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498065, "uuid": "4e1ca360-2eb0-40bf-98f1-bee856317b5e", "value": 704976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498065, "uuid": "e740d466-86b0-436e-a905-5c568129c36c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498065, "uuid": "5b07374e-606e-4547-8622-0c31e5eaa8ae", "value": "l_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45ac1c7-3b74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776550892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550892, "uuid": "5d8eef01-065f-41e3-a0a1-b52c0b1ea40a", "comment": "Malware payload", "value": "886daf3dfac5e3820a885be56d0ab50c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550892, "uuid": "ee2e903b-01b9-42f3-ba47-451713e60775", "comment": "Malware payload", "value": "8031ff1c2814152c1965f9dc73a119156fed841258435ecb32f1f6c27d597ed0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550892, "uuid": "c9a989f5-fd8d-4f51-b678-55a4e54d7a17", "comment": "Malware payload", "value": "d30e84a1bd33dc2255da75238763fe1e413f2f76", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550892, "uuid": "40956c9d-00c0-4bbe-84a4-86f435576e0c", "comment": "Malware payload", "value": "268559cc9fd019c78daee10f17b6bd6783b82adb31c61ada05f92090b63f7fd7ab242f27b2a860b050f2c470b8062027", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550892, "uuid": "b64777f0-5f20-4f90-ada8-fa54d34022d7", "value": "T11A051222A26B4223DE0BE078F86788917DFC84F8714DE59511BEC1C1E553EBE5660BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550892, "uuid": "3fc8ed24-3aff-4573-80ec-b54815c9b6d5", "value": "24576:nMYjXetPy7bK4l0C9jpIX1yO28/MpzdZgWPp2:vjURgYIH8/Mpzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776550892, "uuid": "9b4e41b6-43c3-49c0-8133-b67bd34195bb", "value": 821928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776550892, "uuid": "23ca0fef-189d-4c2f-bfbb-62a8db46fa49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550892, "uuid": "28f98e75-1cd6-4892-b251-e5c0ba97012a", "value": "TrouserStreak-1.6.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c9905d-3b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537823, "uuid": "f9143c44-f582-484b-9209-0f9ef93ef0c2", "comment": "Malware payload", "value": "491afacaab20467f77777d6d57a5101c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537823, "uuid": "1d7683cf-5ee2-4324-a085-63a40032316d", "comment": "Malware payload", "value": "809c5b85a85bafc6adaa6bd0774cc46463df8166d732f2ae67c0d90a0f5f4089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537823, "uuid": "d05a2efa-51d1-457e-a8b6-768cdf24f2e1", "comment": "Malware payload", "value": "3bb1f774710ee30f45eeb5305cd6c1070dd29baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537823, "uuid": "64e3563d-f58c-42e8-a442-9b4733f0ff3d", "comment": "Malware payload", "value": "2e2f69dcbd34e0d94bc0bd55afb9341e6d6b958c686f73d91935d816e07fb9e77c7c61f23529993405635eda12894f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537823, "uuid": "21c90e5a-52d2-41da-9674-8ecdadca6043", "value": "T19F85AE6940B69C10D851CC7296807C426D9EB940CE1BA6661EB47F235F383EC9D2E9FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537823, "uuid": "09de04f7-e17c-4254-85a4-ede541c8c917", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537823, "uuid": "1e524170-862e-428d-bb71-20eee0362f6c", "value": "24576:iKNQqlJW6/ohn65KLuIyte1Jbji/k/MTnFP5s7Kyckkf/jTcXTdqWU4WdM9vf/uI:kVOVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537823, "uuid": "fe7def07-65be-45b0-a035-865bea15cc5a", "value": 1856596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537823, "uuid": "321e45a8-3a92-45c5-ad43-95f8305ba830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537823, "uuid": "b8c357b7-2c88-4b8a-bd22-67f6b3d9c94c", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b039b34c-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476904, "uuid": "7172e68a-4819-488c-98d6-f94f4ef69c7d", "comment": "Malware payload (WeedHack)", "value": "e6550bb3621d87a49ca8f59cae73810d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476904, "uuid": "68f7d4a0-d6fb-49c1-a8cf-c5250ab41ba2", "comment": "Malware payload (WeedHack)", "value": "81084948380ca41cbf4b81ab8be3581483a854225470494eb3a1b2a7b80a3b46", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476904, "uuid": "8791420b-60a3-483a-bb11-3199ee3162e5", "comment": "Malware payload (WeedHack)", "value": "0be48e35b119b7793927106a2402df0e34dd29fb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476904, "uuid": "7005fe9a-8ed3-45f8-a8fc-923e340518a4", "comment": "Malware payload (WeedHack)", "value": "b1cdb972391559d6fa7e34df4513ee965c6b764b1085c4ba900c0d62f4dcad2a667b8f3d4504e5266d150dff6b6dbe74", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476904, "uuid": "2211848a-5f7a-4b98-ba3e-5c1326cc1f93", "value": "T1DF4302317653EBE6FC16C1347866ED39621CA678834BE5A801962D5F3C28E318B74BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476904, "uuid": "7531dec0-9ced-4204-8289-5fc94ec4ca3b", "value": "1536:E1rkp+HFb3IpUykqVE1jzgtC/30uJxZCQ9:8rkpeyuzgMMuFCQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476904, "uuid": "f6c35463-d2a3-47e0-b03c-a78472876dc6", "value": 56374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476904, "uuid": "7399e47f-3ff4-4b94-bcd4-164cf0a34bcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476904, "uuid": "c47a7e54-41f0-4854-87ea-fcff11d21173", "value": "AutoSell_Mod-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876ce7b6-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776472971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472971, "uuid": "16f8a8c1-fee3-4970-8c75-a42379efef92", "comment": "Malware payload (WeedHack)", "value": "f59eaf990bef36f63f333d4f1f519ecc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472971, "uuid": "e758c1b6-5fcb-41bc-9e65-4297fa326226", "comment": "Malware payload (WeedHack)", "value": "814270f82b1b65819fa308fd9721a92ef5ebe82f44efe55fb27f88bfdbb4f3b4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472971, "uuid": "081eb56f-8ba9-4652-957e-5cdbb6e0dbe7", "comment": "Malware payload (WeedHack)", "value": "d6af23f8b30adf1f9801cf83f1a1c62e314cb470", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472971, "uuid": "10695dc6-72da-44eb-be3d-8dc38d3de737", "comment": "Malware payload (WeedHack)", "value": "d90fca053bf67fab838e6c519a076181e542fe66b7c1165a5c1c2a9f2e8002b8681be3c46ece5f7053ec1efd86f76888", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472971, "uuid": "dbad3827-46a4-42b1-b854-415b7a12284e", "value": "T1459533868129E76EF429C761CE4E5F28BA1D7C86C3D771158CDB83312844AD5C6AEB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472971, "uuid": "973dadd1-5d00-49f9-9965-25e4c6394e68", "value": "49152:XAcCysEnA3uX4fSTt0lGQhnAuGWJgSSQbR7sLmtXeA:XA1EUufp0bhnAhWu/QR7sLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776472971, "uuid": "be5a4e5a-b649-4b72-ba00-ffa5e7486bc1", "value": 2043630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776472971, "uuid": "d48e0627-ffa0-42f2-a3b3-eac9d5a284a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472971, "uuid": "3096ae12-0c4c-41b2-8102-7ec617e9401e", "value": "4E-8.0.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df5c1a9-3b5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776541298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541298, "uuid": "f122b733-1235-46d2-8a20-8ceab010a9e9", "comment": "Malware payload", "value": "5b37a2429b219288715d15492405ef7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541298, "uuid": "3e9c4651-613e-4b09-9dde-f7502e237bc1", "comment": "Malware payload", "value": "814cc3153d207190015c21f2e0f4fbd8679bfa33aac3ce2d0acb800ebfe41624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541298, "uuid": "60485403-ea96-43ee-9f40-f503dbb5b63c", "comment": "Malware payload", "value": "d9e1bddf9a59c3d3937591a842ee8b43e1a74d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541298, "uuid": "22c38bfa-8295-4a86-95d9-5bee967b2c56", "comment": "Malware payload", "value": "45475ca6b8f8d4956940220e8adf0ebee50c118e4b3a5a88979b6a0aed382a34b49987f8ee07e320efb622b4fc1b8519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541298, "uuid": "fe0813c0-bdf0-471f-8d64-38cb181f5df7", "value": "T126A59D13F79AC2D8C92D95BC8A129B03E33574022F148BCF57A91D569E27EE05EBE710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541298, "uuid": "787db847-f49d-4f9d-aa76-7af521521c94", "value": "8ccbdacc05479696520fd196671c8b20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541298, "uuid": "a50e30b3-bd7e-49cd-90d9-e12ed7b56e7b", "value": "24576:bPnIhej0LaJPYxL9CpH8WctUssvy5zZjh0lhSMXlrud+RL1mL11HC:khe4v2pvcar/ad+R5mL3HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776541298, "uuid": "395f08e7-84de-435a-a56f-70fb4a5c049f", "value": 2083328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776541298, "uuid": "f4feb311-46f9-4bed-a97e-a90d12ff44ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541298, "uuid": "7815063a-ad60-4d7d-a113-de8d4d87f6ee", "value": "KABBALA CS2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045952a9-3b6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776546195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546195, "uuid": "9a5a8a5e-c52b-4e47-85f7-86f8ae4f8ad6", "comment": "Malware payload", "value": "d0991245abf5eac19272dbca9cd01671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Observer", "colour": "#25EA39", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546195, "uuid": "f7de644c-0f2d-4d55-92cc-5aae516444a2", "comment": "Malware payload", "value": "8192072e1306859098afc7e737058dff493cc805294c710af82f957d6b2cf808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Observer", "colour": "#25EA39", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546195, "uuid": "43b7385d-cec3-4425-9056-775a181b0127", "comment": "Malware payload", "value": "211b665e77968cb5b4c741e4444c08a193a199e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Observer", "colour": "#25EA39", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546195, "uuid": "22254f62-facc-4f84-afd6-a6c4e3238b1d", "comment": "Malware payload", "value": "47b98e84802efa8b506338e0ad1a098a5fb558d4a226fcba47a59f1588e348fb67a18e254519b5ff91d2ac8ee671a034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Observer", "colour": "#25EA39", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546195, "uuid": "f3729b59-8322-423f-8b3d-a449f7608118", "value": "T129D58D03BDA508A9C86E9375ACB702923B35FC580B3623D31A57B9356FF3AD05939748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546195, "uuid": "4cf832b9-741b-4b18-9666-0ac3f5d54cb8", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546195, "uuid": "2a6c5d05-c27e-4249-86e2-41969263b6e2", "value": "24576:Ax1HEGNgc/TiojJRpHsh3n2lq1dKudx9FZwOEfdSVc96ktPN3PlUzz:AxGYgc/TiojJQh3j6fAS6hzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776546195, "uuid": "7297296d-da8e-4f27-b659-68ec74b15e10", "value": 2751577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776546195, "uuid": "48e52326-e7dc-4153-a69a-e779aa603dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546195, "uuid": "1d98f837-86ff-46c1-8f45-f73d1a66fce5", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f156e7-3b07-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503840, "uuid": "a3e3dbeb-3ff6-4872-abaf-37b62863ac42", "comment": "Malware payload (NetSupport)", "value": "38bc2d42f8716b9eaca083cd4663cdf8", "object_relation": "md5", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503840, "uuid": "e3e0c599-1d7b-428b-b826-195ea1af2783", "comment": "Malware payload (NetSupport)", "value": "81eb90570c1b19ee4faeed1b1591a3555a625e561d9a9b15e268789b15fb9cd1", "object_relation": "sha256", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503840, "uuid": "501b10a5-aec6-4a46-9a7b-6e795040e650", "comment": "Malware payload (NetSupport)", "value": "6c942467622dee709b25f61f87c5dbf34e6d4217", "object_relation": "sha1", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503840, "uuid": "d30663c7-b45a-4cc8-b7e8-f917748d2972", "comment": "Malware payload (NetSupport)", "value": "ba49004214078ac06ea40f17b6295e97c2f594eac99412288949dd0397bfb99fabcec2a356cd4f933b1def987d2b3e52", "object_relation": "sha3-384", "Tag": [ { "name": "klyvareno-com", "colour": "#A1D751", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noviqerax-com", "colour": "#7379A9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503840, "uuid": "b26bf239-74ed-41eb-b987-11830a12eb2d", "value": "T158A67C758B84975EAE6E194BE078571F77F33F26E09271FC56622303256FC08663AC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503840, "uuid": "fd927fa4-9345-4de0-b4ba-03b9b47c5229", "value": "49152:TV9JJk7kJIvGaA1UzZtv1NlOMBgr4TIzIizIS9zku2nGsrmhI5NGCBFfIMkYUPcE:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503840, "uuid": "c644db07-d6e0-4b4e-825d-c8d7ecc58d50", "value": 9601549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503840, "uuid": "c4505d8d-d88d-4952-81ba-6ba0baa89739", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503840, "uuid": "0e868fb2-adc2-440f-8a83-73798bacc622", "value": "81eb90570c1b19ee4faeed1b1591a3555a625e561d9a9b15e268789b15fb9cd1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb290510-3b53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776536703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536703, "uuid": "5384628e-1acf-47a2-a00e-4806ed4828b7", "comment": "Malware payload", "value": "6d95075c957756e312d9eb2558b855fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536703, "uuid": "07e9f838-e98f-4db3-9ed3-54862fcfe202", "comment": "Malware payload", "value": "823b3fd5e87b9a06a21e46c1930f665765bcf782216167462b65f4d4256baf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536703, "uuid": "e2321914-0c61-4f26-8579-3cfddeb97bb4", "comment": "Malware payload", "value": "60bcb7338402f419521537ccfe9f9102360fd652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536703, "uuid": "937e6271-8c6d-48bd-a196-f9cd34a1832b", "comment": "Malware payload", "value": "4d4a2ca9d47a987049868a9d7c58ab8fc8b005327dd401b423c1b1ea598dbc2fb9fa786d7bb345ec1e3bb565278e3c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536703, "uuid": "c9c75438-35bf-420f-b745-cc26e7db8268", "value": "T1E4F75A4267EA04C5F9F7AA3489E65213D673BC067F3081CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536703, "uuid": "dc4f6f73-6b4a-41ae-a01e-3d3422baf97a", "value": "80f8f2a7e281a29bd53deee9517aaeb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536703, "uuid": "9319366c-09fe-4bd5-bd5d-a2aa7ded3e76", "value": "393216:/gisFuo+Yr87To2svO4HTOW4iWaSEK133axerL0Qu58EISEhoIaE2FShQ1Pz7mZ0:/gDU2pHQxhETnDNMo4GvxOOx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536703, "uuid": "c1dbf211-09e5-450c-9807-ce33b40c0e3d", "value": 71097344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536703, "uuid": "dfbe2f05-d7e8-4c17-a878-c35705a17146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536703, "uuid": "38e22e03-45bb-4dd4-bba9-e60c745878b7", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac9846-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545655, "uuid": "89620e28-2245-48d5-9ce2-361075e9aaa0", "comment": "Malware payload", "value": "a78efccfa19643712f88dee065c7679f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545655, "uuid": "42e8d165-e216-4817-b757-d42aef3cce61", "comment": "Malware payload", "value": "8298e462ef6b0227ce58d0dfcc807a4433b0f0eb146ddf56b955ba3e798d9485", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545655, "uuid": "fca04a09-e9f1-418c-88d6-2d2d5a73b27f", "comment": "Malware payload", "value": "c6e18f7fab12ef6a7cf2898e3154a141c5adbd06", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545655, "uuid": "ec722b3d-392a-4c6c-8339-807281855fb8", "comment": "Malware payload", "value": "6c1c6eb0c8e752447ff041cf1facbdde71a525ed0d35dbaf28b11b7f533cee3e6220f272281b48aad4449a399ff5371a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545655, "uuid": "858295c3-171f-43a3-b057-06182744d0a9", "value": "T1DCE2D060ED9B1435F52B83B8C1576C1D343F708C606B1E3F3DC6266906562F5AA0EE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545655, "uuid": "14aab381-3c4f-41e5-8fb0-3ae6a8fb720a", "value": "768:fZtxb2/coiPhyqY5Wci0HNW6CdWJsxgWus0bHtBw:fZtF20oiP0qYswJCdWJsKWuJTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545655, "uuid": "76b24de0-9e9b-4bb0-8f9c-b0d44a08810f", "value": 31547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545655, "uuid": "41a8f448-2591-4370-a0fb-4e2ed2e9b1be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545655, "uuid": "26562cf2-e385-4b8d-afa0-c0d659955449", "value": "ThirdPersonNametags-1.0.0mc1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a903c0-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492919, "uuid": "52346027-369b-4553-a4e1-518005f97368", "comment": "Malware payload (Mirai)", "value": "7746c71008778ad06c2b88d42393c370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492919, "uuid": "36bc603c-cecc-43bd-b776-fc651e95c745", "comment": "Malware payload (Mirai)", "value": "82b1fe5b666fe6065a799efec04440be43db390c774bc3d3530a7c005a6d8399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492919, "uuid": "7caceb45-79ea-4ee5-a775-0c0ca8bcf35d", "comment": "Malware payload (Mirai)", "value": "0ea7f2e3528b0ab6c50eb178df61d7ce12adfec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492919, "uuid": "0c1930bb-c8bc-4865-80ac-9e57bcf87611", "comment": "Malware payload (Mirai)", "value": "768a1b040707426c320e06533b6fbb733f4b9ba1b22b6a71ab8dbc556be41248c9ebc936e11a1229d93b426bcff5ebe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492919, "uuid": "526121ec-8d34-422b-bdf7-3065967fa383", "value": "T1A903F166B9300D59DA6CD07C0FA80B215EA84FA194524C6679D3E753DFE30B2348ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492919, "uuid": "6e95bf0c-85fe-447e-aaf9-38bc6c6cf35f", "value": "768:hyI187beFSc+RX4qCw7kwGDGRfHBRRZfOJgGlzDpbuR1J6:hyf7beMbIqCw7jcGXR7f6VJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492919, "uuid": "444d553b-8059-44c8-b740-8e808a11d583", "value": 38124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492919, "uuid": "30ea758a-4e95-4079-b5d3-d1ebeb0efadf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492919, "uuid": "ba5acd00-1745-4622-af39-e760b3300118", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6e10c2-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476950, "uuid": "7eb2a296-28ef-4b78-a01c-c8d14ae4e87f", "comment": "Malware payload (WeedHack)", "value": "00078cbd32f9ec97965030464627435e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476950, "uuid": "b7d16015-0cba-4569-b16e-2adc48e0e8d4", "comment": "Malware payload (WeedHack)", "value": "830399fd851e0194f07a664b054b0d5d89fc31ea536a14081694ca093301f7d0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476950, "uuid": "f1d5ca64-3653-49d0-ace2-904d53cb0638", "comment": "Malware payload (WeedHack)", "value": "1d07910dc40e66b87408f3579d8463e07ae8f0ff", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476950, "uuid": "8cbed2ca-a6c3-4e3c-a74c-1a1799ab00fe", "comment": "Malware payload (WeedHack)", "value": "5b14549bddbda4d2cc446dbc7ca9bf13242a1445f486cd33f4c5cb9632251f2745d407654d700c3db8c988b50fd81338", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476950, "uuid": "d60228d1-dede-4dd1-a48a-f6f19042eda6", "value": "T193C533425A9C1940DEF18EB2CCD3943FF6810DD5EAE87F71129CA17AE67CA783244E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476950, "uuid": "7976e1f2-338b-4acd-a422-f2cb8cb15b5d", "value": "49152:HcwEpOGMd0rVSZbbaMlgmSwNjyXSM7Y6D6NDz7cbqkBxzes7MiaA:8wEpOP2rVabEm+Xcu6x0bNHR7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476950, "uuid": "454239da-648b-44fa-b0e6-10999a4f50dd", "value": 2734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476950, "uuid": "4e2e730f-3e98-4629-a73e-3f45dde882c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476950, "uuid": "bbf139b3-084f-498d-83cd-c7ac44027fb7", "value": "doomsdayclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0717b3fb-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492942, "uuid": "7b044ccd-d576-4b12-be6e-fa712f2b5d6c", "comment": "Malware payload (Mirai)", "value": "9b25d35c6d86fd1fe366211cfdf434aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492942, "uuid": "f3d863fe-9334-42a8-b2f5-56926990edf6", "comment": "Malware payload (Mirai)", "value": "835a789b26d795802a79a54e9dff270a7964d8effdc045f6cd739d7982db8671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492942, "uuid": "ff576331-26d7-43de-97ee-5871d9f928a0", "comment": "Malware payload (Mirai)", "value": "a9d9d5bf8856859fe84dbc096d5c2a1ba8b30c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492942, "uuid": "1dc2f053-b859-4a71-87c0-33c9fd79e1d8", "comment": "Malware payload (Mirai)", "value": "fc741aa63f0a83c69d011ac80de0889b38e1f905cd00de5fdd328ceb846609ae3fee63c7adab5c67cff3aa8c4502fe7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492942, "uuid": "9c5cc731-53b1-42dc-aebe-e4ff27c2a566", "value": "T10183188BF801DD7EF80FD6B74463490EB930E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492942, "uuid": "7c4bbde6-fb44-45cb-82d0-16c2cc9aacb4", "value": "1536:XQOjxmw2V2xAYV8aSlslcjYAht8f489k0rTUhrIpu1HT7ot4O9I/nPaPD:XQO4QEpdht8fsnrCupQ9I/PaPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492942, "uuid": "6cf5eae9-d169-422b-a35b-b5ed2738f2e7", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492942, "uuid": "89d3fa4d-3794-474b-acfc-0872d24cee06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492942, "uuid": "85413eb2-67a7-48cd-bb6b-872fd3b8c523", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd69abb-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776485729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485729, "uuid": "3d439527-363c-4ced-890c-c61f43070aac", "comment": "Malware payload (Gafgyt)", "value": "ec9aef51def59c3ec9b1b12963921051", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485729, "uuid": "ed6a0a02-907a-4cab-84e6-5a5e110ecd93", "comment": "Malware payload (Gafgyt)", "value": "83738b72e30428025b3d3380f49ab28cdaab11f86e94a182dd6461ab8eac9bc5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485729, "uuid": "30bef526-1c63-4603-b021-5a4898d98e24", "comment": "Malware payload (Gafgyt)", "value": "7aefbbb4e93829fd4329e5f67fdb038a22c65435", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485729, "uuid": "25079790-2a74-4233-ba09-8dad373e5837", "comment": "Malware payload (Gafgyt)", "value": "8505cebc6944f073689149b8e5d4c74e20c2827f0328caa64fccdd8586de294cf04d45c4ae5e9b90dd30992939bb80d6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485729, "uuid": "2011c78f-66a3-4cef-80f4-4a6e99e1ea39", "value": "T1CEC32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485729, "uuid": "8d75d71a-89fd-405f-b82e-7301dbc348cb", "value": "3072:/YNa/GLBNPoQnphakpiQ9/nYEP/UnSQf/R:6a/ylo4phakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485729, "uuid": "5e1a09f2-ba3d-4090-a022-4043770b4a6e", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485729, "uuid": "8929b2e6-7718-4d67-aa7b-7b9f65f9577c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485729, "uuid": "ffb71b78-4748-426f-9f5e-42d3829d9dfd", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a095eb7a-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776499212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499212, "uuid": "826e9acd-45a0-4e3a-a9ac-bbda332735c5", "comment": "Malware payload (Mirai)", "value": "aed2417a1bc8751fd73ba7dd61bbe5b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499212, "uuid": "423be076-ce9f-4446-a752-20d637460f1c", "comment": "Malware payload (Mirai)", "value": "8430a935c5bf859276e1a67d31500d4d3fee6c7d063fcf682c5bcf69cfc09e52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499212, "uuid": "08d1ff8a-7483-451d-8042-92e44fbe9fee", "comment": "Malware payload (Mirai)", "value": "ea3f8836799e485e60dc014b0ce2c39058a81582", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499212, "uuid": "dc536cc6-379d-4aaf-82e2-afd0c8248339", "comment": "Malware payload (Mirai)", "value": "a3b022fe69132ec94bb90ab0deeaa349d5cbf4cfc739e8e6555050b2011e90dcc6b093e83ae43732a92437ca101b56b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499212, "uuid": "16c1ffc8-181f-4ca0-8f1e-b2c8121885fc", "value": "T1A4F2F1911361175CD726EBB93DAE7019C43C211733A90E402AD3668BEE4FB2458B6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499212, "uuid": "91b74093-fb41-4441-a778-d1d4a86cd4ea", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQz:87vbq1lGAXSEYQjbChaAU2yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499212, "uuid": "75acc9b7-9d43-4c2c-b346-39ab9319de4a", "value": 35748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499212, "uuid": "76210895-d63b-49ca-bdfe-7d7999d7099b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499212, "uuid": "912bc581-15f7-47a0-8c16-1d9cebfe9f01", "value": "mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b797af-3b5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776539937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539937, "uuid": "1fe02c03-84c4-46ec-9a90-da6dd723007f", "comment": "Malware payload", "value": "167772cc20833371a67a6483c18c785f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539937, "uuid": "9db691b1-a5f6-4fe7-b740-0ae42d2a57a4", "comment": "Malware payload", "value": "847211e7d6bde712576fb7b3fff261cfbb770e047f52e243779da3419023dc64", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539937, "uuid": "691e59a9-17e8-4580-81bd-bde0ccbe8d9a", "comment": "Malware payload", "value": "e67367a04d5962e1cc00a3920eb6b1ae35fe9f85", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539937, "uuid": "03194892-50db-4365-b629-9e54f64e0f95", "comment": "Malware payload", "value": "0af4221166e293a202a9b570ab441cd50fe57124d077b97b9f069c57463cbe4615dccc4a6ebb32928dfe7813c62b99a0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539937, "uuid": "f40d179f-371e-48b8-a6fa-14298d65b7eb", "value": "T169C2E1BB24168827E8026DFD9D871CFB585DC1407BC73D6F8CE4849AF6392B89E40657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539937, "uuid": "35ccbe3f-98e4-4cb5-babd-3718f579d5a5", "value": "768:U9nno/lri9R1YSeXDKH+GFskFWq8QyYXmqe+:modrK1Y7XDKH+kHFWqBySe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776539937, "uuid": "546b24b6-fbeb-4fdc-ba42-4ba78dae4270", "value": 25729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776539937, "uuid": "72cd25f7-5912-48c3-8c25-4478c9bd64ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539937, "uuid": "ec21fb47-a3ee-4024-a22c-1554eb6abebe", "value": "DONUTSMP 1.2.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9714b8-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492949, "uuid": "89c53671-4cce-40fd-9527-41b5ca06f8e8", "comment": "Malware payload (Mirai)", "value": "c79924bd89d179fbd1721a989e8755a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492949, "uuid": "437842f2-2a79-4711-984a-bfead747bb59", "comment": "Malware payload (Mirai)", "value": "84d80b883266e06577864f208511cffc91aba28898bb5dae8d946e4d87163a09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492949, "uuid": "18a6e9c6-2d8f-4a1a-831b-52a49594e465", "comment": "Malware payload (Mirai)", "value": "ed705c01cb10aab62b16bee288f4eb7701aac04d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492949, "uuid": "a4d26580-fe7f-4b54-9b42-f50643569534", "comment": "Malware payload (Mirai)", "value": "24aa6fa959b24e07938a4fbab673099397fd3261400dc10216cb54e640e1d8fdbfd13bb1ba4d1a2b5586209c2729bd70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492949, "uuid": "d6673f5d-0536-4681-9f9e-4b033466248d", "value": "T1F4132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577136C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492949, "uuid": "d970becc-fcf9-45d0-8c66-d565c24cd361", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCwIoOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492949, "uuid": "20bc0601-1f32-460f-bf16-4b75407bdc8a", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492949, "uuid": "8fc9fb64-c1e4-46a9-bfd7-2e5af1309a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492949, "uuid": "63501aca-b95e-4460-b407-c4032e987265", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3746707-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492909, "uuid": "0a94c4db-2192-4209-a6a3-2f21d3089d8e", "comment": "Malware payload (Mirai)", "value": "3e5ac61a12c48edbe5201909cdf45ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492909, "uuid": "5c9021d4-6a40-422a-8338-6feaee7cc59c", "comment": "Malware payload (Mirai)", "value": "8573dd1da2c11b7cdaedd9865cbbf863d45b8492f305afe489752fd3e67b91e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492909, "uuid": "122c3d63-d8ac-4cde-9846-42dbd7f2fdfb", "comment": "Malware payload (Mirai)", "value": "9dde54fc6469a50e6c046fd052ef9f750307c08b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492909, "uuid": "106d5afb-ebbb-47dd-ba94-c3463a2a0e08", "comment": "Malware payload (Mirai)", "value": "95bd8dfd5acea61a652f72ac4ebcd60869a309772ef9147adc47555912faf9a755b6ec19fb8b3aad9fccdeb422c7f46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492909, "uuid": "d0346607-5ee4-4908-b0b1-0c876928b43f", "value": "T1AEF2F1AB4AEBF37DF8815B764C19BAD8A9A7A5C76C480B9F4054335D04B37682901FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492909, "uuid": "7f67c826-6065-4d03-83e5-29772826ba7b", "value": "768:nkjvsa/voIruB2NUJfVB5F7n/gcGgg8cFY6BiziJ3ew1hf5eHgaBXcDP8Ux0nZ1:uzHzxUrBPnJ7lAukCpBXcpMZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492909, "uuid": "e50b9476-a3fc-47f2-a078-efa3ffea83b7", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492909, "uuid": "2dc48909-e14f-4289-bfbf-d9b2e11d0b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492909, "uuid": "b1282924-595e-40bd-9a78-f8f2bf73ffaa", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f0295d-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527065, "uuid": "85c200b1-0bda-4615-aa7a-439df3b868c9", "comment": "Malware payload", "value": "4a41ab4bf2a2302dfed197bae1d6d979", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527065, "uuid": "2ff5decc-30fd-4791-914f-ba8356ef884a", "comment": "Malware payload", "value": "85f322544e783971c8a3b4b942b1c29ac7f97ea404495676ea6052635ca14689", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527065, "uuid": "1a2471ae-4971-406a-ad20-39c665331ed6", "comment": "Malware payload", "value": "0984d49ec06c2ce1d19b1564713aea44323bd2b2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527065, "uuid": "c2d0078d-ab17-4307-8627-18bb024f3ce3", "comment": "Malware payload", "value": "299883fe95ebe480b10640ea1a7d9b84e304cde32fef92f58e7eac418680d117abe4ffe37de76980a57eb675ca063c64", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527065, "uuid": "98c8da24-202d-4565-9a21-754ea5ab6faa", "value": "T18653E1A3B21AC921C55767FD4E8189F2357F39E0D60B71AB7AA34D9F40221CA57C7620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527065, "uuid": "da657b97-96f8-45cc-9f19-258319507a8f", "value": "1536:bRHu7A2zL5AV7kMtUjqMn8FmOz723M8fZYrM5TCIEBRCKZIPm:bV4A2zL5gkMPT/GFur9N/Zam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527065, "uuid": "6d6ea7e2-e009-40e9-9658-eee36d9403c1", "value": 65597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527065, "uuid": "232b91b8-c955-4b2b-b768-04d6c6eec565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527065, "uuid": "b405d041-abed-4ff8-9e52-b3621072bbe8", "value": "SmartTweakesV1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6257372-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537071, "uuid": "ed8558b2-5a6e-4f49-b539-1d71109fb02d", "comment": "Malware payload", "value": "834f233b53e33d225c4ec010126dfd6a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537071, "uuid": "85185621-e9a1-42e5-86c4-fd9ef5e7fb20", "comment": "Malware payload", "value": "8601383191d3ba4494555fe6ebee06db23cbc3ae11ac4e8cad0ae267d6e78d1b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537071, "uuid": "654a0196-deea-4601-b465-4ed71f4103d0", "comment": "Malware payload", "value": "040c45e08076df70aef35aaa663d275dc34a7074", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537071, "uuid": "fb90162d-a440-4d16-89c8-a56c7d5dd228", "comment": "Malware payload", "value": "fa8bee6ccd1fb6cb40a82759b6fc3448797ae8c3c940100126a7b1cdbb39584d88c8d0b2bb1e696072457d3cefa03215", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537071, "uuid": "d3568c8b-3277-41fd-81da-3c7040827fde", "value": "T172B31272DE10ABB0D8A30F74B6C657716F6FD281910EF47E4D0137AD07EB59AA280782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537071, "uuid": "ebed0ee7-9e70-4e75-a904-7c3268f448a3", "value": "3072:zoKIWPG9YGZezsA0lJm09zTF3BrBxqIwtM:zo3WPGZUgA0lJm0FdBFxqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537071, "uuid": "a9640e1c-4126-4b46-b518-d73cc99088b7", "value": 107722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537071, "uuid": "09f3a10e-8dd7-424a-ab35-0215afce41f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537071, "uuid": "c7e345ca-3bf3-4082-a3d6-93d1716dcf7b", "value": "Grimclient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc0b065-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488010, "uuid": "23379364-2c27-4311-867b-783f77cf00a0", "comment": "Malware payload (Mirai)", "value": "440e7f95dda2d0a163b4de3c360e2807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488010, "uuid": "629c4e2d-af81-424a-a1ba-0ca5356d9bdd", "comment": "Malware payload (Mirai)", "value": "860eab8489d0139539933d10fa8aaded473de4fcf8a61fda1fb6713913763f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488010, "uuid": "f85e12e1-40d8-4e22-83c4-2324149a5c78", "comment": "Malware payload (Mirai)", "value": "5008801ad71cadf72261a618e803082f325e6a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488010, "uuid": "f82fdbbf-0f65-4af5-b0ac-a65076226e75", "comment": "Malware payload (Mirai)", "value": "17b8d098d52e6451b88d84a32e1b1156a4d875ab36c5ff39df547509adae2a948bbe5505e98e073682743205138d2b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488010, "uuid": "df742521-b297-4762-bb2e-a59401fac625", "value": "T183243BA3FD01DE7FF80FE3B284530C19B230FB6129521A3661A3BE9799350D56963E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488010, "uuid": "061d5e69-32e7-4b02-9ead-9a6965a64d33", "value": "3072:IobiGL5gdy6HiBh18Cu4KOg1K0gyyX8G8kRGexrjvOF2VOVIjbi8LIoeJHq2:rWHi318vDNzyXV8kweJY2VXLI62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488010, "uuid": "f761eba4-cfe2-4f7c-bf80-ade2c9e4bc93", "value": 219892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488010, "uuid": "9cd8367c-874e-479e-998c-aa615342dd4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488010, "uuid": "9860276e-7f86-44a1-99d5-41263cb89ebe", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3928dc9a-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776485724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485724, "uuid": "5266ca62-794d-4429-a0b2-9312a130da96", "comment": "Malware payload (Mirai)", "value": "927495ee2ea9bd0d50b7dcf3c0e6cf25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485724, "uuid": "169b8bbf-b354-4c28-adf6-f0539ce6d2ee", "comment": "Malware payload (Mirai)", "value": "86abf18b8053bef1a738c29eec8ae6fed8c4df17da87b1bc1fa317bf0240b9ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485724, "uuid": "b18830b6-82a6-4992-bd99-9e20ed8e6834", "comment": "Malware payload (Mirai)", "value": "b40bb303033a78c6701bd58cf241c4c2345d1b50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485724, "uuid": "7da1096a-86a5-4556-930b-1bd2972d2be9", "comment": "Malware payload (Mirai)", "value": "f327506b305c0eaed310577dabe8b93ff3e60f36ad086adce711103f7d36ad82f9a34bb11540f805a5bf0b84e465e4be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485724, "uuid": "e1c3b291-7b87-4d7b-87b4-e502112cf3cd", "value": "T16111F4DD3CB42A39110FB9C5706E0A007A47CFC5A83BCB84A69804A754C7D10FA69FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485724, "uuid": "6fbe3ae9-4834-4d1a-861c-882478d03003", "value": "12:mqYI+1q3Zab+1qRNNIVkvsBA+1qoaqK0H+1qe5E+1qcy1Fq+1qHNAWmq+1qTmH+N:0NNIG05K9T+FCNfm7GdTxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485724, "uuid": "af8cdca7-b267-431b-80da-0dc61c6a93d9", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485724, "uuid": "3d1e54cd-094d-47d9-9638-109008012cbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485724, "uuid": "b1acdf58-386d-416f-981e-6ccad7dddaed", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1dd1f5-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537212, "uuid": "0e93458b-0a8d-4f20-8a3f-e5dc356404ab", "comment": "Malware payload", "value": "0b307c13765861a8a38ab52744a743e5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537212, "uuid": "e077001b-bd69-491a-b80e-28dd9ffa17b1", "comment": "Malware payload", "value": "874c9c65bb907c883e6cabe90268e47daebf87b7e3a263a4ec5e84f0847e9b03", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537212, "uuid": "c3ba98af-fec6-40ca-87c7-fadb7f5a1a91", "comment": "Malware payload", "value": "ffaade8a389fc30663e4f41fdcd279d3f418e998", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537212, "uuid": "dae2f139-d22b-4cb5-a9a1-2ce6fae62fad", "comment": "Malware payload", "value": "cbdaf106778416afb4a966b2f7eb62103c05bcd2b30c01d8a459e65171beaf3f86ba686686fe7b609689faee90e0a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537212, "uuid": "e3e07bd9-5139-4d8a-8e79-a71eb2ff4c82", "value": "T1590533647810B0084DE9F2F9A2F8613EA43C5F10A54E74C731FF572B9A182B691D9DFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537212, "uuid": "f536ea68-ab3f-478c-8c47-ac8658d38a19", "value": "24576:W57OC2KjakdDDWWRRppgsHZbVImkHEIigzm:W5OCRNYcjZhIFTzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537212, "uuid": "3c4a4a14-2cbb-4016-bbe9-31b325204321", "value": 865611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537212, "uuid": "ef4f80ef-fbce-47a7-87db-b1fbbe7d1c0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537212, "uuid": "c569429c-1e2b-4582-ad49-2e758da993af", "value": "Xenon_client-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbc5b13-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494184, "uuid": "171e08c1-0ea1-4f2a-864a-99a84131ec0d", "comment": "Malware payload (Mirai)", "value": "7e0128b683969eb4425ddcdffcdf8820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494184, "uuid": "8105f9ea-a4ea-4fd6-a341-04480ab37771", "comment": "Malware payload (Mirai)", "value": "87b4da6325c09742e72874166442dca4c4b4d84c7bde546259a2f7ebecb0b521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494184, "uuid": "c18c4d85-9d60-4917-9c6c-8b731f33dcbc", "comment": "Malware payload (Mirai)", "value": "9f259c91b7c30f5a49e0c7853a9ebdb6b4f98a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494184, "uuid": "7eafe052-8e23-45fd-964a-239876265d9c", "comment": "Malware payload (Mirai)", "value": "68fbe76eb12a0f0aa5385e9c47f4ff61b6c773b6774eed959b31082665d1e2843dc057d6ae198ebf01b97660d6104d10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494184, "uuid": "d6bb5f4d-0072-48a5-a114-95649ca0a201", "value": "T1D2D2D0BC6B1149D6CA6FE0B44EE507222E60CFB2F1436C077665D5C3BB0A8583CAADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494184, "uuid": "70e17958-b0ee-4e3d-9efd-df28b4b886b7", "value": "768:U4ylAtv6pqLJM0RXaxGyUbXtheU/S4uhJgGlzDpbuR1Jg:HMBqTRXa+Zhr/8VJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494184, "uuid": "7eb6c7db-4328-4752-81b7-d198badb36bf", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494184, "uuid": "7c90299d-c971-4085-91ab-5d2451eb180d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494184, "uuid": "e29767ff-9da4-4b32-a2a7-bac14fe45368", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72933f09-3b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776553251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553251, "uuid": "71ceb933-7a89-403a-978e-ce2cab96d58d", "comment": "Malware payload (Mirai)", "value": "83b09597bbcb6ed5a0e1c316da7fc8c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553251, "uuid": "1f6fef92-1267-48f8-8fa8-3480b321096b", "comment": "Malware payload (Mirai)", "value": "881892e147e4ef678cf772dff7e1e7af1842d4cb21edcb2d44a6e91ae0ef9769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553251, "uuid": "ed1a82f1-9613-448e-b51b-940a52b6520e", "comment": "Malware payload (Mirai)", "value": "32cb686d14038bcffe0c25220a5a2455889a3b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553251, "uuid": "b45612f7-cfca-4291-8d64-b85ae743358e", "comment": "Malware payload (Mirai)", "value": "d2d4465ffaa979f02c1ab3ecca244240f52d4cd98c5cf0a1da397898faa4fdc1352d779d89741f475cdbf9d4ca7caab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553251, "uuid": "6151a870-a597-4776-87bf-021b581690ee", "value": "T199334B81F9919B02CAC25177FB1E43C9771B139CE2EA7303D929AF21778B46A0E3E545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553251, "uuid": "62dfacac-0741-4afc-9e1e-d78333d7d8e3", "value": "768:rAzGr5ceqHgulAhgYdwWdVbOmgUh6Vw9sv8xMwDSL9VusvXSxo2Iq:szEiA0AlVbOmlCRhw+L9Isvr21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776553251, "uuid": "a0d2b38d-9b7b-4f10-bd77-0de8b820c27f", "value": 54688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776553251, "uuid": "1843dbc8-f392-4746-a775-bd38cca31d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553251, "uuid": "424025f0-4151-4f7b-a52d-d0c6c328682c", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3da57bb-3ac5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776475595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776475595, "uuid": "d0daa59a-e26c-478e-be34-a9db36cfcfd7", "comment": "Malware payload", "value": "73ba3a923298bec113961f4fc107d3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776475595, "uuid": "9ca3ffbf-1f70-47ac-9067-28bb9f505aba", "comment": "Malware payload", "value": "888bfc44c03e97875fd1e88f56c8c052c94af130803a096114a76e480313f0dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776475595, "uuid": "16814f79-7d21-436c-a3f6-857a2bcebc90", "comment": "Malware payload", "value": "bf29783bb2daa9d8a8f1306153072375d2f5eae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776475595, "uuid": "2efaa33b-96a2-413c-a6fb-21d3449fe427", "comment": "Malware payload", "value": "0d8c61b27987cb1f76e336fbf75a82dba0ec7b81404e37f24c2fc5d710426ab84c2285ed7703decd8b6cf0359a8ce1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776475595, "uuid": "5ab8b6f2-1e5a-485a-bb12-2d5195f21c28", "value": "T1A9E6333FB2A8A13FC5AE0B3109739350593BB765695A8C1E0BF0490DDF6A0611F3B766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776475595, "uuid": "3696d8c2-5b35-43a2-aa7f-bc164c65efda", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776475595, "uuid": "6c2f2b0c-bf74-4481-89ac-ab30eaff6710", "value": "196608:ij6kU9NYlObEk0Lp2dd/kZzkmxgy9NSW7I7GIXSpINbhiTGIwTh3kC3uDEN9TrSw:ALSN30LpEiSCC9XSpIFwah3RuINhkUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776475595, "uuid": "d37ae76d-a140-43bd-9dda-03ae3c6f3308", "value": 14503144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776475595, "uuid": "4078d7e1-6916-4070-8a20-2941b190f4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776475595, "uuid": "5783f3bb-4f61-417c-9f3b-73aada633531", "value": "hpKdXDa9E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7094fe30-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776536927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536927, "uuid": "72f49fff-e682-42af-88de-2b6e1186ecda", "comment": "Malware payload", "value": "dd3024193ef3e05ec51106966544fc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536927, "uuid": "b92afd7f-c7d3-47b4-85dc-f9219f5656da", "comment": "Malware payload", "value": "888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536927, "uuid": "87803fa2-bce3-4e47-b009-ab67beed3f86", "comment": "Malware payload", "value": "4d3b600fd76d9905269e1e96bf2a42ed7a1d106f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536927, "uuid": "557b857c-70ca-492f-a9d9-da65a2e45e57", "comment": "Malware payload", "value": "bda5b326b683f9d8bfcfa116296f736b10e2fb3a8c90815001ed3857c4a5192733e81c05d25d0042cf246d24fafca4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536927, "uuid": "ff27e590-604c-4002-b660-6cff783620c5", "value": "T1EA623B42E95D8562D9F204F15A1E6A35BAFFD16007328EC397400B9B6E75EE0B83834F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536927, "uuid": "58cd7516-d92b-47a7-a865-32af6734534a", "value": "0986c134ccc3041a3665a381bbdf8c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536927, "uuid": "bc6b4ea2-ce58-48fc-84fb-55283a1c9a76", "value": "192:6MCepUCEPUoRRwExvUrJFwbQizVoYZqXoGePV/k3K5/kK4W+FWAsL:ilRUoR7kw0pXAl5cK4W+FWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536927, "uuid": "d2771b0b-9468-4299-9602-485bf74b9efa", "value": 14976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536927, "uuid": "588f3e14-e7d9-47b0-9308-6495604b6cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536927, "uuid": "50235346-8333-4d4f-9fb2-f0b450a4b24e", "value": "mrxsmbmg.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed4b919-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473037, "uuid": "3c37acae-b482-4112-9c61-eaf2a550ab5f", "comment": "Malware payload (WeedHack)", "value": "0da10545fe7b4d26efa6f61239ea69f8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473037, "uuid": "6db43876-0c62-4eba-9947-9167d4cf66cc", "comment": "Malware payload (WeedHack)", "value": "88eed69a60339fa23a877daa254f0602c1845e78289df9c491fc1d000e9e8434", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473037, "uuid": "e42e3504-2240-4c14-99eb-87d4c3c3f9d9", "comment": "Malware payload (WeedHack)", "value": "fbdf5e5f43ae104d49861cef90b280042b59ad74", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473037, "uuid": "bdb1ce7f-12a4-4b53-9c5a-674e4b3fed7e", "comment": "Malware payload (WeedHack)", "value": "a9d1053572c07fc5e4b67c642ec00e2c3449feec288d9324fb3b0b977827572b1f23893449e209899fd5598c9a76fdde", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473037, "uuid": "8b3b0a13-8ad8-463f-86a9-79f257d75635", "value": "T1DCB423046622CC86845989FAF8B99771962878DC35FA3F7772CB79C940F44939ECB324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473037, "uuid": "d66ddf40-3daf-4fd5-9be4-f46a2633d894", "value": "12288:QAiGWs8VxLnctbx2pgbaQ8y73y6ZyZsjy6yWcNWMnarrm:W5Lbkbxp+QX73S6INPqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473037, "uuid": "78e386cd-083d-44b2-a933-bdf2abcb90ec", "value": 527636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473037, "uuid": "7dda8101-9a93-4222-9949-96967024811d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473037, "uuid": "6aa5d70d-51da-4f12-a65f-413343a90eed", "value": "sexmod-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060a96af-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509261, "uuid": "f88e106d-e0e5-4ebe-92f0-eedbc167e612", "comment": "Malware payload", "value": "4d1e22acfb24a18def20b89a8423e996", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509261, "uuid": "dd739cef-648d-488d-ac85-94252dd40492", "comment": "Malware payload", "value": "8915095f81c7368bffbb595e0a771a70bd7e6245f2d1e4cc9db983bf493e4b4c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509261, "uuid": "b2180b9a-df70-4519-b56b-b153525994da", "comment": "Malware payload", "value": "f305e881f8a11dd6e5f67d184476646c22df4fd0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509261, "uuid": "daeebdd3-0d2b-4ef3-b136-1844d9650516", "comment": "Malware payload", "value": "0baf1af2ad624ae556f76d44b30ef36a8682f17501a0e706d23efc7ddb66ee2ac6dcb272b7fe2cbc2b1cdff147170899", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509261, "uuid": "453db498-4024-442a-b6c1-d73682f5331e", "value": "T1AA663336F51D1DC9C82B98BF50A11BD4C3E6220FF447D43B62A176D4B6E5B8A08CE16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509261, "uuid": "82725f3a-74a7-4fb7-8986-96415cbfdf4a", "value": "196608:CXU8YYlbHXUZZftz5iqKpcXUS0uU+HB/OGUElHT:cU8YYlbEZBKqJUSrU+h/PUElz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509261, "uuid": "377eaa9d-f244-4f38-aed4-8eadab8a7717", "value": 6831546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509261, "uuid": "e169432f-01ad-4680-bcc1-d15c438f8ca1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509261, "uuid": "fae84cf3-deef-4f7b-a61c-f7b40fde9fd8", "value": "armistixconp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a4097-3b76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551437, "uuid": "6397108b-43f4-44a2-b87c-40668fdd5afa", "comment": "Malware payload", "value": "448071dc7a8e795cd2b7455e9027c514", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551437, "uuid": "5cc80f8f-e9eb-41bb-ba15-a51152f0daf5", "comment": "Malware payload", "value": "898ea5a90810f892eecec1df9907e9a15e1dc558e74887e194fcf9553ac7a9ec", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551437, "uuid": "383a8673-0575-404e-93e1-e1448ea933c9", "comment": "Malware payload", "value": "ed478cacbf8706556b67ecabc29d36edd7c46509", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551437, "uuid": "39792b5b-8b23-41a8-993f-9b28c633490a", "comment": "Malware payload", "value": "e60fb35ba949fe2da702970a454d8cecb05d3763ac62a41c2faef3832e05d283c211678ed6df09e9cfd0de32622a9039", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551437, "uuid": "61a4f4b1-23ce-4b37-b73f-7c07d28d0d63", "value": "T1C8C79332CD450E678AF2627C69658AE3FA60AF2F1380591BBDFCBA4C1F36D715042B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551437, "uuid": "9020648a-ae7a-4f99-baac-29dc661d8e56", "value": "98304:uvkyvull9xUdyTrSqiyU7WXsHUn248QoaV2P48IfqPRJV51MU8v8mYK1St:urgTr1NrpIPAqZoUzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551437, "uuid": "95fcdd0b-1b89-4a99-b236-6579da3e82d2", "value": 54341632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551437, "uuid": "52deb5eb-06bc-4224-ade1-b983533006f4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551437, "uuid": "e3dbda0c-61d3-40a2-baf6-7bb75735fff3", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736e82d6-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776527054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527054, "uuid": "45ba5e0f-4be3-4a39-b8f3-6dd31840307a", "comment": "Malware payload (Gafgyt)", "value": "bf01c7e1785cdcb48a4b862fa040a33c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527054, "uuid": "52765962-4140-4d19-9be1-616e247986bc", "comment": "Malware payload (Gafgyt)", "value": "8a7dc9e82c8d24fe5c62c9dfac5dfbfa9fd5a514bcbdc8cb0e3fe4a1e4ee746f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527054, "uuid": "1749bbed-5d5b-46aa-b4fc-4cde0dcc8e53", "comment": "Malware payload (Gafgyt)", "value": "d5d93d3cbd3e3fb05f7f151233d24c58e45ea78a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527054, "uuid": "acd47c92-038b-4910-83dc-340dea12f2f9", "comment": "Malware payload (Gafgyt)", "value": "c324084f075cf105e3cc239486e0c30ddb24405d97dae0239eff48d857f5cd8671d0f1ff821a7e7b39f716caf4321fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527054, "uuid": "50393f63-945b-46be-9479-298fec2aa940", "value": "T1E3C32917F9419F41C1C325BAFB8E964933136FF8E3EB7102D9249F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527054, "uuid": "69638356-67c9-477c-95e2-98162c3f1a8e", "value": "3072:i6nP6nlJosoawDh6iNwaVBgqO7sCk3Xr5h/pc1n:iSP6nlesoawF6iNwaLgYCk375ha1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527054, "uuid": "65ee8f68-c225-4c95-ac79-7849fea3496b", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527054, "uuid": "fa6ddea7-5ea4-40e4-b1d2-81b8ab4f2d96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527054, "uuid": "161fabcb-390c-467c-bd49-cb8a89c0e107", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454e4472-3b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776511514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511514, "uuid": "12284ab6-a55f-40a2-b255-9be8c3f97846", "comment": "Malware payload (Mirai)", "value": "8f29fd50398bbbbc141c426fd706c64d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511514, "uuid": "95dcebc7-a782-497e-946e-65c96050f5c6", "comment": "Malware payload (Mirai)", "value": "8ce0d00d3e6f03a3d44a605a331ada378787c2518e41945695494d0c84aa19ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511514, "uuid": "81c8b4de-2204-4a00-a0e8-77a429f82ace", "comment": "Malware payload (Mirai)", "value": "bc439b3c33b5c560d1e54bf4bd8ceb1a11970983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776511514, "uuid": "add93b8d-344d-4b6a-8209-a4535b480adb", "comment": "Malware payload (Mirai)", "value": "75f7441a4a78a0d4e4df918caed479ce20d5ad8d1bdbff0e600fc274e60ceaca9a2788939c5a68a2a51a93782fb82119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511514, "uuid": "45ea91cc-3f97-4c5f-bea4-d4595f522696", "value": "T1AC931209E979922E9AB0E73B95B8C65EB31557838C9E6102373011C78DDF3253B65F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511514, "uuid": "3fafa7cf-936c-4c9a-bc4c-bd5ff87dbf4c", "value": "1536:3QauNoOtWPA8Huu1qzHO6Og2w3v3KFJFgNLosCWZzHY6uFtzHC:3DOtWPAGuTzFz20/GPgNLosdVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776511514, "uuid": "8fab77dc-d2d1-428e-bc3c-36274c5f27db", "value": 89684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776511514, "uuid": "715e02fd-86d8-41ff-a5e2-889faee8221d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776511514, "uuid": "8f029cfe-b4eb-4456-8ee9-2479339d1a0d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ecd451-3b1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776512618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512618, "uuid": "8842643b-1c1f-4537-81cb-17e44d05f8eb", "comment": "Malware payload (Mirai)", "value": "62924c568624987253ccea642e1c7eef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512618, "uuid": "d3b20076-84d2-4eb6-8d3d-bd3b5b805391", "comment": "Malware payload (Mirai)", "value": "8df1b2fc1ba146c91898370bdf78cb78eb7f21225c4d7c149c269f062df3e573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512618, "uuid": "12252345-d533-4532-9285-dfa2a472a8cf", "comment": "Malware payload (Mirai)", "value": "ca92de22dbb50d2845a28a78fc2443d5f3999b23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512618, "uuid": "da8338c5-8e6c-4e02-890d-3a879e96a24f", "comment": "Malware payload (Mirai)", "value": "bc6a73e2fb46b0eec4f6752017bb8733f6246d4bdff2a6f44beab916326d498b520278c1afcc60d74174b2feecdad22f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512618, "uuid": "1c85064e-12c7-4c22-b2e2-39e43152b20b", "value": "T11844F806AB610EFFD8AFCE3706E9170528CC651722E86B3A7574C918F54B64B1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512618, "uuid": "0d48815a-0ea3-420c-8e03-59e0f74e0d9d", "value": "3072:/1woiuf+IkfzAD4cU5Veu08u/Zd/m8q8KZ83B2/+NvVhUnYMebspm3:d1f+xcU5BsZQ8V3y+FUYMebsp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776512618, "uuid": "066a774e-5787-4511-90ca-17d900ffb3e0", "value": 263404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776512618, "uuid": "e22e36d0-8227-4c0e-b433-00130927d639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512618, "uuid": "f889f631-0a23-4995-81ea-56085ba44518", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b69b2cf-3b72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776549669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549669, "uuid": "2559e527-cff9-449f-9842-d01c9598c5a9", "comment": "Malware payload", "value": "70a79b21ba4c8db19b93058ea0951df1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549669, "uuid": "a7c1c6a1-ff52-4b75-9725-73ff43674bc5", "comment": "Malware payload", "value": "8e52c92c533dc6cd4935e6d2e26882335b86f80f10c178a7b24294fb866b3532", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549669, "uuid": "4111fac8-167c-4b29-8a0e-ac6b2d7adff6", "comment": "Malware payload", "value": "6f2519be2e328f72a4cac303f8bb3a5c23f79217", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776549669, "uuid": "debebcb8-7f50-4223-9009-f906eb57ac7d", "comment": "Malware payload", "value": "33b96ad6f4c7bda7494871c27f6d5f08bfb21ac2be07e0cb103148c99e3be41ed84ee0fd289b6d8d5796ec9dc9e29d1f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549669, "uuid": "ec019999-b343-4b0c-aa48-1ba9ea6dc1de", "value": "T1E16733DCD8784B56D97B807D8332918BCD67CDD2084E643B216D35C9B8B2BC6BAF6049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549669, "uuid": "fa8a034f-c241-4d09-bd29-fd5b1dcb245b", "value": "786432:xrcbyGycwgKtqaNDK/kaKUdlcUZhbstxflWZ7nrm9Ep+5j:xrc2sXKMWe/kzU/cUvbstxdmKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776549669, "uuid": "ac653950-d7c0-42fa-b814-13432f648391", "value": 30015488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776549669, "uuid": "278c8607-eac1-484a-a00b-c37af86752bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776549669, "uuid": "f9115cf9-7f76-45d5-ade5-5e98855933c9", "value": "Sloven_Game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97575fad-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776488030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488030, "uuid": "d558ec83-ac21-4921-a84f-f32ae6544f3c", "comment": "Malware payload", "value": "594a1cf358be60863decd20bef1c34e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488030, "uuid": "f929a777-ea06-41f2-85e8-ae72b0bd93b8", "comment": "Malware payload", "value": "8e8fbaf520b1a5afffd4534cf7c138162a4f153b5013a99c232d1bcc7670d413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488030, "uuid": "0b84e95d-6353-418a-a8af-dbf9f080ce69", "comment": "Malware payload", "value": "94dcef84ed23355d55e49de0ac6eadc045007f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488030, "uuid": "a2763d36-5948-4f7e-885e-14f9e78fe8a8", "comment": "Malware payload", "value": "f2ad9cf8c2696893174d68072e10a8da2d83f08a620c9718b3dd0037ba29e9e0789836dede595e5f577ae0bd6426f625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488030, "uuid": "90585262-044f-4463-9b26-ea5332a7f52e", "value": "T140247C99BA4F7E82D2C6D3F89F8BCB91312731958A4682F53D01132DC5C6DD988E2B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488030, "uuid": "0bb39047-7e56-42b0-908c-b28a18857357", "value": "6144:N28tZFTJNVafpx+i4y3KRh0sXeUxlIjq:FdTJNVaH+SdAeUxlIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488030, "uuid": "c6b15471-a2c4-4810-a1e6-784fef93c3ec", "value": 211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488030, "uuid": "d16a8be0-0889-48ab-a45e-2d8b605044b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488030, "uuid": "e2451fba-e15a-41c0-8953-34b68306ace5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a066763-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776509375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509375, "uuid": "723d5dcf-0b81-4d26-b736-484504aec03d", "comment": "Malware payload (Mirai)", "value": "1235fd9ea4bc8d12225d3339cc4df73c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509375, "uuid": "0c12c592-7089-49ef-b48e-3c1fd747885f", "comment": "Malware payload (Mirai)", "value": "8ed185081c163327a2352f2814ca0b679172ac3ff4a48985680667e440418128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509375, "uuid": "d215b952-654d-446c-91bd-09dee72eca59", "comment": "Malware payload (Mirai)", "value": "86b827c83bc6d96ab1abea627297ee3e8102e680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509375, "uuid": "f0841d9e-d039-4500-8fe7-dbd1f14eb23b", "comment": "Malware payload (Mirai)", "value": "bc59fe39963a44239842236570e92b9b5f0ada355f4c03db5f4841a7e3a999b95d9eee37b2880ac6154b0da8812e9f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509375, "uuid": "f3627716-641d-463a-b19a-0db3063cc98e", "value": "T1C344B41A2F228F7DF3A8873447B78925979933D627E0D685D2ACC6105E2438E541FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509375, "uuid": "462602a1-b28c-491f-baa6-3a9dfa8c67d2", "value": "6144:x2b9zimXsd/QLNrUXXCMoawgAruQ2zvsqNAGzsUTIN2VAsBTRpCT+7GN+3bsf+9i:VwfyRbPFRvRlXUnatq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509375, "uuid": "fa5b1d80-c434-49a3-87ad-3975f6e9ac11", "value": 254668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509375, "uuid": "382766c7-e745-4b41-92c8-69d52c95ca60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509375, "uuid": "a49cc441-7c64-4c4f-b107-8b4be2cd6403", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f29fa76-3b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776539582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539582, "uuid": "b4b24bfa-a39f-4d91-9f7e-a715b3f76548", "comment": "Malware payload", "value": "921d321ff5e470d6a4a57d8c0032c5c4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539582, "uuid": "8c184876-7f8c-4d1a-a2ed-48bc06ae0302", "comment": "Malware payload", "value": "8f11b4aeff40c332333e5eaebdda52d09d4f498d5c477f7bd628b46384321f08", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539582, "uuid": "6d9928fc-ab04-4dc0-aee8-de427406643f", "comment": "Malware payload", "value": "cc32783db7b5605628c3688b0606d3220e23e616", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539582, "uuid": "0a0dfdfa-baf9-42d7-847f-9fa363db3e2d", "comment": "Malware payload", "value": "992d2dcf295e18794721fdbefde71fa7ab310d445e73f56ddfeeb087417cfd495d00540343617b460b7909393f0664f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539582, "uuid": "565e236f-0a0a-4ff4-b1a1-f60643347224", "value": "T16015332E36DFAB3E6641447F48926EDA080D40471D0711916D762BBECABFE9F92780D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539582, "uuid": "01747070-7a55-4090-b369-6f7b98663e3b", "value": "12288:DnMJFzGro8ipuysjFSym76hAhE34mPm8FniH66MvuIxwxoqjR1rT2W0KrrtRCfX1:IJtwocZjkWiZxo4TP0URCvDcStcNpKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776539582, "uuid": "e04821c8-9f23-450f-befe-d22c3af80f04", "value": 886085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776539582, "uuid": "53246a41-ca3b-455a-96ee-9627938134c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539582, "uuid": "d4cefbc0-d799-4ae1-87ec-c2b902ee33c6", "value": "Kryptonclient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1bebbf-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494188, "uuid": "1e07136a-7d5c-4036-970d-d0e7f8c58ce0", "comment": "Malware payload (Mirai)", "value": "4f0cf57d9a63ebb6d765366f93d95ec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494188, "uuid": "33911a02-90a4-405f-8696-a8d741b19c49", "comment": "Malware payload (Mirai)", "value": "90324772fa25816cc396637b1f7e185f8912a4b037cf4710c3fca46576a5fb1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494188, "uuid": "157a4d61-004e-4246-a157-808a01372a10", "comment": "Malware payload (Mirai)", "value": "d4620b782c7c0b3fa73e8da002ad55ea27a7e229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494188, "uuid": "bb5abfd4-5ba7-4cd7-aa2a-907160f09bf1", "comment": "Malware payload (Mirai)", "value": "37f3f3e00bcadcc07b37da9473a48f27ac79ac84435044107ae3446216807194236ac6cd024a4d30dd89b600fcebb874", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494188, "uuid": "4c2cd19a-41cf-4052-9165-8b9260b9fcb5", "value": "T12AD2D1ADE5B442C6FD4E0C3DC4CC3BA10E19A581231BDB9667218C8D5B36C9BF17A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494188, "uuid": "e372bff9-ffbe-40ca-bef5-52a4a41b5e23", "value": "384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj26G08MCRWGVCz0NvJ:HMYHb62x4ahQ3CfdwLjdT087Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494188, "uuid": "ff191f16-5754-4b04-bda0-451e8f5b690e", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494188, "uuid": "4db67292-248a-4b15-80be-92c4263e086e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494188, "uuid": "ea3147e5-9429-44a3-bec3-82937e17b109", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69895030-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484517, "uuid": "69b7da94-2b3b-4225-99bf-20d7b69ddf2d", "comment": "Malware payload (Mirai)", "value": "92f6a46f4359c041742d1da4e38333c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484517, "uuid": "49396d15-1c71-4e9b-921b-86560bce0d54", "comment": "Malware payload (Mirai)", "value": "91d525cd43f5d07f105aac4e1477d3b60292645ddc86b089efbf0c0df9dbf7f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484517, "uuid": "ec59c59f-0674-4ff5-a935-4b08ebbb84db", "comment": "Malware payload (Mirai)", "value": "f7cf6848748984e50383f44b5f6aefc22849fe7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484517, "uuid": "c8611e29-c778-46d7-b864-6f9aacbe7ae3", "comment": "Malware payload (Mirai)", "value": "becd7c6cc7000ccceef5f5ec9082de4f8b3486c425813bc4ac7c2f8291732b7078c43f107dd36d12e1b60b85fcc47164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484517, "uuid": "a4bc10a8-8f0e-40ea-808c-eed09f14699a", "value": "T1C4530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484517, "uuid": "e8d8d9c7-b036-4f20-99f3-1ce39ca21022", "value": "1536:wdnIYoZXnYkTAcASlquASyAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqRuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484517, "uuid": "2051cef6-0f23-45ab-90ae-756cbd64b71e", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484517, "uuid": "a57857a9-b7f4-468f-909f-f3e41fb30ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484517, "uuid": "83d64a7d-1c8a-4ef8-8b34-76364409e4a7", "value": "Josho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c7529f-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537149, "uuid": "cd9423ba-63c0-48f3-9a61-13365eea089d", "comment": "Malware payload", "value": "573ac4e7282c53279fa8b07c695c0e29", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537149, "uuid": "93b99edd-c2cc-4071-bc92-e6cafba6f779", "comment": "Malware payload", "value": "92bd1f1ffdd9f8d1272317ee6b8910fc1ea08c2eeb83883815cc002c20dc473b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537149, "uuid": "94138e3a-473b-4f88-94e3-49c66f15439f", "comment": "Malware payload", "value": "341feca8910cf0cdd859112791f95bd20a757e92", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537149, "uuid": "0d2f9d6b-7e17-442a-88ea-7aefc9ca4524", "comment": "Malware payload", "value": "4d87512a6bb84184485544541d0616c8b1662c5030ba11b4490ee39d52044276b93238573c27dfee9997f3669b025e65", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537149, "uuid": "1ec1cd72-7ccf-412d-a768-c146a8a2b447", "value": "T1F6E51233F4E8C07FEC87A33295822551796E26F7E00630B666FC0E7AFC958975360695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537149, "uuid": "1df81fdb-1525-4113-b2d8-e7677a8b051c", "value": "49152:9QQE5a3An1sYJvDiG5wej0rcJEr8XJb0l7Seki5EG57TmWFR8rQvuj0ejP8bZdd:9RweYd+G2e0TrYCl7Oi51mTrj81H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537149, "uuid": "5a45f62b-0fbc-437f-955f-9930cc62ddc9", "value": 3164535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537149, "uuid": "72c97ab7-1c78-4849-bcc7-f7152bee83e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537149, "uuid": "cbb09ca9-2d95-481e-9d1b-adc28cdcd2b5", "value": "Meteor_Rejects-0.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8d3740-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "908baa2c-9504-4407-965f-d1652170c984", "comment": "Malware payload (WeedHack)", "value": "b85a0c19efa2aa65f9e2c683227eb2b8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "934cd2e0-0550-4930-b5b8-81ffb71b976f", "comment": "Malware payload (WeedHack)", "value": "92fd7d05967dafb93acdc20520800244c7c12410185679775d1784c8f3444808", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "040b2a2a-8ad9-49d6-bb7f-df3f96d72f27", "comment": "Malware payload (WeedHack)", "value": "2e565d3b9ab25d8fa7cdec601fa17b560d3e5424", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "af78fe75-b6e6-4fc5-bfa4-cb3d890f6cc4", "comment": "Malware payload (WeedHack)", "value": "bd2cc5785dcb8eec5c014b089fd6cfaef1854e10765420fc905cf97d5cecac868e3a461f259133b5eb5696a7a517b706", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "298461c4-9886-4bf0-844b-242d0d428c45", "value": "T1F89533A9A423CD064F80B0357389C4B1C79EA97F09448B6E16DA533A1671336EEFF4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "19cc43de-0fc6-4b3c-8e6b-1990dc27e1c6", "value": "49152:1vU0mm+GCiU9C7x9ngcMdv8V+IcWmmYiLP:JQRC7xyDdva+hWrYiLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476925, "uuid": "a0cee77b-8777-4ad2-a62d-81af1acea842", "value": 2043593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476925, "uuid": "62ddb8a6-a92d-41db-b3d1-4a82a837d578", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "706265c9-96d2-46ae-bff4-99a18d9241b5", "value": "donut-dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4447c65a-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474146, "uuid": "d2164955-6f07-4293-b52f-02dd4dc174ed", "comment": "Malware payload (WeedHack)", "value": "5f60d951d2cd819c97086d3279a29b03", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474146, "uuid": "e77c17fd-e251-4524-a363-6841395ad0a6", "comment": "Malware payload (WeedHack)", "value": "93d766f6f1be90684b46752a2007e97d9c293703236057f146ee57ef59c18959", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474146, "uuid": "c846eb20-4f74-4b61-ac38-1abaa1e1b8a2", "comment": "Malware payload (WeedHack)", "value": "ded509510f23d20b826d9978f38f4bab38b87b6a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474146, "uuid": "71a70e12-2048-4af1-a107-15e152b50b2f", "comment": "Malware payload (WeedHack)", "value": "fc5b138797f3fb3be88194e03c0914d59cdb1bc382472b8e0143332dd1529e865bee0a8e7475e67911981ab296fd5275", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474146, "uuid": "6b2fe619-e45a-48cd-ae84-c08c00011b95", "value": "T1FD3533D6CBEF8D41B986713CD1AC94F01DD77789076D9384E3DB1C60B8329B6A80992E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474146, "uuid": "4c189d3b-8cd0-4e3e-b06c-18fccfe9cad8", "value": "24576:BVQbNWTCbV17GmBoyAEc+ZISkpIiSfg8JFq5h6K2hr2:nQbNWC1ymBocc+ZIWimCEhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474146, "uuid": "8207a287-8f25-44a0-a2c1-c1cbf4b1aa25", "value": 1060297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474146, "uuid": "6405bc77-4b4a-4633-9973-e90bb8403de7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474146, "uuid": "7b1ae4dd-bcfa-453a-bbb6-971110e91e22", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6be551-3b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776553291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553291, "uuid": "ce71f59b-2ab9-437b-8729-51af47aaacde", "comment": "Malware payload (Mirai)", "value": "0192d8da849d0f0b7c7f1f841b01f38c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553291, "uuid": "f956cfd6-03d9-4afa-96f2-26cecb33d6f0", "comment": "Malware payload (Mirai)", "value": "93e7e592239a41716077f2c4fc29f76640b5296502725dfd3d3615e27838cb14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553291, "uuid": "141ecd43-8876-47eb-98cb-6f283cbb8c31", "comment": "Malware payload (Mirai)", "value": "d30a0517e286d7cdf42ffdd1144ba6ef0976487a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776553291, "uuid": "e315e46f-9e6f-47f5-95fd-556bacbcb686", "comment": "Malware payload (Mirai)", "value": "ab60df8c6f5e94c7aabc5c4f9076370366280c3d1bef138747d1d574b70ec49c9d7d39782c50f3507a48fc132f779ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553291, "uuid": "adf41c67-d9ed-4c90-b9ce-2f344571eb4a", "value": "T111733A17BA4080FEC899C43843BABA36DC7274FE1379725A17D8FE366D55E601E29C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553291, "uuid": "1540b6b4-6850-4562-a457-e5a8594ca518", "value": "1536:DeuIZobGRRINkGIb/+w4HnC+8l8AnzcfS:quIZzDIWGIf4HT8l8AzcfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776553291, "uuid": "7eb46927-6194-4af0-bd53-5edb2568bd52", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776553291, "uuid": "e7980cd3-6341-48b9-a5fa-3b4f15d65869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776553291, "uuid": "8e568d20-ced4-41ae-99b3-323f66512284", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a046d41-3b14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776509321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509321, "uuid": "ab67d7ec-61cf-464e-b76d-8463131acec7", "comment": "Malware payload (Mirai)", "value": "309f170a2fc47bc8aad23f0a7a678b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509321, "uuid": "c6996c31-9bc5-4df7-9f9b-1391f37905c9", "comment": "Malware payload (Mirai)", "value": "93fd5d044909555935ed9a14e895f470efa5ac1553365937d0486e063f0839cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509321, "uuid": "37c9434c-d33d-4c44-81d9-e3af1ad8ec36", "comment": "Malware payload (Mirai)", "value": "dbc4bb7f57279279fc6fde22a1877562842de5e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509321, "uuid": "39559368-83bf-404e-8749-d56361dcfd9b", "comment": "Malware payload (Mirai)", "value": "a9b205058d1d955340b0c2712706879f7e837c4c28f56546e2404432387e341cfb8161000066c558dcee2f249e9197a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509321, "uuid": "1a858a4f-cf80-4253-9ca6-a7bd0ee9fca3", "value": "T1097302045744C2A8F32BCA7C1B952F9C663F4B7706071D2F22A8A6936F9D92578537C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509321, "uuid": "a02ef8b0-4b76-42c4-b3a5-e2eb728f2d0e", "value": "1536:kdCTDABCJhDS056FRy9sOmaKGyvfbl8fY1y3kvjpnGzQiuTb7+j/ngjNg/YIFvh6:HT8whSiMwsOP2fbyg1xMhuT/+Dnq2Dve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509321, "uuid": "c4e0beb5-cf39-4c86-b75d-c6d1b7e8ad13", "value": 75156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509321, "uuid": "62b6f629-e4ad-408b-9aa2-95d6569edb87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509321, "uuid": "c31b5b1c-dcfc-46bd-af8e-932affadf4e6", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1738ae33-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477077, "uuid": "85b8ec51-859f-4f53-bfe9-b6db38fe294d", "comment": "Malware payload (WeedHack)", "value": "7bd4f610101e1c30fe97f6f98f7766d4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477077, "uuid": "a7fe5a67-4380-4847-b52f-350dd47d1c36", "comment": "Malware payload (WeedHack)", "value": "941df309070d3eb924587f42b9a6dccc5d59494630ec5d566f18772af0d56ed7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477077, "uuid": "36ddc3d4-40c0-41ed-8e46-6e35a007f38d", "comment": "Malware payload (WeedHack)", "value": "f18fa5683738067b8933da7c7a6beda12ebf1664", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477077, "uuid": "1d4294bc-8334-4ecf-bb5a-5e87241fba5a", "comment": "Malware payload (WeedHack)", "value": "c018c3475bef3261396b53305da254897b98999f87363b35fdb3fd0ba38ff238913c678d473f90391f80cc5df10c411d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477077, "uuid": "2c014093-4a2e-4960-9316-71be5990d8c6", "value": "T1647533C9CF4C8E64B28DFB30C4B8C051991427B7A9DB1CDA2BE5B49368277E05E16974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477077, "uuid": "b4764de7-a2d9-4259-8d7b-91142b5981bd", "value": "49152:4n/i5/GbxEFKQ45w9exzsZqwqgxs5WBv9pCgXDg:0/i5E24SeWLK5W99tXDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477077, "uuid": "aa74ad2e-936f-46bf-973f-63445034f262", "value": 1633742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477077, "uuid": "4effa1e6-7fe8-49fc-8033-fc975e32d1a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477077, "uuid": "25e7e487-e16e-419f-917f-987fec38fa63", "value": "SPOILER_ChunkScale-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970ba9b6-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776533985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533985, "uuid": "e308c89a-5848-4f05-9ae1-e4097770377f", "comment": "Malware payload (Mirai)", "value": "0f620f09be0691292a6dee0fd3bc47f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533985, "uuid": "a4606e38-fe96-4583-bcf1-4255de64f44d", "comment": "Malware payload (Mirai)", "value": "94990cc87f4fc49c54cd1c0234818e5089a7b91363bb33b3eede640211e5e71d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533985, "uuid": "9b79bff6-74ba-414d-a92e-b0880d397d22", "comment": "Malware payload (Mirai)", "value": "aca028493c85803c881c64ae8474f9707872ed21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533985, "uuid": "c2fcf29f-0e87-4eee-bf20-4d4708b145a2", "comment": "Malware payload (Mirai)", "value": "90d07076a45e58b09735b852b8d6ce77e013e06c01cdc7c66549c620c0e671a7afd15574857cf4221ba6e633ff795e81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533985, "uuid": "5af8fc06-6faa-42cd-a940-b8f63e0264c8", "value": "T112D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533985, "uuid": "714e9763-877d-4fd3-a0d4-6c06d44b1a9d", "value": "3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYY:fYFJvwe1gKCYVl2sz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533985, "uuid": "b2979638-cb9d-4aeb-847e-1c30260252a0", "value": 137481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533985, "uuid": "20570023-be53-4be2-915d-f705ae9e8b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533985, "uuid": "233a1f65-da28-4818-8cef-c099276df175", "value": "94990cc87f4fc49c54cd1c0234818e5089a7b91363bb33b3eede640211e5e71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095bebe7-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498958, "uuid": "107c6b36-bf53-483e-96eb-65c476927475", "comment": "Malware payload (Mirai)", "value": "c799ec46ae930c437b2cf709de08a943", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498958, "uuid": "8e75b085-3802-4c29-8deb-3e8f4f3eb5fd", "comment": "Malware payload (Mirai)", "value": "9682fd9745b7f47eec6ccd7329be56ff2b9cdf60c14eecc76b92b0b4ac02e69d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498958, "uuid": "65fd037f-71c9-47fa-96c7-947d4040fb64", "comment": "Malware payload (Mirai)", "value": "d71286b33d398f775caf571d07379a8597c18767", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498958, "uuid": "ebfa6906-6705-4954-9127-d73faeeb9ca4", "comment": "Malware payload (Mirai)", "value": "02bd42e5cbdd4456beadc77301a359a9b68fcc5b77019421fb407e8117037028ccfd2b79a64e8532769c63e92d72cd39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498958, "uuid": "16f550f6-731e-45bf-8204-105faae7e447", "value": "T1F28309519A4AC5F7C8430BB70657AEB90B6DF8254DB9EE84F31CBCB49B624A4713E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498958, "uuid": "0b162834-e562-4e99-a179-ff1cf14d1338", "value": "1536:VuyXScwTwIR2hWpsMDmGf+jsMV7gZczPumFHg2OZIf5jr8y:ZXStwI32MDmGfqz8ZXmtg2OZ85jr8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498958, "uuid": "532e1812-f29b-4a13-baa2-3da249a7432e", "value": 85363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498958, "uuid": "ae5a6c9f-cf8a-424d-ab7d-22dbc7ce4ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498958, "uuid": "c843d118-1549-4dc4-9953-984ba847a695", "value": "Demon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f34e7f-3b52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776536057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536057, "uuid": "d54f1e56-907f-4469-809b-869c67e54440", "comment": "Malware payload", "value": "ba4e6bcc4834a6d0dbbbffe880d94109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536057, "uuid": "77739e6f-7f63-4a90-8d26-a0ad90d3bf68", "comment": "Malware payload", "value": "96e275d5eb6b5995b18a673ac2b42b0e17a355e00c737e31fc39167170a7d276", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536057, "uuid": "49a65f6c-312a-4068-9af7-e7b8de5ee718", "comment": "Malware payload", "value": "ad0b7aeb9da90f6f12a92a6246b9bed16d5ed461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536057, "uuid": "238b79fc-5550-411c-911b-8baddaf3eec2", "comment": "Malware payload", "value": "0dc27282992c649752f064b1afcfae7751271aa6d5e9faf17f5b8989b00c2caa8a0652b736c4b90457b18b03678d1728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536057, "uuid": "eba167ab-7fad-4507-8092-675cf0a2c0cb", "value": "T12A24B71E6E228F7EF768873047B78D21A76933D623E1D645E1ACC1105F2429E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536057, "uuid": "72858d42-0fe3-46fe-9e5c-43011a89e74c", "value": "3072:HX5VOYpjpM02eM/+7zw40RTCjHhyoN9j6AiSBrbeYI2aeun7gf+:HX54cAeB7zw4+TCjH3R6qBve+aeux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536057, "uuid": "09b5640b-d3ec-4632-bec1-b4a191a10142", "value": 224940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536057, "uuid": "a6490ff8-c202-486c-885e-1393aab9c910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536057, "uuid": "db415c14-7f3c-4b3d-a118-206ba1a12b4e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04459b9-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494192, "uuid": "baf7eff7-b0bb-4b4e-bdd5-8ee1c5ed4087", "comment": "Malware payload (Mirai)", "value": "692d83cdd605937639dba494bc701bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494192, "uuid": "ae71b318-d49f-40cd-9940-8f9db9212b9c", "comment": "Malware payload (Mirai)", "value": "97b7b4c456be48420e9bc9fc6c2d3d2ec86f4a73eae457a6ef11134ec446a42f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494192, "uuid": "cadd6222-ec73-41cc-9f15-ffc3fa239e21", "comment": "Malware payload (Mirai)", "value": "f21d8e913ad43f382016e050f5d43c7ec1d0b6c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494192, "uuid": "6a75af01-dedb-4b45-92b3-849056cf6cbe", "comment": "Malware payload (Mirai)", "value": "040617f3729895551add1d7d4e3e41909c0e6746e3370e25ad38d69598cb63fc9091c836117967a71b048f0ba2963081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494192, "uuid": "95eb2d5d-b800-4a94-8e2f-5c8bf19e493d", "value": "T163330113B715FC62DE752C39A6FD4C8A3148066DE4DC9C2235C469B062C224BFBD55D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494192, "uuid": "0d90fa7f-57c8-4dc6-8311-bb54b370a93c", "value": "768:CfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbwG9q3UEL2qEK5J6OAsNTGjf2tl8XOYT:tPtQjiZVcykHRD0L15J6RN2tA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494192, "uuid": "1239ab90-0589-4609-8cb4-38576b6938fa", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494192, "uuid": "a58dfedb-601b-4c3f-bbb9-81652eaeb140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494192, "uuid": "05cd9428-2908-4a45-9ef2-bac2e37454a9", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1126b08-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477013, "uuid": "cc1e996b-aaec-46d6-b39f-c9f4b24e76a0", "comment": "Malware payload (WeedHack)", "value": "0d97d0614ee31bdc9ce6d278d7432b57", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477013, "uuid": "f04ccefc-6334-4490-b698-2fda31b58669", "comment": "Malware payload (WeedHack)", "value": "97ff0f14dbb3aa880669ddc8c388bcdab12594a309d9765edd76547942ffc1dc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477013, "uuid": "e08ac1ab-0033-492e-8c13-f3e9da0d19c8", "comment": "Malware payload (WeedHack)", "value": "453be1bfb7099f87bed3be7c55ace1c76699bc9c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477013, "uuid": "adcdfd84-a3ef-4371-8e9e-ad8d26193be0", "comment": "Malware payload (WeedHack)", "value": "dd8a3eb053729648357b257b182f386d866e5868dc044b080b47c0c1985a6ba8a290f97d7150fe8e24783f156a63a2f7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477013, "uuid": "26c2f457-2dfb-47c1-8338-9d99452073d9", "value": "T1B8E4C887F1208AC7F44FDA7F14504210AEF0E4704A07F2561B6E885A6FEB9C89F657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477013, "uuid": "5c0a5434-0a49-4416-b7bf-1ba741df640d", "value": "6144:a1eMX5Uh/W94gpr2TsPjhMoIM/PdvehSQOGVLBgP4tUSN50+/1gp3x1Z+q3:al9xQBF3f/12p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477013, "uuid": "c3627f47-997b-4f5a-ac4e-dc1bc5e43f1e", "value": 702524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477013, "uuid": "7a4bde23-d76b-4726-a88b-0f604a53d962", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477013, "uuid": "6a1a29cd-4e01-4a33-a406-17f043cd509d", "value": "krypton-v4-1.2.5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90f9475-3b56-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776537908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537908, "uuid": "9a364912-0746-435a-a82f-09f0756d15de", "comment": "Malware payload (Vidar)", "value": "8effe02731f0aa1fdc1ced86753f7f40", "object_relation": "md5", "Tag": [ { "name": "ChinAd", "colour": "#0DB996", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537908, "uuid": "8ee83b59-9250-460c-9e94-59157d793c8e", "comment": "Malware payload (Vidar)", "value": "985fc3de7924265b3f7387a3c72e84fea10049b786d40ce1a324697de8862ef1", "object_relation": "sha256", "Tag": [ { "name": "ChinAd", "colour": "#0DB996", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537908, "uuid": "03268f89-8ea8-40d3-a150-341fad559ae8", "comment": "Malware payload (Vidar)", "value": "ef0fcee2cf8bf7dbc6d08b95d68de84fed9f18d2", "object_relation": "sha1", "Tag": [ { "name": "ChinAd", "colour": "#0DB996", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537908, "uuid": "f95d4668-73fa-4b5f-9a6e-d982798d9373", "comment": "Malware payload (Vidar)", "value": "049e7f3ed729e7ce904e6b217bc3bd5f7e0ed141e0f2fe36cc1551202747f720bf30bad8082a6d760c357c9fd6161066", "object_relation": "sha3-384", "Tag": [ { "name": "ChinAd", "colour": "#0DB996", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537908, "uuid": "09ac067a-1305-4de5-a0db-ac937c7bd1ed", "value": "T12CD54A53BD9299A5C02EC239BCB6A6A97B747D3C173123EF2F8135351EB16C1183A748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537908, "uuid": "4c60935a-e2a0-42ea-9d54-fc7f2df90e24", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537908, "uuid": "18899847-0e5c-486c-b3a1-e083758fd2d8", "value": "49152:xRDMHiXt6lN5XwWttyakHHJgd6QTdDwQ+T:xRYC9gEy6fQ+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537908, "uuid": "d0d85ca0-8676-4f37-b2e3-34efe0f5a33e", "value": 2989788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537908, "uuid": "96782f2d-be12-46b4-972c-42d0652c2e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537908, "uuid": "eda9ef64-8a1a-45b7-a45f-5874ac02f1db", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626d49e6-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527455, "uuid": "284978f2-f151-4f1f-850b-92b69657ed45", "comment": "Malware payload (Mirai)", "value": "2b99917324c857ec3db94bcf8bd587e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527455, "uuid": "3a023fb8-08f0-4d77-ba45-f022cee8f26b", "comment": "Malware payload (Mirai)", "value": "991779edb615e17abf32fd62d7aa2a051d9974be8b5acf1cf82dfb0208512b7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527455, "uuid": "9bcde4ef-ab65-47a4-9506-3f33960af89f", "comment": "Malware payload (Mirai)", "value": "06de6c57f3ec5c98291e6b866ca38d9a9cbef8f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527455, "uuid": "cf0f23db-27a1-4f62-956c-5bc4fe7bcf7f", "comment": "Malware payload (Mirai)", "value": "b5ce156b1d21c127d9d8e47b4615cc3c6cefd85badb4376fcb820abcd2403c706995614576631748ed340dba2d28cb46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527455, "uuid": "1225c9d8-a48f-487f-94b5-db525db922aa", "value": "T104146C2BB3C3ACE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527455, "uuid": "b2a98eed-effb-47e9-bdcc-683f4da8b383", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtW:BZAyFzQSdS7Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527455, "uuid": "8457c94f-d305-44eb-a5fd-1c39f81db35e", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527455, "uuid": "9d472438-0411-4c92-a34e-4e167a1a456b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527455, "uuid": "59c7d41b-1761-49e4-a52d-133e6b4a1872", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8f6c7e-3b35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776523683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523683, "uuid": "6915b8a3-2bf9-46af-98bf-9023cf10558a", "comment": "Malware payload", "value": "e6351c85bbf515e3c5291287c4569cf4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523683, "uuid": "e6ef4786-f33f-4490-be6c-cbee992d517c", "comment": "Malware payload", "value": "9a8720d27a44ea90b00a223f1173f50371d0a99d91a79505ec1a606d6e4fb62e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523683, "uuid": "cec23662-e79a-4b27-b790-8c708f9fe1e9", "comment": "Malware payload", "value": "204142771b72a770a94cf0db3fb57776dbb152b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523683, "uuid": "ef91a366-7abb-4f45-935a-d6b61dae49be", "comment": "Malware payload", "value": "6aeea4ad60a34e198a4039c5bc97dfacb10d9614c93d7399e053f8a3c6a5fbd52bd1ae217b9e3b51f9e6402d1ec83433", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523683, "uuid": "3c54ec44-a02d-437b-80b6-6e64c7adfdd5", "value": "T164D54BC72A0CD647C032943654CA2442C12CDF5AEEAD4E85EA328F5D72E7B463967F4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523683, "uuid": "8bba6f72-b9f3-4ac4-91b6-af2d22cf696b", "value": "89e1c675512a0b89b8a00dcc1980a62f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523683, "uuid": "398e45c1-236b-4f98-b060-28f1c314699d", "value": "24576:Cl8YS5Yzkp7W5gFbmmMCmktkC7vqXz08WyhmMCHNQch64qwBhmMCBRTGQj7LoC4D:j/++lUsXraV+pK9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776523683, "uuid": "2b22d56e-cff4-4bee-a95c-d80c65314533", "value": 2813952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776523683, "uuid": "0eae6a94-9437-4fcd-a60d-e9a9a73b6138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523683, "uuid": "54973857-bb88-47fe-a4d2-4515cb59a01f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86660d31-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527085, "uuid": "a6f86739-6272-4f04-9a58-e12e9946bdf1", "comment": "Malware payload", "value": "6d3dab4cef6a28edef7ae3327da1c90e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527085, "uuid": "6aaf2b16-6b5a-4e2e-8955-0b57339e0ebd", "comment": "Malware payload", "value": "9ab31332428640deb133e870198a8ea9a00c7613ebc6bc6388b47d1a975390c4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527085, "uuid": "03dbde6f-3d02-4a5e-8b8b-5f83dfb0e825", "comment": "Malware payload", "value": "9c795ba3768fce126003fa7fe102e58e9801f1e0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527085, "uuid": "da4762ef-9a76-4e7b-8b4d-b223c1841f7d", "comment": "Malware payload", "value": "8fba492669755bb33ff9eebe43f84d154ebe34235c843063fdc8888fefd78d5fe80433922560d93c5adc52cc9b5e44f8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527085, "uuid": "acecc543-ae34-40c7-8010-339145a46c94", "value": "T1CA05F1B3F71D05BAFD1BC936800058227869E5F7D45B702F26BC46B708A39C99B357A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527085, "uuid": "6bb111c0-25b2-41d4-a8de-cff7a7fb70c4", "value": "24576:m2B+VAqoq05Cj70O76JqRZ3FGJd7V5iTlQmKg++:m2Eoqfj70OUqHFud5oBKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527085, "uuid": "7e19a3b8-e885-4d82-82f5-ce46f2f9752b", "value": 870602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527085, "uuid": "03b2031e-0f03-4813-a6b3-a8126a0f8aa4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527085, "uuid": "0b260d92-fbde-43bb-a88b-7199e16eeee3", "value": "Xenon-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8b1877-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492924, "uuid": "33a1161b-e5fb-448f-a0f8-a7bcb7fa2bdd", "comment": "Malware payload (Mirai)", "value": "630dd3f555b4a35ce2548489b0d86006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492924, "uuid": "5188b06d-ab33-4948-b018-eb3897fa90dd", "comment": "Malware payload (Mirai)", "value": "9ba93ebeb6d121165b3a121d8936196fd85cc9d1224b13b8c9ac9d7c7742c29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492924, "uuid": "ff7c9790-bc02-48c2-8772-5b737ef4768d", "comment": "Malware payload (Mirai)", "value": "65145d05a2a399dc6b2a7664d3d9e4a3e9245454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492924, "uuid": "1686889d-986b-4c1f-9e04-12c63f6d2717", "comment": "Malware payload (Mirai)", "value": "402b24e3d01511f9175feb4c4805373162cb83275bf5a7c4f3a988ec372658054ba19c37ea927d64e23492302260d430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492924, "uuid": "40222b80-1799-4b37-94d9-01fd1c476c08", "value": "T150F2E042C98D420FE07F15769CAEF24D0641EB5CB9C0B89789E1B07B5C02B0D6E5DB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492924, "uuid": "d82ce248-9265-40bb-b9a5-0981f97e2a78", "value": "768:1zbGjwng3vdO5994SKAT1M1bVnykwtYcCrV5cWRsdHnbcuyD7UHQRj3:hdnA4994SuTykwKcURRsdHnouy8Hyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492924, "uuid": "eaff6a2b-9335-4603-a665-8ef797f6d773", "value": 34888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492924, "uuid": "6fec5847-1768-42b2-8753-4cfb955e93f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492924, "uuid": "a8d66778-0e13-435f-9efb-4fe829917872", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21be5411-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474088, "uuid": "9e1c0d87-74a2-42ae-9b0b-e2053894decb", "comment": "Malware payload (WeedHack)", "value": "d5fee8d1657f4d5b8802ee752f5ed708", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474088, "uuid": "71b0c069-3f0e-43cb-b6c5-8b2e17cfe920", "comment": "Malware payload (WeedHack)", "value": "9bb11ba2f44b49ed2bbdedd950768bb506fd919e665710ad4a8852cb09a8ef23", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474088, "uuid": "4939e60f-1ed9-4351-a07f-5c8b281126d3", "comment": "Malware payload (WeedHack)", "value": "14dd6ef8f31a0e1668271f5aa7b0ae7e2248cd46", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474088, "uuid": "5f49ee41-51e6-4417-bc18-4225c23ff65b", "comment": "Malware payload (WeedHack)", "value": "0ba056826d45bcc77dd9329ac1cf0edeac78c3b5ba67da6a6d74a073ee6b59077656f535624683bace34745f6f6abc9e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474088, "uuid": "c3c2e430-dddf-4426-ac0a-20df48d1037e", "value": "T16584231A855449F5D7620E36B4C2AFF82EB93E225383EE16927229FD76D1345034CBB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474088, "uuid": "29d1b7ba-37af-4d95-af5c-e2272ae8f7a9", "value": "6144:eeRvxJM5hjuwYcsCkSalM/cM6tksCZXPHC+2SygTnmvopoI6B6Dt9NvB+wTmN0qN:hZch7uJM9zZXvC+2uyMp6BQN48mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474088, "uuid": "33710a01-f4b7-4add-9dab-89f5bd1e7df0", "value": 394375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474088, "uuid": "b344423f-0184-49ec-b75e-151d16a854f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474088, "uuid": "ecf0110f-f73b-4fbc-8171-5541aa152549", "value": "22qq-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed06369-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551312, "uuid": "a9398336-758c-4ccc-bdc3-f693314c2152", "comment": "Malware payload", "value": "ec4ec1680eff129e53371df4e6a6e16e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551312, "uuid": "db30718b-80f4-48eb-9918-23b08172a102", "comment": "Malware payload", "value": "9c00d480de8dea506b007fbb4da490034fcbb9199d696208d7ff762de9055118", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551312, "uuid": "3f24f73e-ae2f-46d2-96c6-c0b0381be470", "comment": "Malware payload", "value": "1f2dbf9dfa90bd3fe37e2e2af6fd8886e6cdffa2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551312, "uuid": "f53c2839-2f4e-4d03-a333-25d023834b12", "comment": "Malware payload", "value": "e194d049840d21ce5448ab3dbe5f3479475e899a92784a64ae5b94313d574bd66178b044f9e50bf0593006f2f10ca7ca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551312, "uuid": "8cb670a6-e982-4b73-a047-819452eea105", "value": "T1E984231000671B009A1F1EBC6FD5FD659F6427E3A14F10362ED215E73B6E5AE8F82BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551312, "uuid": "e364e7ad-1228-4380-bcd2-23d49748497b", "value": "6144:dsVJ9L7sojngxdGmR7dxiBu6JX9kxCA1ofRrOqcU7OESNCFH+pdPnHVSSabgfSQI:yVfL7gxdGmLxio6JNkxErSUBS0FHilHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551312, "uuid": "3451b77d-8a2d-40bf-be12-e12abac32205", "value": 384207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551312, "uuid": "1cd0c4c3-02e2-4410-854d-6ac95d45ed18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551312, "uuid": "9c458f54-7e00-498d-8139-3585d9db2cbe", "value": "Server-crasher-12.1.9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8d434b-3add-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776485733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485733, "uuid": "0f25895d-bd83-4084-a7eb-54099989bf82", "comment": "Malware payload (Gafgyt)", "value": "81d262344a4f6711a61e2e9ff6ef367e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485733, "uuid": "15e46691-80dc-49cb-b28c-d380123f7e94", "comment": "Malware payload (Gafgyt)", "value": "9dc5a09803bedff1e6edcb2fb8d490816e545cb4d0dfe238cd8410051db0fa9a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485733, "uuid": "866702aa-11d5-4502-a8d0-087f61b747b0", "comment": "Malware payload (Gafgyt)", "value": "7fe9573765b39e9114b18ab2772c864d5aa58c63", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776485733, "uuid": "5e40d741-b5f1-4048-9d81-fdf326425f05", "comment": "Malware payload (Gafgyt)", "value": "47067f5ebe4d7ed659c5b8642d65c47541f78772f4321e94e79c9cf08cfd111cc68756b65138f024ad6725f3ab3b8554", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485733, "uuid": "fa5c10af-e8be-4983-a4da-b5b7ae8d2102", "value": "T18DE3766E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485733, "uuid": "7ffe9389-b401-4b6b-80c8-5bc01ed30bb3", "value": "3072:AvtLZpuGPyaT/B5hKWEfSaWURxuZq+1uPNd5R:cQORB5hKWLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776485733, "uuid": "62a24559-8c38-47a3-830a-05fa0269101a", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776485733, "uuid": "425725ec-5ce7-4268-ba11-99f18858d3da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776485733, "uuid": "ffbfa37d-3995-49e9-87db-3876e29243c5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d128dcd-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474107, "uuid": "54c2e3da-151b-4a47-a45b-1d1283b8936e", "comment": "Malware payload (WeedHack)", "value": "2961777751ab28d1308a1ae6866bc341", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474107, "uuid": "e34eaefd-aa8e-4c9a-a99b-1f16b82bf63e", "comment": "Malware payload (WeedHack)", "value": "9eb0eef631b26c217eaaebcad68ca68bebad1e52a2b760a5e92b4cde77b6b0ee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474107, "uuid": "c708402d-47e9-40d6-a04c-bce26da23f8a", "comment": "Malware payload (WeedHack)", "value": "750e098abccf6e486856106f5ee56d70e6ad9c06", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474107, "uuid": "59c2132f-3b13-46ac-80ff-0fdf741041ac", "comment": "Malware payload (WeedHack)", "value": "97d7d3806362d1655f07d4278d485ffda07723c6117c855e55193e08a1518e46b69f0b9c7f28f37c49cb72800838592b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474107, "uuid": "93ad57a3-2ef9-4e3d-a54c-2e6f1337747d", "value": "T105A3F133E2DCA665E827C23DC4A45C787C890C785A5E7B1F28C2A5CF551ADEF2311BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474107, "uuid": "4e456412-28b7-40da-9882-10a1d4f3ab3a", "value": "3072:aR1ttfY4wP53ghTMd1Y+QhLZ8bHqLHr7Xf/QgtBC:E1fvwh3ghgnSLKqHfn/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474107, "uuid": "17d27fcf-346c-49ad-999b-d620fee9cc27", "value": 104405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474107, "uuid": "f7218aad-5089-43b7-b312-4a43896ad911", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474107, "uuid": "192fe1b5-871f-4cf0-8d6e-89fc5aa15d53", "value": "DonutSMP_Price_Tracker-1.0.0(1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1001909b-3b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505841, "uuid": "aedb8a5f-8897-40b9-80b1-36c3dbb62319", "comment": "Malware payload (NetSupport)", "value": "839ee34e96db5ac58cc4b8ed64a12c69", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505841, "uuid": "3d529c2a-dd29-461e-a0b4-6abbfdb16494", "comment": "Malware payload (NetSupport)", "value": "9f4cdebdd54e483a7f1ec4b05155e34752cae53d187008a016d53299bbe85633", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505841, "uuid": "2c2b33e9-3e4a-45fa-9d75-a9da9ecc7c05", "comment": "Malware payload (NetSupport)", "value": "5bdac2178fe6ceac3a8c948870d4c8f562c801ee", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505841, "uuid": "d3b967ce-075c-43b8-a7da-3fab22499fab", "comment": "Malware payload (NetSupport)", "value": "4b683d2c3fce1185cab67de14f2fee6b48a15e8ff93162754b87e0c4776434fcb1998fcb739d5153055a24310951b634", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lomtophamchese-com", "colour": "#8EAE98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ostlomtophamchese-com", "colour": "#E2E44A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505841, "uuid": "2e3a98af-8f1b-40f1-b137-c50a227b6024", "value": "T159416C2507E2171CDBB68A39A9F6B3179633B952FA524F8E514053481C24229E9A8E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505841, "uuid": "721283f3-959c-49bf-834c-415c6dbde73f", "value": "24:8sc36drlzoJHKkeWFhTXaAR8PWD+/CWP855EpnoFNSUwUkpK6+/CIab/68Cq+/CH:8/8yJVlR8zpoFoBcabCq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505841, "uuid": "8142a1ef-8f49-4b99-9027-d76d7bc25503", "value": 1902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505841, "uuid": "8620955b-4952-4102-8b0d-434bf676f067", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505841, "uuid": "6ced42d5-3e92-4654-9d88-76d43d58d261", "value": "9f4cdebdd54e483a7f1ec4b05155e34752cae53d187008a016d53299bbe85633.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885c6bbe-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488004, "uuid": "cfc0e29f-de1a-459a-837e-47991fe58d12", "comment": "Malware payload (Mirai)", "value": "85945e524d6a22369b69e46383d03abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488004, "uuid": "f3dda405-3e29-4515-9d30-b43e3b30832b", "comment": "Malware payload (Mirai)", "value": "9f527571d2586af8063e5a09227b3e4520b6c156462f0f947a5770a0bee1c984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488004, "uuid": "1c252b68-bfd9-4d25-8161-e917a9b93037", "comment": "Malware payload (Mirai)", "value": "87cc4f613ba2b1962f779636372ea4cd0dfeaa27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488004, "uuid": "b1d91197-9d35-4af2-a703-8800dbd55aba", "comment": "Malware payload (Mirai)", "value": "18f086cdcad25f5470a099ee97d564fed1b59a56f2c0bd39d80049a4f30e018824423f7fa3a617e9733a9a721941db6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488004, "uuid": "2cff8cdc-e105-4fa4-832a-fb435b7c97df", "value": "T12853F153DD129934CBB22CB1E6285B5274460B26CAED5C305688C6FAEBEF4C515B0F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488004, "uuid": "f8dad337-a99e-46d7-ae5c-2b00dba1c649", "value": "1536:kvoiB1wgkSLKUlOViVvlIcQPakZimrwcrQM:kvo4oSwoVORb7tQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488004, "uuid": "048fcb77-1146-4c19-9861-94bfbb19e926", "value": 65944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488004, "uuid": "62a85994-0c80-42b4-a923-6401174001ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488004, "uuid": "c20c8eeb-2fbd-4743-9b06-4f9036f4977d", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cb2b6f-3b0a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776505175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505175, "uuid": "25e63dbf-7882-4455-b88f-cf6bccaec4db", "comment": "Malware payload (NetSupport)", "value": "d306fc4f997c9b36ca04bc5d70af146d", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505175, "uuid": "1e52a1f2-0d7e-433a-b5bf-26babc01d08b", "comment": "Malware payload (NetSupport)", "value": "9fa5f8c29116bac6d352a2a3aac294e0597cc5cfaa137caa93a85d42a5ddfab3", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505175, "uuid": "51c41356-6784-4959-a6bc-d26110ef75ef", "comment": "Malware payload (NetSupport)", "value": "d14fe7ef29ded976836aa303b169ef5f5d71f85a", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776505175, "uuid": "2e9b91dc-a4fe-4070-b42c-1005ec92177e", "comment": "Malware payload (NetSupport)", "value": "48f914a29c17264ca5706565a338ccb5251bc76658637580f408faf1c0707c6685996165faa139cb39cc91b4761a9ada", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kislosflfkcjdj-com", "colour": "#CA2A35", "exportable": true, "hide_tag": false }, { "name": "losuinisots-com", "colour": "#FD0EC3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505175, "uuid": "9f0e81aa-edc4-4e08-a7ae-e984ae2eb86a", "value": "T150029E1ED7884C82E0EBF27966D08154C93AD6C44BE608461AF863C9BB82EF76635335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505175, "uuid": "b2d81d9c-ca69-49b7-a12b-b731ae5a23fd", "value": "192:HRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+9Lo9:HRm/wksuQJ/g6dI+92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776505175, "uuid": "2092ea19-b8fd-4f7c-9b0b-278ba2a38aa9", "value": 8993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776505175, "uuid": "1caf3741-8a34-4a9b-abda-cae7ee738cba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776505175, "uuid": "e59e3ede-b4ae-4087-ba04-1014e11509a2", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a237770f-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473015, "uuid": "6e0e5fe9-c585-4872-88ec-8f76d4debb8e", "comment": "Malware payload (WeedHack)", "value": "b3f0a69f4309fb93fdb6f2753d40915b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473015, "uuid": "33bf5a27-e6bf-4810-9087-f02ef573a348", "comment": "Malware payload (WeedHack)", "value": "a04c2f89cb5483bf3815f1e1d2e69653b9acb23fb3f87b5d22ea4e0aed05aa07", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473015, "uuid": "95d8e026-1dc7-4d2c-8ef0-359e2ba1e7cf", "comment": "Malware payload (WeedHack)", "value": "3bfe9f7d93cdb7e5bc3ad1e357fa342f9e6c6f6d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473015, "uuid": "8e415a52-5606-429e-841a-1d1a830f9b7c", "comment": "Malware payload (WeedHack)", "value": "dea5dea134f93df6c5c490586698feb5586eb2d8610dc35f220cdfc9b74d6a606d83e0d0b1752d0c0ad57c07af147247", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473015, "uuid": "b66fffbb-53b0-4054-b0c8-080ecd91da1b", "value": "T1BA8533137B33E985F69765F29E9E4EC3BC21226DADD703D48C5006C6876C6E8E74CA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473015, "uuid": "fcc251e9-9949-41be-b68d-350ffeb25fee", "value": "49152:gqnMG17VTKtawSug9PO0ztRndT4fjl8yfvjX1F0mpa:BM+7R7wSugo0ztRmJ8uEya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473015, "uuid": "5e3ae7e8-0321-4827-83cf-bcd2aeb385ed", "value": 1777171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473015, "uuid": "32e5c26b-5658-429c-b95f-67173db94cb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473015, "uuid": "dce8710a-58cc-4a95-a5bb-977cdbca88fa", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57df5536-3b73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776550200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550200, "uuid": "e2d8609e-1eaa-4b6b-a66e-e7429c200827", "comment": "Malware payload", "value": "34073aa5974f92f68938f3548835738c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550200, "uuid": "9eb1b514-15f5-404a-92c1-37ec26bb80d6", "comment": "Malware payload", "value": "a1c784bca8a639dd77436244fc16dd5808ac01f0edd8560e8a01c166db238760", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550200, "uuid": "c448f84f-7462-42e1-9f0d-195be0dfcf74", "comment": "Malware payload", "value": "f7cc809a3822d2b5885f6c574e9c048720d428a1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776550200, "uuid": "0e343483-06b8-4165-be39-c3339ed19c5c", "comment": "Malware payload", "value": "9613193cb6f94909ad0f4cd5b55013fe03f7d206613396c287c256bccfdfdfd8e488acba332e70763a8843447cd5de73", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550200, "uuid": "60325da4-f5d2-4d8a-808f-3d08897e487f", "value": "T13BB2D014F056B101E2CBF6B4E9002C22BFAD9750848B2A090CBCA527375FEBD4B577E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550200, "uuid": "f08b098e-e25f-43ec-995f-a5577c3f82c1", "value": "768:M9nr/7fKfLtCTYWQ6a3hJ/9Fb5FwlfdcXKkPnYoHy7E:cGaYb1t9N5AV8/YMyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776550200, "uuid": "a6b16af0-5b8d-434e-89aa-bc4367779e26", "value": 25670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776550200, "uuid": "b4a56634-a271-4669-8e28-a62241721e26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776550200, "uuid": "228394c7-78e0-4b57-bcbe-61ceac1e6ef0", "value": "a1c784bca8a639dd77436244fc16dd5808ac01f0edd8560e8a01c166db238760.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b532649c-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476913, "uuid": "abd5fdf5-9e86-4771-9614-8380fde594fe", "comment": "Malware payload (Gafgyt)", "value": "ba7ed3c283c7e6db1ebe2e4cda1037f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476913, "uuid": "e6b3b74a-1fdb-4de8-80af-c2a19996825b", "comment": "Malware payload (Gafgyt)", "value": "a1ff3a7eb9e3f77487a2b92a4fa58cee4220726bc4e06547e0a49707af6ee1a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476913, "uuid": "e340cf94-d20e-40b7-ac5c-162b5a8a28f7", "comment": "Malware payload (Gafgyt)", "value": "643ba3f28faa7b9491b0284791f14ed98116c73c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476913, "uuid": "d9f872a9-66a4-4c0b-b7d7-fe9d58e1e474", "comment": "Malware payload (Gafgyt)", "value": "8292d4a5df5c329a37b87f7e130109a21cca05e3ddd61f184040a03cfa23fdb2348c980f0560b78cde0f26961b1418bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476913, "uuid": "3dfcc3d3-2f4a-4736-8ce3-a2d6ac849c1f", "value": "T15EB33A0798615F77C045ADB529AB5530072BBA120F4F1F99B57CAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476913, "uuid": "6507530c-e154-42c3-902e-5f4080e35999", "value": "3072:btTQn622oNI8zpUS5hLwtOCwLkY0Px9gQNfR:btc6Vs/US5hLwtOLLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476913, "uuid": "6c88f3d2-6cc7-4b42-9087-852f9bb48166", "value": 108415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476913, "uuid": "fb87da23-6bb4-405a-a5c7-ae0c85705c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476913, "uuid": "f339d8ee-df1d-4935-885e-51bbf7f4174a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf713da-3afc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776499204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499204, "uuid": "149ed3c2-8dbe-4b2d-8db1-fc643ac3a52b", "comment": "Malware payload", "value": "6cab33d43dce47eed3bb94515fd62873", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499204, "uuid": "825c3e6e-7715-4a82-b2ec-e1f600b1b31b", "comment": "Malware payload", "value": "a4ba25ffaf428e97a24ebe9cfe443263534cbb52887c423ed4cf676709b6ed35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499204, "uuid": "8767c930-13d6-4095-a376-d7116c83c57c", "comment": "Malware payload", "value": "7d80be91c0010792659563e2a2c513e1b92f8ad7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499204, "uuid": "bab4c3e8-3a98-4779-a64d-939e9603b810", "comment": "Malware payload", "value": "1225979d102d4922e0bbf085eb1c7eec97d47aa452ee9356af84b4786463f336719b2abb1dd6e4a283f579c6ad491ea1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499204, "uuid": "7ca7722c-dffa-41a2-80d1-70cd90819c8b", "value": "T1F693F69BB61D1BAFC65B5AB128A717F0CF6DE460019A51C6B50DEF8003F29702863F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499204, "uuid": "679d7aa5-0a34-48d6-a935-a207a16cb06f", "value": "1536:uQ81xCmJ6fWua/8/bReN6dGQUsg9IPUGGV5dRyDl481Ngm1jT2q2I/fjAoc:u71MmJ6fWua/8gNlLZIPUbyV1Ngm9T2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499204, "uuid": "d66ed6b9-78ac-4b36-a7fc-0a21849759e6", "value": 97622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499204, "uuid": "28f484a9-1da5-4d3c-aaad-639d0f7079bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499204, "uuid": "3acad0e1-2499-4167-adad-1d3c352da0c8", "value": "Demon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d735258-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488013, "uuid": "2fafc450-6678-4c93-94f6-27b81b6c6746", "comment": "Malware payload (Mirai)", "value": "ef06bc022916f2b4ecd83ba4b1ec0038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488013, "uuid": "b855ee9e-2aa0-4ee3-aa9a-2653e5a1cb69", "comment": "Malware payload (Mirai)", "value": "a4bbc410fc3752c682361c797e006a1a35ee6feb0f8a1d6a9d451482e1346c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488013, "uuid": "4f338545-b070-4a59-af79-af9ba1482393", "comment": "Malware payload (Mirai)", "value": "27a567e7fbfd60528bb9e2fc210b722163165fc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488013, "uuid": "8727c867-73d3-48a6-bf8c-0778b304f9a9", "comment": "Malware payload (Mirai)", "value": "199c5020655709e05357a56aef8ef61a4ffa461a094da48334efb7764e8168f7b9e80716c1c7b4176aac761becc3c3c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488013, "uuid": "dc4d024e-e3f9-4a26-b165-ad46b9c1ea26", "value": "T193246B43BB868FA3C225BA7449F386785AD92B0B0AB3C4D7C3755B0167655A03C2DFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488013, "uuid": "0a67282d-887f-4043-9a0d-0b6d90288443", "value": "3072:7gw1q0oExAqvBbjAJibafBCJN5UGZAjY6116IahgdzM+w1qgCK95F2MWoVj0Y6+:h1qlE/BbjAJi3JPUahgdrwUWrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488013, "uuid": "250c8bc5-2876-4396-914a-0fe92c45737c", "value": 218160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488013, "uuid": "01772c37-4015-45e0-99d3-7b8d5d50b395", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488013, "uuid": "1c6a581f-058e-4044-ba09-cb9174027484", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11307bad-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492959, "uuid": "6072fcb8-da01-41ec-a85b-7bcdea4bf0dd", "comment": "Malware payload (Mirai)", "value": "98513d5f158f2ee876b489d62a7cd06d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492959, "uuid": "42773fbe-fe5e-4ba7-844b-d8236ae0da3c", "comment": "Malware payload (Mirai)", "value": "a4f1447444400a39d398a8b1fb00a5c730db1c125ce774a5ca765fdb9d583059", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492959, "uuid": "b0a19d53-82ad-4dda-a859-705a72d7f471", "comment": "Malware payload (Mirai)", "value": "b19127a3796ee58f66b74989e4dec96f6989eec0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492959, "uuid": "769c5205-5a16-4ad6-8584-97e15fb33de1", "comment": "Malware payload (Mirai)", "value": "2e214d8be1af9d8f60a6aa92017d96e607c9d4469cc966223cd9731f45874b2ff1230cf77ff2f6680007496fcef9b4e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492959, "uuid": "d71e8b5e-4872-44c8-9dc0-c2a87def1f37", "value": "T198734B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492959, "uuid": "c55eed60-dae7-461f-b5bc-2ed7ef527713", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vNM:uB/VBBpCO72RDRZNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492959, "uuid": "8b260582-c83e-4571-89b4-aa8666d7c54c", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492959, "uuid": "69d61dc8-ab84-42e9-a3e2-5122597f5e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492959, "uuid": "db03701d-620f-43f1-b9a8-3dd52f4294d6", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5423dcf7-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776493071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493071, "uuid": "027cb96b-73e9-4ef2-82dd-e4a814509cd4", "comment": "Malware payload (Mirai)", "value": "939c1971bf026e54481350585ae72ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493071, "uuid": "a74a92c3-86a2-4bd3-9643-4049a4e43ed9", "comment": "Malware payload (Mirai)", "value": "a5aecb793b9fab5bcb4b9e654efb7414f4e40426331f260fb4ab75e29f7f3649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493071, "uuid": "bf06fc2f-5808-4401-9b79-ea69295fb7e9", "comment": "Malware payload (Mirai)", "value": "b27e76fd94895c70cbf0158c57ec657d74a2b823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493071, "uuid": "52f5abb9-7270-423a-b90a-7710dca258fc", "comment": "Malware payload (Mirai)", "value": "551367dfea2d315ef2a8f2e6e9a97b80d2bb7abbba93b52a094d7f879cf3e49368c13d5da31dc52389ca0d78bf699d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493071, "uuid": "cfeeb4fa-35c4-4f68-96c6-81dc612a974b", "value": "T14A83185AF8814B21D5C512BAFA1E164E331307FCE3DE72239E24AF7137CA51B0E6A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493071, "uuid": "18f3d2c6-b810-468e-bc67-c99826c77dbb", "value": "1536:GpnQQmY6CpD2sAKv7isPtBBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtb:4m0D2ym4EZCSHYMactW4Bi9gnS4V0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776493071, "uuid": "ca218c04-f23d-425b-a2e9-83ac370cfc71", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776493071, "uuid": "0987015d-b350-4ae9-983c-0f402bcd5c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493071, "uuid": "16523927-5f79-4a37-97a5-4d1696fd79bf", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a67e76-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486310, "uuid": "adf99206-fc30-465e-81d3-178805f4b42c", "comment": "Malware payload (Mirai)", "value": "3c5bb5603f9199c4ce6e60584a164831", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486310, "uuid": "fffacf1a-0ae5-4bb4-84d2-7d02b49bf7f5", "comment": "Malware payload (Mirai)", "value": "a79620f0e5ad74df8db5a278e364c7b10ca2b4586f6dbc4d5df49faf4bb8e9fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486310, "uuid": "7b0546c2-0dfe-43c8-9404-f2f054b9b080", "comment": "Malware payload (Mirai)", "value": "c53648b6b4755a73cd928dcb81f0228a01affdb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486310, "uuid": "38b1cead-995a-4341-aea5-f9127b920b87", "comment": "Malware payload (Mirai)", "value": "5101dc3133c58ce41d9e48202d38f3f4d7e6548cc4fbbf246ae2d37e02c7e39842b76fdabf3ccf3dda7f03cab36e3399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486310, "uuid": "becf8236-eb65-41bf-ae79-ed4dc8700332", "value": "T176432960FA53C1F0E44305B0016FFBAF5B36B9A60235E5ABEBA53932BCB17910C5295D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486310, "uuid": "05fe94cd-9991-4d68-8b45-c8a946395965", "value": "768:Qo8F9YrG3GXD+ydXvAb9D3t5aJJi3+t0kkMgmB6Zv6i3g/jWPsg:Q1F9Y3z+kvAbB95UJi5Jo6ZF3g7WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486310, "uuid": "24fac0e5-0f43-4d33-bd7c-41d9857f2322", "value": 58516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486310, "uuid": "9afec8f1-2efd-49e0-b703-b50d1e831fbc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486310, "uuid": "ba8310e8-3ac8-4e22-af03-6231762d6ee7", "value": "alyssaai486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd029c-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776472993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472993, "uuid": "ab027c67-7cb2-43e8-9573-77a19b8b78be", "comment": "Malware payload (WeedHack)", "value": "1c7ff17b47f0b7d0565400d779ab0423", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472993, "uuid": "44fc691b-5cf4-4422-a99a-e1de4c1c6fc4", "comment": "Malware payload (WeedHack)", "value": "a7e6af50d78cf73d7e152842ca6f487a86f4f872f0fd1d0ec1875b020fc2bd77", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472993, "uuid": "edcdca23-911d-4786-916d-7187da762077", "comment": "Malware payload (WeedHack)", "value": "3cf4858a41a06d4fb9555ac458e63edfd56c0d8c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472993, "uuid": "4502331d-2abb-4224-a3ba-943a488cc8d9", "comment": "Malware payload (WeedHack)", "value": "a0747934a632e985f134aa09eca0f5554ba7e4e0d14e3730ba40711add1808f5cd6a502e5124eafc4e465810289b147c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472993, "uuid": "8eff5c58-0f06-4e03-b829-aa4dbd97ea1c", "value": "T109930234A131A431C088CBBA260F6960B49B1A5A5ECE6C57147A42DACBFF47EC7097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472993, "uuid": "d148c0a5-2c45-456a-a22c-1ee18caa2719", "value": "1536:QGzRncrzPbPfH0iG0ihcyYeFW+ChOOtNaQwigB4Xr2xSiAVowzCyImTuW3JVdo73:ZcrzP7UyihLYeCcQwckSFA+uWZU7YlYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776472993, "uuid": "0699186b-4743-4c61-9caf-d572f2f89b4e", "value": 97504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776472993, "uuid": "6d8a1bd8-d432-4fd6-b512-c91f29ed3e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472993, "uuid": "08bece52-0058-46c1-8a7d-c983a97eda3a", "value": "DupeUtilsV2.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f31abbe-3b13-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776508954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508954, "uuid": "0ace9247-7822-4db3-8071-500ff34441cb", "comment": "Malware payload (Mirai)", "value": "35ce258957630e446a94f94bb637ffa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508954, "uuid": "a0bda9ca-f2c4-41e6-8f31-161eeacadb72", "comment": "Malware payload (Mirai)", "value": "a84038d113e6fd3153d84a20a05fd5c64eb2a2daa47fbdad51b025836afd00a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508954, "uuid": "86c1f922-e642-486e-9065-2f3c774940a6", "comment": "Malware payload (Mirai)", "value": "0f9c03e6ad23534657f7f008a5b74a328f59d352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776508954, "uuid": "3b971477-8602-43bf-a5a2-45cea535edbe", "comment": "Malware payload (Mirai)", "value": "c907e26535185b2823ab254e7d93c14305a9b0758538bfdd558693627ffdb8018ae41a3ee5e2572c262875fa716d5dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508954, "uuid": "514a19fb-c241-44d6-a01f-044333c3e6d7", "value": "T194144A41FC819A27C6D522BBFB6E418D331B27A8D2EE72078C255F21778A85F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508954, "uuid": "862e289d-1951-413a-820e-af818576803f", "value": "3072:gIVgrQpGHmBPmZEef6FInqh4fv6QuRuVNOUgJA:gIVKH0mZEG6Kqh4fCQwiNOUgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776508954, "uuid": "754e2c2a-6aa7-477d-b00e-57463e645d4a", "value": 198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776508954, "uuid": "3ad5001c-3d8f-4d45-9a87-7fe57de1bbbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776508954, "uuid": "bbf55fe7-8d16-4f4d-85b2-2d02e2badabc", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f8cd21-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498062, "uuid": "782b4fc2-827e-4b81-981e-395997ce0f62", "comment": "Malware payload (Mirai)", "value": "d93460c3c8c8a5a576fdc9383493995e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498062, "uuid": "2c1f8450-e291-4394-b8b2-3929c289e48c", "comment": "Malware payload (Mirai)", "value": "a8907443145aba88079cc2042b714b0a22cdd32ef4be3a376097d8de569f4a3b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498062, "uuid": "4f3475f4-3cdb-4be0-93f6-848735c4dc15", "comment": "Malware payload (Mirai)", "value": "d755aee7a634a92e1e93f97b1b7893f9ab5fb1f2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498062, "uuid": "a5e1c58f-9ae9-455b-a464-09540e8aec67", "comment": "Malware payload (Mirai)", "value": "948e8261d269e2d62774abde8183b15e34a0d07d48d3023147e180f30c74822727ade3c00542a7a6b31002c460ceacd7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498062, "uuid": "15d64fb2-2923-4b32-ba74-aa96460e75c8", "value": "T1A3141A46AA404B13C0D627BAF6DF42453333AB5497EB73069528AFB43F8679E4F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498062, "uuid": "98b6c0ba-64f0-4ef4-8c13-c84a5541d617", "value": "3072:e0F3bNNHJBbWICaqUW0hFOOS5vFNG7T3Qm7Wo2M/REQSm:PHHJVFCaqUW0hFOX5G7T3lf2M/RHSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498062, "uuid": "98182b91-d3b3-4cee-bc72-0aa654c5330d", "value": 190651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498062, "uuid": "33a0faed-8562-4f99-84ee-d74073102477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498062, "uuid": "9f9c7a85-d0ad-4437-9e7d-958c43f1d641", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38cc1ec-3b15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509954, "uuid": "04a1e3ea-c0e3-4ce0-a4b0-33700c18928f", "comment": "Malware payload", "value": "39fff1f1eda0c54dc106be2ce1aca772", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509954, "uuid": "ca09e887-c5d5-4d5c-a17c-be95269b5ad4", "comment": "Malware payload", "value": "a8f92e521b958cc8c702ee5eddfeb77b571de2b4c23f88de69949a419956432d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509954, "uuid": "e2da05b0-6635-4917-8b8c-3788038b3042", "comment": "Malware payload", "value": "e349a30b27e67e59255f1dec14a09e000e1431ac", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509954, "uuid": "ddef6ddf-4de7-4fa3-b932-f87b114bafe7", "comment": "Malware payload", "value": "c968eb26b2527efc2287f038f1f8aec1e7a2dcabf954fe241f950ebc9046389798df28d6ea3d9d20ea9245f9c4fae443", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509954, "uuid": "f82a297c-91fb-40c7-b897-2853a2a4e0b9", "value": "T10A335DCF11F74B632DF3D81A9A008EC67597F89862F7D99A004568D422D5C36CE89EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509954, "uuid": "2f433ddb-378e-4bc2-bbdf-d9ee8d1b9db5", "value": "768:41AHDJ1tjFiGRgjvXMUWz2e1eC8LVjZDa5aTK/kek4gZrPMO6xsHZ7k29yeoTPtf:4u1XQGmW8Rs5L/khP6SyIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509954, "uuid": "37588f3b-6db1-4d88-95c6-b38e55e2c151", "value": 53288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509954, "uuid": "9616978f-8160-4777-8b80-18fae92246f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509954, "uuid": "2b4ec06a-3250-4309-ace9-efe52d2718e4", "value": "cnpaintequipment.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5ea736-3b7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776554239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554239, "uuid": "e5ddcec5-a218-4cea-b5f4-20a3afd99a2e", "comment": "Malware payload", "value": "fc6392ea3466958ba429d04db148ea0d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554239, "uuid": "257b06c0-bdd3-4be2-bade-0d195b3f72e1", "comment": "Malware payload", "value": "a9ce65ddd0d2f90efea81542a916e8ceb8f9980f76e0033bf048263b2c94ec7c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554239, "uuid": "052fdbb8-b9d9-4b75-b09c-5c7568a86088", "comment": "Malware payload", "value": "1b60be219c50333f2fec2276425965f20ca0f51c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554239, "uuid": "6c1fef9d-3224-47ea-9fbb-e6c60f765f35", "comment": "Malware payload", "value": "685fa5216dddbbdc77c1818cb77c60374019155c77bcc8416eb54f725a1d021f8cf20401060c017c7990f8586a89ba45", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554239, "uuid": "62b99d9b-e523-4946-88d6-44d27607818f", "value": "T1AAD3E0E84D9ED8B48B4F6425055F6C166A8DA213135FC891BADFDE80BF63870B0BE4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554239, "uuid": "288faa05-a922-4efb-8d37-ea319b9bef65", "value": "768:grBWZdPjx+uhe4A74xPNYcblRLT+VuG4AY5hP+FPaHpyPTcgmLB9oXcmRGPnxofr:8BkdjAFOV2nofP6tY3Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776554239, "uuid": "e0f6c938-4c0b-46f0-8ea3-2d8c48659f0c", "value": 131812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776554239, "uuid": "0a223058-95a3-4781-a5fa-bec3a006a74f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554239, "uuid": "0cd8e147-a580-44b1-a3a7-2ed559ee4785", "value": "Global_Invoice_Updated_8861.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabb3173-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492894, "uuid": "cee2fdc6-6235-4db1-9658-5a367d976e66", "comment": "Malware payload (Mirai)", "value": "d6a691e21ef8e707cbed52580f57e0f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492894, "uuid": "a8aa8955-712a-4a45-9b8d-8039e5b193e9", "comment": "Malware payload (Mirai)", "value": "aafe966acd67a746027f1a5ac41b6da478da30c0de165ba85fabaea94ad39f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492894, "uuid": "ef374971-4f31-464d-8e16-425e4c7029f1", "comment": "Malware payload (Mirai)", "value": "a6d3ff9807b3163227ce18cafd47735c38fb44f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492894, "uuid": "f29a1a05-d867-49c2-9196-e9af61ea03ad", "comment": "Malware payload (Mirai)", "value": "f33580c1fe0d4595a5811c2daa12c30c692e57b7dcd4f6830ffd86b124b8edebddec11f71750437bec21bc6acc512e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492894, "uuid": "f8e5b894-cbd1-4a8c-bead-5d4040984206", "value": "T10492C06F946090C0D5619437E6F8CACBA2BA1BFDE3E430A103A99A2CF761684277504F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492894, "uuid": "c4b0fbfe-4093-42ce-a3db-6e039d19e12c", "value": "384:v3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWD4szZE53hymdGUop5hts:/CmyqM7zLnmZQLh+IWfdzFG/QPDJzZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492894, "uuid": "e35fbdae-0cf2-4077-8e1b-e52a15236e8e", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492894, "uuid": "895a14de-d449-4f77-a0f5-ce8d17b32f6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492894, "uuid": "bc44b24f-d28c-471c-8f18-18dc9cffc932", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0f362d-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545483, "uuid": "f885611b-c70a-43dd-b03f-e02f48ecc545", "comment": "Malware payload", "value": "1418430500a8b534359e08b9ff2cfea5", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545483, "uuid": "3073244c-2f5f-483f-a54b-e1d051a8edbd", "comment": "Malware payload", "value": "ab78ed059944a9bbbaa1c123a02d74e81db77507fa8888273be4136a521a6aa5", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545483, "uuid": "f265e649-d1c8-4956-94e4-2ccc5a7d3160", "comment": "Malware payload", "value": "6388b253528f31b04cd426240e8819fb7d313448", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545483, "uuid": "c6d6732a-bca1-4d89-9362-64d33e44c1cb", "comment": "Malware payload", "value": "23dca588c9473bff4108526e09a7f75f26eb8592e8b5856b8112e043de769f8dc8b28bafce7dfb2e6f71fd0201ff221c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545483, "uuid": "84289dd4-e4b1-4379-a474-c18b4cc0ab34", "value": "T18E57334BD4A14ECBE5396031C073E8EA6561FD461A834936B394BA26BAF7BF13374305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545483, "uuid": "e71cc199-995e-4557-babc-fe6e594348a0", "value": "786432:JdIu4r+t4+CvLtqDelwf6lFX//atIytCBvQu2YHtL90J:Uu4rI4ncDQO6nv/tytD/ct6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545483, "uuid": "44df659f-fb6c-4cc3-b23c-0606dd843876", "value": 29605888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545483, "uuid": "0c014456-8e0e-4826-bc90-ad48f69afb91", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545483, "uuid": "e6e15269-e245-43b3-ba70-952d89f14e8e", "value": "RivalMods.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e752a8-3b7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776554242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554242, "uuid": "9b1ba126-ac82-4fbd-b05a-91034e91f304", "comment": "Malware payload (Mirai)", "value": "79e3b6dba62f20ec2f8d0c6758967582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554242, "uuid": "bebfc278-0b12-4482-a8eb-5d13b92a608f", "comment": "Malware payload (Mirai)", "value": "ac34187311be27103b09fd93c3c8503f00fabe726c3ea2355a83210b6a7d4426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554242, "uuid": "ab32fe9e-eaad-46fc-938a-b96b4bd5b535", "comment": "Malware payload (Mirai)", "value": "1faf483d18a50093ae0f51194ddbb7a16e209324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776554242, "uuid": "f06e0a20-9b09-4089-b375-3e90a463ae4e", "comment": "Malware payload (Mirai)", "value": "f3e28f265d362d84f27bf8283975998c4b56675126dd74db9a4227a73d5111773aa652467da0bfcb6e7f50031469a5ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554242, "uuid": "0177b524-30f6-4437-880c-266c058be961", "value": "T1B7D32B46EB418B03C0D22775B7DB42553323AB55E3EB23069528BFF43F876AA4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554242, "uuid": "b5743f90-f265-4e20-a65c-8e615e363579", "value": "3072:AlCFj8oz5X9vvu/7a07mMHDwjfh1M/9RAtxHJB:AlCFj8oz5X9e/7aUjwjffM/9R2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776554242, "uuid": "c3017660-a715-4ff1-b554-05717bf8cf2a", "value": 136166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776554242, "uuid": "31e77d41-44f5-4787-b434-a11c988b88f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776554242, "uuid": "1dd28e91-e033-49dd-9439-dd05bf2ccc43", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981820e1-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776533987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533987, "uuid": "89255386-9ee2-4869-b0a8-ca98b9c1cd24", "comment": "Malware payload (Mirai)", "value": "880d819bdadd8c3f836f68d3fe439bac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533987, "uuid": "4a81e37d-d9fc-494c-9d6c-c62b3b34f94c", "comment": "Malware payload (Mirai)", "value": "acd0712ea85c759020b448cf8344b7cee72b646cbc8e96eb53507a83463ee340", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533987, "uuid": "9d5b5d08-0f65-4dcc-97b8-000b40bbfe39", "comment": "Malware payload (Mirai)", "value": "005d6f0845e396fcc5b1fe2f20ef4602eb8e2059", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533987, "uuid": "fefcbf05-aad7-495a-a821-88ff0173a875", "comment": "Malware payload (Mirai)", "value": "4f23450cbdd332c53ed416e6b75cea590086a5f4df61067876f8755fd9bb7fdbd87e49206f458d16b72641bb990f795d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533987, "uuid": "2c0f933a-4d60-43de-8f6f-cfebf1786bda", "value": "T1E4643A8AFD81AE25D5C126BBFE2F4289331317B8D2EB71029D145F2876CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533987, "uuid": "e2e18779-8598-4235-85c9-6198220ef97b", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJE:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533987, "uuid": "56fb679b-3ccb-4039-8440-db97bf2bcff8", "value": 307961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533987, "uuid": "ae234204-a7db-4774-b3c6-e08c7418edb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533987, "uuid": "99f7a839-5d1e-4e92-aae4-c47183058b26", "value": "acd0712ea85c759020b448cf8344b7cee72b646cbc8e96eb53507a83463ee340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806b0e13-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776487991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487991, "uuid": "28179095-88c6-42be-9201-ed4e1a79d35d", "comment": "Malware payload", "value": "d75ea4b47eaf4f884667836bebd2f5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487991, "uuid": "bdc22c16-bd61-458c-8d75-1bb7e0356ede", "comment": "Malware payload", "value": "ad5819ebafc6590e5296df4f439c57d3e7f9f95b3376920a1060446457e5329e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487991, "uuid": "1db02c29-39fe-46a5-9315-4f354a0cc096", "comment": "Malware payload", "value": "684cda1faf1d9fa6cfdf1f31659a6945c4c8254d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487991, "uuid": "d5881b66-dd23-45b5-b823-52a814bd8fa2", "comment": "Malware payload", "value": "30ea2c59c9ea13cc6179c97c031f21b50dd01a340fd044f962ca5331a16b42566d800d6dab5e6f94642b904769c359b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487991, "uuid": "b4399d9f-a69c-49e9-88b9-ae9b939faf75", "value": "T16C83123642F5D8B1E819913F879583C87F37E5180326835E22D7A2FFD189D07A354BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487991, "uuid": "79206979-4758-451e-b246-eeb11969a5c9", "value": "1536:gUthA2poo3cqL/2L8o29kcDWvtBtUyZKF3rYSTO4AKCGTAH1Nvvb4i:B4vs/GcSOW1H1Zw3rnTlAKCGsVNvvb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776487991, "uuid": "c0ee5d7b-0a85-48a1-a51e-db7eebf089a8", "value": 87824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776487991, "uuid": "255d9038-0afe-41a4-bbc2-f29a3915863d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487991, "uuid": "25d9fcfc-0305-41de-97b3-2076634f9dbb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c7086a-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533802, "uuid": "d9883189-ab3c-4459-8a7a-c0aca1800959", "comment": "Malware payload", "value": "2383a08482c4d26512597cc142c3511c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533802, "uuid": "cde43e98-1bf7-4f6b-a2ed-f2e4b09c4327", "comment": "Malware payload", "value": "ae7e743fb729d965f8471da1661dc8bf2cb614f3ab611ca158b7e0a76a122880", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533802, "uuid": "17eab33b-56fd-4b2b-9d9b-3cec7747a8f6", "comment": "Malware payload", "value": "5f6c76a3e807e66564fbe31c92b33bcb5dbcd4cf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533802, "uuid": "233867b0-084b-4e1f-be33-38576763d161", "comment": "Malware payload", "value": "dec173b35444e5e97e5fe2be7df5fc1ec46e4acfd3c4c4c60d8b8931ac26320edae262b64c686aff5cf11985805f143c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533802, "uuid": "a56c9e61-84b5-4965-ab74-646f5efde2a6", "value": "T177F6025CF74DA82FD9D270FC4D5A02A6612B3C891B11D2953C51B60CE9B37E84F2ABE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533802, "uuid": "baaa3dd3-49b2-4bb6-a6f2-1643b757d62c", "value": "393216:YtY6pQvrigE/7dHbQ/adiwJTK3+8wsifFP:YtYasmVRXAwJG3/ifFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533802, "uuid": "dd1868a4-2588-41d8-8858-303943e9e895", "value": 15653191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533802, "uuid": "c1f8e534-4263-48a4-913b-bc2be2c0dc93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533802, "uuid": "7ea8406e-950e-4c25-b380-f2494270bdcb", "value": "Max+Cleaner_1.3.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bd71d6-3b05-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776503006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503006, "uuid": "087eff10-f225-4884-b013-6089bf8c2b19", "comment": "Malware payload (NetSupport)", "value": "a29c304f48d83b0c4c84964b64533de6", "object_relation": "md5", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503006, "uuid": "afd10ac3-16a6-48b8-a789-b7f43667f883", "comment": "Malware payload (NetSupport)", "value": "aea26874c60941626341d0e1a37e22e35d342c9887e89e17350def4cdf266065", "object_relation": "sha256", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503006, "uuid": "27d8baa8-da67-4284-acd1-e2c543a3b798", "comment": "Malware payload (NetSupport)", "value": "939843db11b37d71d26ce56c22e5be49d1c9ccc4", "object_relation": "sha1", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503006, "uuid": "6d3ea482-6ce9-4b81-b808-e4433424fbd2", "comment": "Malware payload (NetSupport)", "value": "b55044a1f46bf5f0f5f2f461cbc1055ff1d24f4ddf58d9d8fa26faf55868a042bf4926180d46740fd2913330dd9f14da", "object_relation": "sha3-384", "Tag": [ { "name": "91-191-209-26", "colour": "#401D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503006, "uuid": "586b4a81-a8f0-4443-9887-656d73a42541", "value": "T1BCD5892829A0F797C8381A31D822BD399F116E58F337944A257BE73975F0B31653B293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503006, "uuid": "7f68d082-8a5f-4a09-ad61-6c8dd7e8b281", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503006, "uuid": "81482825-5f5e-46d7-bbf9-3e0afd4bbcc4", "value": "49152:DhgW+I+MTEMOnJaYh+DVJ4RUWO3ihkDPD8zFKiYdWWM2ZF1VcJjf4fQj:DhgWUcrOnJmb4vFaf8zAFWuAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503006, "uuid": "884c5c62-cc3d-438e-84db-e82f0600b0d4", "value": 2966439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503006, "uuid": "948e9d3d-4783-4ee5-a5c1-ee8e1ebb2016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503006, "uuid": "618b7bfa-b4b1-4658-b729-ab05befe93e0", "value": "aea26874c60941626341d0e1a37e22e35d342c9887e89e17350def4cdf266065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709ad209-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776527049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527049, "uuid": "418f9d14-92e7-42e5-a379-1bf9370227e6", "comment": "Malware payload (Gafgyt)", "value": "6cdf4f978722067925d94ec2a24c3006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527049, "uuid": "4828e225-de6e-4507-84af-9de6d7061c8e", "comment": "Malware payload (Gafgyt)", "value": "aea7bba2d7b88d0108c4ff27fa7a85f260ace6a51ee8ce45dad3a566704513dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527049, "uuid": "1e2b36a1-c8c5-4323-9f1e-92fbae813c97", "comment": "Malware payload (Gafgyt)", "value": "aabed0a63d5ef7281f845e07499f7677e4eb22a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527049, "uuid": "dbe81d4c-3b23-4d56-b452-dd04ab1a024a", "comment": "Malware payload (Gafgyt)", "value": "095dd45e2e483d55a7d6b901ad6fad84e73068240c49c4c629ccafca7c9844387255e056e39afd3194312c2faa97991d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527049, "uuid": "578466f2-533d-4b49-9d70-1d365654b785", "value": "T196931A9BFA02CEB3C41310F112AA9F219D71F9FB4827E642E3646DB4DD151C26A15FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527049, "uuid": "40bdc180-24a8-46ad-97ef-b359593e37f4", "value": "1536:mikcxDffsiqU6s7ck+LWQw5+QwSNg/UVE7bnVCMquoJ33mZTEgV:miH7qU6sXjUINgUVE7bVCM+J3WZTnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527049, "uuid": "39afc5c2-540f-464f-a041-11abc4968207", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527049, "uuid": "3ea43fe8-37ee-4b1f-8e67-c9cfdc22a9a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527049, "uuid": "8a4242c8-604e-43c8-89c8-abda378ec4fb", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca743b5-3b0a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504977, "uuid": "b00a152b-3661-4097-ada1-baf3f1898a36", "comment": "Malware payload (NetSupport)", "value": "d04e3c831e3b0e46b63db01288e41a2d", "object_relation": "md5", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504977, "uuid": "9b85b870-1db8-4456-96e3-c18b3361f24a", "comment": "Malware payload (NetSupport)", "value": "aee87d6f748601a7f9b52411dac6f13ad90b57c5cd725e80bf05024322c6abed", "object_relation": "sha256", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504977, "uuid": "0d10c5f1-9eb9-4a9c-83dd-4a74b31a1a09", "comment": "Malware payload (NetSupport)", "value": "54b0ba3aa03cb4ccb9ca2052fbc1132d18aa68d6", "object_relation": "sha1", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504977, "uuid": "a75ee890-8213-4b5d-859f-4cb478ab2e6c", "comment": "Malware payload (NetSupport)", "value": "97badf5c28ad0d773ba0ef3d1f48a3da49d52fa9fffbe77fca393bdcb3e2db04862a573ded8180a5a023c057f258a845", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-182-172", "colour": "#FE8F71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-com", "colour": "#DD9BBD", "exportable": true, "hide_tag": false }, { "name": "yellowbricksj-net", "colour": "#4B3FB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504977, "uuid": "c562a319-e83d-45cf-ae11-d1687b27467f", "value": "T16A129F1DC7C84CC2D06BE2745AD08655C536E7D84ADA04096AF933C9BF82EB79621375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504977, "uuid": "9ef72d2e-6c56-45cd-94b2-f9a6bf50c20c", "value": "192:HRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+Zw:HRm/wksuQJ/g6dI+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504977, "uuid": "5280a444-0c1a-4d27-aa52-a478c17f856b", "value": 9057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504977, "uuid": "f1163222-8269-4971-beba-8036c0db6653", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504977, "uuid": "d5112b27-ac1c-4364-ba24-90d6fbc715a5", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47a7814-3b69-11f1-a769-42010a9c0008", "comment": "Malware payload (Vi)", "timestamp": 1776546087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546087, "uuid": "b892fb28-69a3-48b7-b83d-92e1901b107a", "comment": "Malware payload (Vi)", "value": "882a403126acbdf799daf4e9a139999c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546087, "uuid": "8863d1c8-9256-4d90-ab95-d4843c6fddd7", "comment": "Malware payload (Vi)", "value": "af6671086ec32cf343f99fb99ca292f80636fe74672e8073c8ffdd2bd04c3a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546087, "uuid": "36d86a51-b321-48d3-8323-cd6df78f24af", "comment": "Malware payload (Vi)", "value": "a737ee13d4a49f321e322da159cb7f5694b22840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776546087, "uuid": "83bea25c-18cd-4788-8354-b5bb1a723f79", "comment": "Malware payload (Vi)", "value": "399f7fe1a9d6877a2f5ec78bd16b5532fc35820f9e4066255c43264eaaa62cf196a448a12d856e29668c2a4e0198413b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546087, "uuid": "01f2255a-ebc9-484f-b4a8-3d1b3b579d10", "value": "T18BC58C07BC9548A9C06AA3758CB752927B36FD880B3263D31F26BA742FF36D05979704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546087, "uuid": "adc02608-7f88-4f04-848d-e6fea016dd75", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546087, "uuid": "dc76cc4f-5215-4a15-b83b-7934e609cebb", "value": "49152:zgiWVXqQhFYpksvx8lS/gvVxuT/ntMJMBgptx:zgZjhKWlSoxvJ7tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776546087, "uuid": "bf65ee16-1384-4c2f-bb68-8d7ceec01598", "value": 2501444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776546087, "uuid": "9811d9fa-a0af-4a83-bcd7-8a263a2447f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776546087, "uuid": "9caf64fe-b931-4521-ab4e-26c253d63028", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f69cd5-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776497819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497819, "uuid": "66b388fc-b4d8-4bac-82b4-7e58893bd17f", "comment": "Malware payload (Mirai)", "value": "917a076d6394d76baef9a4f4bec3cd02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497819, "uuid": "fc696e6e-37aa-4ffc-a66c-9681be4cca7c", "comment": "Malware payload (Mirai)", "value": "b007bed632275c2b8fbef7a27e81b43e4d946016a7d25c75300591964be775ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497819, "uuid": "2f68f3d5-793c-4585-98af-1b574b588f03", "comment": "Malware payload (Mirai)", "value": "ad721f1d8b728a030f7d4e94d63e24d1fdd12e31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497819, "uuid": "2219a8a0-2d48-40f1-90a2-d2a49d75d9d8", "comment": "Malware payload (Mirai)", "value": "9e44ff6fb0629b1763417ffea4b1549f0960016d9b09117b119a861f747a7b427ae7fe06c1f4b63f7d3774ea440d4eee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497819, "uuid": "55da199e-fa6e-4262-84c1-e7bfff0289b4", "value": "T158D31A41F9414F23C6D612BBFB5E428D772A17A9D2EF72039D211F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497819, "uuid": "c1d14fd1-0acb-4dc2-9def-a2217fe6ba75", "value": "1536:a3Du4G5c5BEsqEh640eYWgAMaz4V/HFTcVmAWTNPdmOAISeSxLme42Nfly8wywM6:a3DiGqkkXWgq4RFStWTlTMNmevmZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776497819, "uuid": "506897c9-fb4c-4c88-aa64-6dffaccf649f", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776497819, "uuid": "a7ef67e3-bc8b-480a-b2e6-dbf34e92cca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497819, "uuid": "a052f1df-9fd2-448b-b641-a6b9fa442483", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a85180-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776487995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487995, "uuid": "b866a320-0dab-4aaf-87a1-8acb344ba0c0", "comment": "Malware payload (Mirai)", "value": "5fe25cfe5ff1f49793e25074c2c3e7a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487995, "uuid": "fd542f37-2a43-4643-bbe9-d1e80761362e", "comment": "Malware payload (Mirai)", "value": "b027075674bd7f8fa70f09f28716deb234c20cc51425d4d210bee09789134d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487995, "uuid": "cdd704d6-16af-47f0-b959-25ca9a87b777", "comment": "Malware payload (Mirai)", "value": "1eaf5070a2747bcabcba036e366a1d7e88748880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487995, "uuid": "15232a42-47fd-4479-8b6f-2e2030befc8f", "comment": "Malware payload (Mirai)", "value": "f2f8275b3dcfc0920579eb58d612063cb9ef64cfafa04887371e1cb8f50f983568c83d08d28db1af51db7a7560ca11ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487995, "uuid": "accf467d-86a7-4424-85fb-1fcb1f42845e", "value": "T1C16301A1C581ECE570B91D375638E68870713678D9A4303B154E7ACAC791B4AB2FB3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487995, "uuid": "4d345667-f522-4114-af1f-72edc9a57f27", "value": "1536:TtQj+VlhPCBkFmU5wUkvZ9a2sA1lDYNENrKgb:TtQjm7ZvOUkvZ9a2PMNEMgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776487995, "uuid": "456cb7ce-4c97-469c-b562-739b600811f8", "value": 69664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776487995, "uuid": "d5ccc0d2-49d4-40b0-a0fa-e7f696b16ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487995, "uuid": "e036f296-c8f5-4b78-ab97-c53616cf0bd0", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7e2d5b-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498752, "uuid": "8e88ec42-ec4a-4284-939a-a7f69dce0014", "comment": "Malware payload (Mirai)", "value": "1e97a975275763d314588b7f4a773178", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498752, "uuid": "416ce740-09f5-4fe9-af2e-8e7683671e19", "comment": "Malware payload (Mirai)", "value": "b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498752, "uuid": "2c8238f5-5b5b-4bd8-b826-cf90f18591ae", "comment": "Malware payload (Mirai)", "value": "36d2696ceb35bdd5ab60a8a11c57d2b78df1b6a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498752, "uuid": "d20c87a2-8385-492e-89c7-42846fbbfc14", "comment": "Malware payload (Mirai)", "value": "5eba5334f3f0c8be25dfa7e8b36a8d87cf918a3fa54deb8af92218fbff7afe6e13e834a24cf76fb4cceea5c46fe81ab7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498752, "uuid": "7d247a01-e518-4da4-92a4-03cf7fff6a96", "value": "T10693091F975581ABC89746B607CFF63A4C33B8362B65A1453386BD9C2F07ACC8D29385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498752, "uuid": "034ba51f-6924-4258-a57f-abedd09bcd92", "value": "1536:E70qEo336pR+ABHnc+G4/CqaeFK7+VWOm5fUVs3/L53unXmSHsbOmIct90ymc:Kd3KL+UHnh/CqjWtJUC/l3uXmGsbOm/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498752, "uuid": "7f259196-9360-40cd-87c5-83eaff434873", "value": 94842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498752, "uuid": "f5ac20cd-b368-48ae-930c-b615551cb5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498752, "uuid": "d2a30bc5-a594-41ee-afca-16f716f03f01", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22eddcb-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476961, "uuid": "976e1c59-0e7c-4119-9c2e-436caa4c223d", "comment": "Malware payload (WeedHack)", "value": "7a0090a2a18f14a9b958a0617b736797", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476961, "uuid": "e0ab5631-8216-40d1-a9ba-6684e97ec651", "comment": "Malware payload (WeedHack)", "value": "b08d76d565b1707b9aaf0a3b8d458377b875f99822adee18d0d4dede1e3b4668", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476961, "uuid": "dbde24bf-8089-4c8c-ab01-282b24a0fce8", "comment": "Malware payload (WeedHack)", "value": "7617e20f16d0cd1a811246a4e56503e1a02dcfb3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476961, "uuid": "715a3b0b-ed5d-413c-8ec2-7fb67a1b33ca", "comment": "Malware payload (WeedHack)", "value": "3f9dcf2c1318af420b67c59552f541b36b49d798fd1c47094d3368e15a741d8d96531cdff39d85705eadf371a79d037d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476961, "uuid": "c22322e4-aff1-4671-8df3-4023105b87cb", "value": "T1697633B3AF8C6436EC135A34C4046C5BBF0C5144E64B14EDA8C8673769839EB8F9D76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476961, "uuid": "db6dd917-89a8-4dce-8975-b2ca537956b7", "value": "196608:ToNM6NSL+JYn7zPwG18dEy90P/mAjxf496LZVb:yM6NJJYn7zPwWdOA6OD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476961, "uuid": "2ca04d7f-cd28-4d95-8b27-ad786cdf61f6", "value": 7136586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476961, "uuid": "85183cdd-8736-4a3c-8aed-38c1b855bfc3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476961, "uuid": "69dea071-b72e-4b39-ac46-b101de857b6a", "value": "Embeddium-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e8ad5c-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776527056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "de452381-7e40-4fbe-ba50-50de0cecca05", "comment": "Malware payload (Gafgyt)", "value": "a8e7bb0ff086c4e0f7748eb48f04581b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "c7ac75b0-58a3-47b3-9d53-041cbff57189", "comment": "Malware payload (Gafgyt)", "value": "b09966b839f0320aacaa755b67b523891ea4d3b95bc64607ebd81312a554e2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "4e35bd98-dbf2-4d76-a2ff-c2c3492d4e1c", "comment": "Malware payload (Gafgyt)", "value": "1a1234c29f4853b6e742c1ec41fac93d5dc83449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527056, "uuid": "1b638bc4-42a3-489a-837b-6eca0fc0d42b", "comment": "Malware payload (Gafgyt)", "value": "deabb122fd1dad26641a71456f4cc9f52c30cd55d1664161766c3499a8cf51215b21e7324f3395ddda08714a5f701a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "58ad9062-7030-491d-8bf7-05c654df4ca3", "value": "T19FB32A17B9528B12C1C215B6FB4E564976136BFCE3EF3212C9249F603B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "0bbfb487-2bef-4d23-ab1d-960100218f31", "value": "1536:yLnB+44uILd1u8HUULQh+O3a/1T/TIpPtMbiXfM6RJZf6jRS5yYL5hFp1Bvr:VhU43GatTmfM6RJZf6jwQa5hFp1lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527056, "uuid": "25fc1262-f503-4fa8-ba22-f93773bd816b", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527056, "uuid": "5f91270e-622d-4e11-9643-63ed9e2d48e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527056, "uuid": "0e0b6fe5-2865-4e01-8893-02f470e95621", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a053151b-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486327, "uuid": "330f83bc-a81c-43b4-ae73-8be8c6345b8f", "comment": "Malware payload (Mirai)", "value": "37085a451077d24ebc06a5a0a0d965fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486327, "uuid": "ebddeab2-4a53-4fbb-9616-33a716fbacc5", "comment": "Malware payload (Mirai)", "value": "b26fa292a1bc8fcea067c5bf78795ee355cd2a8b3eb171469ebf1fa4d5c81311", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486327, "uuid": "37df4727-384e-4d6b-8a43-6769166b6d34", "comment": "Malware payload (Mirai)", "value": "93a3ae17ed98a023f1146132cc83c65f3284f4c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486327, "uuid": "ec7a074d-faa5-416c-adf1-9079237902ea", "comment": "Malware payload (Mirai)", "value": "f1fd703276d4ffa2be24426969a8a9a02778fd1fca557ec58e0a5ca12743b0885fc1a353bc3dd685c08b074dcc0d79b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486327, "uuid": "54a9aa96-b949-4e5b-ab8f-dd7fca7f5f22", "value": "T12DD36C00F7050AA3D4831E74173F0BB69B6899C265F5F2046A06BFA51B31EB76587FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486327, "uuid": "f75f1818-5ca4-43aa-89a7-3c4746aba349", "value": "1536:1AnpcT8ErxoyGwFgbW8TyreBfAxyazyMwkDB1R2/ex5dnO/IQ+U1XX:186xIioCxyOyM/B1R2/eYpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486327, "uuid": "4aea76cd-3864-467a-9493-c141c4f4b55e", "value": 132260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486327, "uuid": "dcae79c2-ba12-4764-84f0-5477bb5c971a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486327, "uuid": "4296c600-c019-4b08-9fbb-6711849b2463", "value": "alyssaappc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da737f84-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476975, "uuid": "bb4bfbca-5aac-4b12-852d-ed97b50415c5", "comment": "Malware payload (WeedHack)", "value": "7cb39d1752d0875c1b12197bd323b547", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476975, "uuid": "f5a5deea-4eee-4d6c-9847-af97233620ab", "comment": "Malware payload (WeedHack)", "value": "b2f6488b0efbe639805ec2d519bf20fdc2598f9b3615457094f84b1fce99b32f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476975, "uuid": "a5672097-e0b6-47fc-a9f0-e4f17695502d", "comment": "Malware payload (WeedHack)", "value": "741e9b3454bc8c29b99d982f9aa064846c5ba034", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476975, "uuid": "e3f08d9a-1331-405c-9885-d1bdb936e822", "comment": "Malware payload (WeedHack)", "value": "a780d24193ae14aa7eca30b601cb1292caea17bdd392f353c1d58e6bfa04f0aa262c17d82f7aff3b4c59d1c29d5427c6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476975, "uuid": "7879c3c5-3ba7-45a1-928f-400aa58527f7", "value": "T10EB2CF12CA54883BF6D18FF96CE6FE79752E0A90114F22070433456BAC6796BEB87E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476975, "uuid": "efc220b4-24b9-4ded-82c3-98769d75a35a", "value": "384:r3w9gntYOGoFenMhxh2rnqw1ln7PYcbLex1w1wDfQKJ8VnAOp1:T9nKOBFe5hJYcjyD4y83j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476975, "uuid": "4450b733-fcf2-4c3f-b6fa-ca2049bb5b65", "value": 25701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476975, "uuid": "b13502b3-d64f-4701-ac70-bc17abe13153", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476975, "uuid": "cbdd65eb-24cf-47cb-b81d-51fd5c3dc263", "value": "Example-1.0.08.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83fc020-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545611, "uuid": "5cf02187-7f03-4bc1-883e-4850a1e21bbe", "comment": "Malware payload", "value": "6cb4de5a905cab765ba2d61191b2def0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545611, "uuid": "4279506c-7037-43d7-acfa-81900c98a620", "comment": "Malware payload", "value": "b406c74ef33a0aca42fe3feae1eeec3c98c131749ecc2c9dd09c39cd10535469", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545611, "uuid": "f88667e7-3b5f-44a7-81f4-e6a62f4e1644", "comment": "Malware payload", "value": "257b5d22e88ee7ddec13e9d19877787988d42b8a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545611, "uuid": "d1b9eb2f-9f04-498c-82a1-0bb578783e81", "comment": "Malware payload", "value": "b99822b7290bacf1e6f3eaca9fb5c02da6d21680a0c4be48693d5b27ed15fcf3e40e73825293455e725865bb64a83328", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545611, "uuid": "b59c0c7d-357d-4fe5-9be0-78f94ed29f0b", "value": "T198931262EA539815C4939330CCB72C74F582C56C49CAB0E17C671F0AD9BFA35B99C362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545611, "uuid": "192fb09f-190b-4eff-a133-bab17fd050f5", "value": "1536:v8dCn6S/DBn3BXE9TAJP4I5ERNUzVFwcJLjn7U8dzxtfqsNsuxr/E:voMhU9m4GERNUhacRhrhPNnr/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545611, "uuid": "8a5e029c-4b14-4a96-b0d1-8938c4cd27e1", "value": 97361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545611, "uuid": "2816a493-1a12-4495-96c2-962fadc1ce39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545611, "uuid": "874ed8b8-76a3-4194-94bb-c03785074c8d", "value": "Reeqos_account_generator-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe338e3-3b06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776503345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503345, "uuid": "f4b7f54d-d521-4b6e-92a4-fe7458fb8173", "comment": "Malware payload", "value": "318ec46e5c3fb4ce110b19c5c7439646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503345, "uuid": "14be1c8c-2cd3-454d-a863-39ff4dde340c", "comment": "Malware payload", "value": "b412d96f936a6c039e998ec0e6df526b0879abebcdd23f0948ddd58effb1ddbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503345, "uuid": "4a14f44b-b85f-49cf-9557-70cf7ce3e6aa", "comment": "Malware payload", "value": "dce0eda4c953ca7a8a2c9b059460ff5465a5da13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503345, "uuid": "b28414c3-6c39-4e0b-9c17-ecd4360765de", "comment": "Malware payload", "value": "a319ae129409db7939cfad6d5e427b4993038ca2a57e72b1cf646642e152ba0b127885db60eeae13debfcc0c0a8edf5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503345, "uuid": "3c25807c-3b39-4bf3-8c4c-2fc8f1820a97", "value": "T1B0D46C627721DFB5D354C27009F3C6655AE521A20AE250CAB27CC72C7E6162D2D2FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503345, "uuid": "5a3544bc-02db-41c5-8b2a-27e24f73f616", "value": "12288:oH4O4DwKvC6Qq5RIZlnm6xLq6rHjpjBDPsBt8pwFj6LE:04O4DwECXORelnm65HjpBDPs9Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503345, "uuid": "80927bf7-b433-43f0-81b1-6c484199cf42", "value": 637404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503345, "uuid": "129f7d1e-ba13-4efb-a770-70b499d40b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503345, "uuid": "031efa72-5e3e-468f-a509-935ac46bd419", "value": "l_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc95bb9d-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527633, "uuid": "61e1b580-d2fc-4dfe-b617-c8c0962d1e0f", "comment": "Malware payload (Mirai)", "value": "079ab6d50a74990f98cc8727a065572a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527633, "uuid": "aa0e199d-769c-4865-8b5f-c39ff14e47f1", "comment": "Malware payload (Mirai)", "value": "b56a9eee31ecde672aee64a0d6a140fa9cfa1874bad6ffcdc9ea3c2533a327d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527633, "uuid": "0bc1bced-b225-4a75-8957-959c5787d600", "comment": "Malware payload (Mirai)", "value": "624def9b421f11e575cb943da9aeb5e5307698e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527633, "uuid": "161723e1-ed5e-43dc-81ea-1bfc0c820fd9", "comment": "Malware payload (Mirai)", "value": "c6221fd7b195cefa0f79ed10bfdb95be3f2555b80ead9c12d8cec0de765d6369d2bac74b8e50b15c32add4092e2087a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527633, "uuid": "0f3e280c-332d-43ec-899b-8b52ba3acb16", "value": "T13CD35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2BE711936ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527633, "uuid": "494547d0-116a-4a7a-9d48-be2fde45b4a5", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQ6:yIRfe3xvvSrlvZZ7U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527633, "uuid": "1ed30ebb-fe75-4a0e-9583-b1e2ea7d3345", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527633, "uuid": "5c87ea43-ac7f-409d-997c-d476795d4f6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527633, "uuid": "b22fa75a-52c1-4ea0-81cc-0e3b5785702d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064e90b1-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477049, "uuid": "9b15aafc-181f-4f5b-9ea3-fe889541ed29", "comment": "Malware payload (WeedHack)", "value": "e792ce1abe1c6a79b9fe64417997e64a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477049, "uuid": "ecada557-9afc-4276-b7cb-14cbb0e63496", "comment": "Malware payload (WeedHack)", "value": "b5ff73e77d45a7123843f763f9b1fce7e90aea957bd5af3607780837549d7e18", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477049, "uuid": "b78e683c-9b8a-42c4-addf-7e2e844760cb", "comment": "Malware payload (WeedHack)", "value": "7bc61edaa7f7ee8e567498f978ef0a87029cfe5b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477049, "uuid": "531dd38b-cf3f-4663-961f-0244404f88e3", "comment": "Malware payload (WeedHack)", "value": "240d190cd6ceb13449209f3c3bfbef8791e31fc1c56136fd46fba057bbbf8e26db6dca157961f51e597a71b6e686f8d4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477049, "uuid": "7193c04d-4562-4e12-b409-33f841348a38", "value": "T14F25337D9D3136AD7F2172EE1432D424DE8C7DB1A9C24AB6F602828ACEE1E0244DDF55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477049, "uuid": "eb920d47-b309-40a0-aaf2-f8cf6cda377c", "value": "24576:eoC9U7sqTuj8G8mr+VYG6oD7Ix2mBoOGLWWmbwtWDT:fSU1ShlBy+WOwtWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477049, "uuid": "96e8e596-e36a-47f3-9077-b5c9010c8da4", "value": 1019283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477049, "uuid": "8fca0b29-1a4e-45f0-a931-edcd65d7692d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477049, "uuid": "8cc28ecf-5a3e-4b2a-bfd9-2302fc91a2cc", "value": "Prestige-1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b57a512-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474131, "uuid": "c14f69ac-c446-4aaf-8f7c-e10eff90f318", "comment": "Malware payload (WeedHack)", "value": "0cde6eee2df3339ddd8d0470dfc9112f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474131, "uuid": "8f0bd825-42b0-4d3e-933e-21783b9f3c69", "comment": "Malware payload (WeedHack)", "value": "b6241d23e801244d84df56f06526e120f385ebcccc63aff5e7c967394fbb4335", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474131, "uuid": "9d679c8c-97c4-412e-b126-729083127703", "comment": "Malware payload (WeedHack)", "value": "18ccef3ff79d7e016123382cb4dba1068035d47d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474131, "uuid": "ad364bf7-24d4-4a2c-8c7f-6922120b94b9", "comment": "Malware payload (WeedHack)", "value": "651665be393d7e3786cc7fd45942a736574a13f59cc63e943b186c9124ce2d39f3fee5d9bd10da0a1657b0170dea737c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474131, "uuid": "bee0f8b3-c42a-4c7b-9eb1-4f7884bf6792", "value": "T10033E177CEF91129EA1B47B5C441F8830D6DA8C8D560337BB5B058070CAA7E987A279E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474131, "uuid": "84cfc703-6469-41dd-8268-8cabe2cb706e", "value": "1536:QBqdmSnBf85taDS4jG9A+7qHTz9JkYw4Zg4Fv:Qwd/KtaDvGu+7ONOY7yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474131, "uuid": "220f49b8-f264-40d6-b2f7-dc00182c17ad", "value": 51028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474131, "uuid": "6c3f788b-c84d-4bdb-8bff-02e8168f52db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474131, "uuid": "8dc9bb6d-10d4-4e5b-a1a7-9e8c8b0634b6", "value": "Gambling_Rigging_Mod-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4ac3e1-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776487988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487988, "uuid": "7d7dfba4-11a3-445b-bedf-5e5f7b2fca7d", "comment": "Malware payload (Mirai)", "value": "f2f12dd04e6e0a7ff4f350d7360fc778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487988, "uuid": "98543c8a-cdd5-45c4-b777-f86f896097f5", "comment": "Malware payload (Mirai)", "value": "b6da5db60ce85a6e282d2bc822cf95b8162a35614c0b6355017c0628af37c84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487988, "uuid": "d0b83b12-8899-4200-93a1-b0837284899a", "comment": "Malware payload (Mirai)", "value": "de92502a9de5eabe1d284b9a28cd61a61857b45f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487988, "uuid": "762835fa-766d-4522-a861-6d4d5050de64", "comment": "Malware payload (Mirai)", "value": "d230bb98f9e2887ec0837b153894cd49bc37d762fda3c00f1d314a41df7f4599b4f82a0310c30682f607448d40575dc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487988, "uuid": "94f608a7-7234-4c71-897b-50a251090140", "value": "T1E65302216A41C992543117B6F838A2F0BAAA1FF889F3B45766B06380F7E18915DFD487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487988, "uuid": "c94bf86d-3c7a-473e-8ac7-e72149f604ca", "value": "1536:maB0WJ2oDq1apy1CR3giAY8kIuS0Vv6sPmPMLV2ALlE6q:1B0t+qcLn4uS09PmPWVDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776487988, "uuid": "657e4f2f-c1a3-44e1-82df-560ef823eae1", "value": 63212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776487988, "uuid": "706df2b1-decc-424f-85ac-3a0602923e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487988, "uuid": "a65d7387-1753-41e4-9738-c600bef883da", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0457cfc3-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492937, "uuid": "c4bd353c-2ae1-456d-a45b-32ed6b61d24d", "comment": "Malware payload (Mirai)", "value": "763ac1e632a735198afd162c6b4b502a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492937, "uuid": "fb4b25c6-760c-4353-9051-3cb2a46e2394", "comment": "Malware payload (Mirai)", "value": "b730ca6a1a0eb87f83ecf35cad27bbc0227f2f4eccf7be314e5a1f602161e617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492937, "uuid": "6af51adb-125b-44b0-a575-17a09f1feeee", "comment": "Malware payload (Mirai)", "value": "ae7e8caed8a505644bda1c39c4be187aec9971cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492937, "uuid": "ee6bfd82-8c2c-406a-b8af-8a23c7c0b91c", "comment": "Malware payload (Mirai)", "value": "891c248d2690190c8479ba342d1baaa8a6eada3898d0fbde855252121347d5b16f6b170d67d5a41b2b141645215dc7d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492937, "uuid": "484a80b4-b388-4617-9f36-ecf3f5a78560", "value": "T111639E16D82109A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492937, "uuid": "c503f97d-ad66-47fe-8c92-9d987b846f99", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udw:dWVkwgAYugsz9xznsxrdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492937, "uuid": "263a1b58-86df-4654-b457-3cd633c8f207", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492937, "uuid": "001053ba-3a54-43dc-ae70-13940181fa4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492937, "uuid": "1660cc16-c9f9-4a6a-8b33-8e0eb1712e0f", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384d6d91-3b39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776525236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525236, "uuid": "75e6feb0-067f-4a58-97e1-cce592bd02e1", "comment": "Malware payload", "value": "526e66f420acd9b4cc10b57240836539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Lazy!MTB", "colour": "#1924C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525236, "uuid": "577ebc4d-b02c-468b-9897-54772ac8150c", "comment": "Malware payload", "value": "b8ad7b9f2eed92ba0c5b755c769a55b33afd03263b39c654dd97126439990733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Lazy!MTB", "colour": "#1924C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525236, "uuid": "fe3c3bf6-4415-4022-b7b1-4575d29f995b", "comment": "Malware payload", "value": "349e9dad7dc9a3d413cd94154f3443045453c373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Lazy!MTB", "colour": "#1924C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776525236, "uuid": "3c2e38cf-cce0-4f12-9287-9e1308ea8461", "comment": "Malware payload", "value": "887d287ab72e47b8b08dcd33e843760eb969612be246987fbfaef5eaa0b9eb6919c73141c6319f52a3819ed1c9cf7666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Lazy!MTB", "colour": "#1924C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525236, "uuid": "990ab651-9e9a-4230-92bd-316a4faf4597", "value": "T17E67CF87626C24CAC47692BC8542513AF2B7F8195760C3FB59D3FDA60FA36C01E7AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525236, "uuid": "2bb797a6-3389-4fb8-a226-c1428beb89a3", "value": "e995a326feb473d9f374782cad9541da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525236, "uuid": "5c76ff9c-96aa-4b00-b1af-b5ca9af1f5d2", "value": "393216:zlrnCDutahC6nqJREs8RHgkp4VxmZ72k5kbHPBqwSZ7gNjk5HNhGr+sVLE91thPd:2H4V7Q0LE93hPhZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776525236, "uuid": "5771c4f2-a613-4105-8910-2e902a141d5e", "value": 30004736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776525236, "uuid": "9bce0ae1-2de4-45dc-8438-9c05b3f4f49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776525236, "uuid": "69eaf06f-f585-458e-844b-8b9e16b93fcf", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdb465c-3b5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776540491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540491, "uuid": "ac392669-ea0d-4599-b679-54c1baf74e9d", "comment": "Malware payload", "value": "20d00fb56dacc7ac0e66d079f88aa029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540491, "uuid": "48f924b3-b147-47f5-8573-9a981e0832cd", "comment": "Malware payload", "value": "b9277014b5a639d3c63027263b25480b693fa0b9ab1049604577c8ae9d863c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540491, "uuid": "22281de5-4e3a-48ad-ab8c-f00d68bbbc96", "comment": "Malware payload", "value": "59ef961e9896b0048462ca8670e877c58c76f8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776540491, "uuid": "10f4f776-8282-4c73-95fd-1604b2b17600", "comment": "Malware payload", "value": "fb00c5a9cc41a276029634c3c0343db18b00ed302f30ac13da4e2a802982cd23b869625f03bc88365abeb554d7ce2ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540491, "uuid": "874e2962-e4ec-4fd2-b778-8b15775ba439", "value": "T1A2F6129635D562B8D0E3C730768722CA70D0795A86FC8E5F2AC72C036A31DEA594B773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540491, "uuid": "fa0aa6ef-42c6-4eac-a3f1-5fb0ac40368f", "value": "f5e22e6b03a00685c38cae5f17cb1946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540491, "uuid": "51380de4-2dd9-4163-b62e-429f4dc17852", "value": "196608:XnimDUm8J3E0Ji+CMy+g7fSB5Up2CWESXa8E/CMgqfxvOLjY+meslTF:TqE0JiBMz82M2zfdMFy0+kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776540491, "uuid": "d9b688b2-b9ee-49fa-b4bc-d301dccd6958", "value": 15958528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776540491, "uuid": "e2f2f1b6-2b26-4d2a-ae7b-ae065d4d8700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776540491, "uuid": "e647b195-0b02-4211-b4bd-5d7f1d4969b5", "value": "valorant_unlocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f64489-3af1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494314, "uuid": "2101b02d-f8db-40ba-a2ae-9f3bc01ce4a3", "comment": "Malware payload (Mirai)", "value": "766e426e27fc6049aa0683e8479cdd89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494314, "uuid": "ebed9d12-c64c-4471-ac23-4542ef493069", "comment": "Malware payload (Mirai)", "value": "b95b11fa1a55b88a85139fe22fee87923523e59b91fe0445c8c992cdd50a8d29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494314, "uuid": "9e226217-2367-4fda-abfe-3be18e215447", "comment": "Malware payload (Mirai)", "value": "8ce7957845c45153c989d993b4fd2d562da0b0d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494314, "uuid": "c64963f7-8b97-4a76-ac47-4452805f3398", "comment": "Malware payload (Mirai)", "value": "9caa10622ba8f059bcb3229b86e96fdf8c4a5c395f2bab360cfc7542df55326b4e3cd5b61c4e2023cff2c0be2b202e22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494314, "uuid": "1c80083e-0b70-4d44-9b18-0b800eb9aded", "value": "T18C730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494314, "uuid": "0bc4aa38-93f9-4838-9419-ffde99538d1f", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAb4:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494314, "uuid": "469d7d91-8b27-438b-9656-53fd12bce85a", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494314, "uuid": "6281a645-424e-4a0d-8534-5af14409f325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494314, "uuid": "d9257731-07fd-4a9c-9b4f-3f1ede457ad5", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a5fd84-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476919, "uuid": "76392ea0-a07c-463d-89f6-cfddd7709dc5", "comment": "Malware payload (Gafgyt)", "value": "d677b0eea8b16f4151f20c2be0c76f2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476919, "uuid": "266709de-c90d-41db-bcbc-ae3faab88492", "comment": "Malware payload (Gafgyt)", "value": "b9d555c83c3b7769d4616af6c501ae8381a359582020a1168900e1b888e048d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476919, "uuid": "b6f8c009-a214-4b3b-9d2f-17b4482d608d", "comment": "Malware payload (Gafgyt)", "value": "d80a2dcc30ceae102892fa16fecf65047675fd32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476919, "uuid": "1b96d7ae-b444-4e01-ab69-b6fc6e27178b", "comment": "Malware payload (Gafgyt)", "value": "be71a5f971f1684ac48aa31b381fdcac68e28fec461791bccc33c3b291422ea375062d2a11c7dc6ba7b3bac062d6af1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476919, "uuid": "b221dd85-dcda-4a0b-bbbc-5260995bcb9c", "value": "T19FB33A57671C0B43C58B5AF12C7B37F187ADEA7112E225C5A40EBFC01B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476919, "uuid": "4e6964d5-6340-4a6d-ac39-a26a0bf27000", "value": "3072:JHXrsU7PNZMHNrONBbsQv5hkqu4CK2QnI0PDG4gQNcR:J3LTMHNrOwQv5hkqH2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476919, "uuid": "02d5b1c7-f711-4825-b9e9-c5a0cfae68f1", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476919, "uuid": "1fde5275-88fc-49d9-8b17-c3961830ecda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476919, "uuid": "78d148b8-cb1f-4b6c-86ff-a9b7cd04400c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ef50bc-3b1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776513039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513039, "uuid": "d882e1ae-3169-45a7-8d07-5b56df1407a5", "comment": "Malware payload (Mirai)", "value": "1699b31a9f451397dfaad97183f4d8f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513039, "uuid": "a3c397d4-f4f9-466f-bfbc-9e484ab5a32e", "comment": "Malware payload (Mirai)", "value": "ba2a0c107b5a9458dee3d47499f0e505f09e4e7a09b0b64f24d720007583b03c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513039, "uuid": "7dae6f71-a352-406a-9679-686ebaab1c56", "comment": "Malware payload (Mirai)", "value": "431cd7fbaa7a1fd0b595ab336d83e1673429dcde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513039, "uuid": "072ff29e-84ea-4a85-9cda-6921a0e5127f", "comment": "Malware payload (Mirai)", "value": "162c19499408bacb2e51ce10e6c3ceccca27106275b2a6accfdada875332047db6fb779bd51eaef751aa7c0d5e03e1fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513039, "uuid": "dddc8177-b2f7-467b-9414-28b9478534d3", "value": "T130E35CC5F743E0F9E85601702133F73B9B32A536412BDD93D768AE22AC92691D61A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513039, "uuid": "d8ab5e99-24f7-4c8a-a21e-9a1815649339", "value": "3072:ZOW2R8nsFeoAlKWZZFPHmYmiJjzBK1XA6UCjBF5SUSvnwppG4ubrKTw1:0Rh9AlKWLtmYmiNzBKVA6UCEUbTGjHWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776513039, "uuid": "aeadd135-5c93-4ebb-884c-78b6d3dd3418", "value": 147240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776513039, "uuid": "6377cdb0-1183-4712-ae69-f9be22fb77ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513039, "uuid": "117dc27e-e982-4371-ad8f-c20380b64bdf", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3a297f-3b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776510107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510107, "uuid": "73cececf-26d6-4d3c-ab8e-08ff8b1ec9c6", "comment": "Malware payload (Mirai)", "value": "83c45016910a370d39aaa04d8b665406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510107, "uuid": "606942a6-fff8-4d52-9409-b5aa11ad72ba", "comment": "Malware payload (Mirai)", "value": "bb4b6fbbc3a9fc5a196b144f4fc39845092ec1e69ce2bbb0721917b1d75b33a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510107, "uuid": "dd221990-32f6-4483-ae7c-10093124bd1f", "comment": "Malware payload (Mirai)", "value": "3a34887b406060a3905ec08ad7508b215f42dcf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510107, "uuid": "4fa4116d-7ca8-4ce8-8c00-ce3d80b7719b", "comment": "Malware payload (Mirai)", "value": "9dbde9d23c8416b5839ffaa60c3e7a504bdfe93724aa81af6a7936a285aa41052b0e751792d7b736e9733177e08b01d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510107, "uuid": "c480f0fc-4122-4c84-aa2c-be09b2abd8dc", "value": "T1FB143B45F8818F22C6D412BEFA1D128E33272B78E1DE72129D205F65778B96F0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510107, "uuid": "78bb7918-0f3a-4970-81c6-a44577741ecc", "value": "3072:TRMXItjGyPNZjGaTElR0DwM1paZ1YUx8WTlXdIynVIaRG3M6pCCW4oNcgVdr:TRVNGalDN1MjYynlXmynGa2zCCiNcwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776510107, "uuid": "db5cdded-85af-45e4-9ed4-670f7568c8e2", "value": 207676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776510107, "uuid": "a52cb261-5c52-4bd6-8643-1c2161804130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510107, "uuid": "6646078c-d810-47cd-a1bf-28686a9cf8dc", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533b1525-3b08-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504236, "uuid": "f8f266a3-9a19-4744-9cd2-655f238d6f0d", "comment": "Malware payload (NetSupport)", "value": "80f6b011ef9593998a508d9d39a9c95c", "object_relation": "md5", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504236, "uuid": "a071c77d-dbd7-4455-a307-c2c92b630f1a", "comment": "Malware payload (NetSupport)", "value": "bb88fec74a275024becac2fac14510b754b87979cdea0f79331516ef1f893a31", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504236, "uuid": "ccc34b94-8204-4da4-9cc0-49d7de9d0b47", "comment": "Malware payload (NetSupport)", "value": "79ade6fb255a96355481b562415a20d6919cd365", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504236, "uuid": "b5f998ae-4096-4afb-96d1-17db499a2167", "comment": "Malware payload (NetSupport)", "value": "d24da669018f71e6bfc558a05d6df6b24470323e9786e91bfb33f78726115602465d6f1b2bde8410c8dbac287d99c3c0", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504236, "uuid": "039f27ea-feb2-4700-9134-8fd7afd216da", "value": "T1A4A5339A9A0D88DFC55B4F74C00B5E1AD33E3A41F1AE7081F6728252CC89B9F57B8719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504236, "uuid": "750af26d-0832-4d8c-b5ef-a28049de5696", "value": "49152:5YWKcquaxYrp7Bn+VnJTmm3F+WVcBdj3b2+3bw/0JBAThAnl1N9t:5DquCS1+/VYj3b2+30/wB/Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504236, "uuid": "764a4a48-5467-4814-96ee-43abd254b898", "value": 2201699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504236, "uuid": "cf5f2bf7-af82-4d03-bc0b-5f0e68a5af83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504236, "uuid": "9c6e60b2-ac33-4e7b-b643-a1df1b67ce31", "value": "pw-ilil.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d01418-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527440, "uuid": "a29abe74-baaa-403a-8fb2-add7c384b647", "comment": "Malware payload (Mirai)", "value": "2a0ea8d3763e9576ad09f978939d078d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527440, "uuid": "a7dcf4b8-d44d-44fe-9b10-e9225a2caa70", "comment": "Malware payload (Mirai)", "value": "bbdbf4d8f02ce33d9bb05f8cc0cd5cfb23225f7bf1d351aa8176f059773d48f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527440, "uuid": "2510a87e-d03d-4d37-90ee-0ec4b7a3ec75", "comment": "Malware payload (Mirai)", "value": "485d79304d6ab9b7ed5a1bbf7c2077db0ccb404f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527440, "uuid": "2394f326-a5ca-47c9-b1ff-91a58e36b9dc", "comment": "Malware payload (Mirai)", "value": "7e614086b1050109265ffb6558985386e9d1fc480a9c5a97c89b450350c057513fef5d07687e1316f9ce2b32b4489749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527440, "uuid": "c59732e7-7393-445f-beac-7df0424b581c", "value": "T1C404392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527440, "uuid": "734c3284-e011-4d34-baee-b79c217f2749", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wuUXS:7eJpJUVD1A8n0YNgEJi5ari", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527440, "uuid": "b96f60a1-a710-4a87-9a71-3933cc1bb5ac", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527440, "uuid": "661dcc86-58ec-45ae-ab13-3076f852a47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527440, "uuid": "94def465-4d7d-46f8-a2e7-9018330c5b91", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a28aa7-3b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776510069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510069, "uuid": "03db25ab-a35e-481f-bc29-32550691ce18", "comment": "Malware payload (Mirai)", "value": "69aa46ddd0df01dccd9ca0419a577fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510069, "uuid": "e562bb0f-a22e-4052-816e-2870036ad561", "comment": "Malware payload (Mirai)", "value": "bc0cb910005577e7c03e54c3330eb941224c795b4cbd9b1ae7efa9fc1c721893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510069, "uuid": "10735cdf-347f-425e-84b7-2d07a60990e9", "comment": "Malware payload (Mirai)", "value": "d7a6bb323f87be69e4692002dcd87b0e4807209d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510069, "uuid": "6a08af45-614a-4e9d-8570-4aaa6ba32198", "comment": "Malware payload (Mirai)", "value": "8f3bdbb2d2a66bd1fe548b43e50fd3cc7f37c816e528fa30ff8fce8e04e1caca178f89f0a1df9592b7cd29c198931d6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510069, "uuid": "cafdf1f4-bd74-4cd3-be07-45f9b8477bae", "value": "T1207312DC60DACDD2BB0063BAEE7524CBB89753FA91FF353086D80A3997E6004A255C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510069, "uuid": "729623c4-3b04-4453-bc7b-21d14a9169dc", "value": "1536:NzMd0CWDiYe4PhjzbPjYwjetnvzd9B46q1gxtF/eDTcVsDE5/LL9:qdCzxD8wjeBvzN4BQtVSs5TL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776510069, "uuid": "72e1bc0a-368b-43d0-8983-54a93169b57a", "value": 74420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776510069, "uuid": "4c37fde3-56b4-4b2c-b5c7-392f36782926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510069, "uuid": "b88f1425-ed1a-4039-8f4b-4f63615a69fe", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6766ef-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476922, "uuid": "7f2b5eb2-2a03-4b51-adea-f62bba79ef5f", "comment": "Malware payload (Gafgyt)", "value": "aa2be5960deaf42e6b4488c814a88692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476922, "uuid": "810e16d4-0fab-4e6a-88b8-5f23a3ad079f", "comment": "Malware payload (Gafgyt)", "value": "bd888ba6f238ae46f62b918794d7788d46e35cc54dcfd5dfd74b41e0668898ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476922, "uuid": "2d05af30-7b2d-4f79-850f-1e9a2345ae5f", "comment": "Malware payload (Gafgyt)", "value": "27b3df222282c14aaf5f630b6465941e4085c567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476922, "uuid": "c8925b4d-ab80-48ba-acbe-39f15a1853bc", "comment": "Malware payload (Gafgyt)", "value": "0105d61a95c07a7486f049cc65b4a1c8838762a854da6b5a9bee817abe3a9e72f13b404f602afe04eea46a4fd76abc30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476922, "uuid": "e56a0fe2-28ba-465f-b8ac-a92f6c1afd36", "value": "T121C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476922, "uuid": "d63b797e-69c7-4a06-83cd-e8495352ad36", "value": "3072:sJDZ+6lJQTnoo3nKVz3ecxPWQ5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+Q5hLSFuDJoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476922, "uuid": "53e15058-2ca7-4f8e-b29d-2a93eacc2eb8", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476922, "uuid": "0a688715-e311-473c-b3fe-5bcf201ae4fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476922, "uuid": "2d3d59e4-5f13-42d2-9b29-2c92b4fa1287", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98963595-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486314, "uuid": "abfd86b9-4d8d-4e1f-a706-03fb6dc3fd09", "comment": "Malware payload (Mirai)", "value": "a433f335699eb60b21f0f2f6c467c4aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486314, "uuid": "fbe83f4e-0ba6-47ec-8822-b90df726e5e5", "comment": "Malware payload (Mirai)", "value": "beb3ebf11c9f25024746abf223756e7632b3b564a29ffe8278591ef6de369484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486314, "uuid": "c5938013-e844-4a6d-9e35-f2c01d592c6d", "comment": "Malware payload (Mirai)", "value": "ce4fc9b7c2ee92a659deb7ea9061102f0cdadb27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486314, "uuid": "b024ad45-3a6d-4c7a-88a8-158d11c2a92e", "comment": "Malware payload (Mirai)", "value": "dbd63b5b056945c7be3de49c267c900449520dd12d644b23241fa3f149e6b1b84605dee44122bfe07549a54542a572e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486314, "uuid": "3ecc5403-ee6f-4aa0-a5f7-89e525cd9487", "value": "T1C9830A48FE951BEBC0AFCE30151E472A199D188F63E2E3369278DC5874DA349D9E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486314, "uuid": "5dac035d-7757-4704-b1b3-1e83ed276b42", "value": "1536:gikxejeStbdVZeokH4fvsLv1+q85oIcNK9W:PkxQrdVZaMsLEqYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486314, "uuid": "15aae56a-90e2-45eb-8ffb-b50801d9d3ec", "value": 88244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486314, "uuid": "e5e68126-3acc-49eb-bef7-2b6e469068d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486314, "uuid": "48907081-18f0-4615-bb0d-92b2bb2a6ff4", "value": "alyssaampsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a850eb-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474095, "uuid": "7e62bd6e-3b31-4d68-b520-956dd49094ba", "comment": "Malware payload (WeedHack)", "value": "fe9b471a62ac551903b501582876bbc7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474095, "uuid": "aacb840c-182d-4300-9e52-417a30e6c81e", "comment": "Malware payload (WeedHack)", "value": "bf1735c437087adefa07940225b692622ec249f1d2941953351c322e90bb7c46", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474095, "uuid": "1ac01621-030b-42ad-ab21-d6357321e7f1", "comment": "Malware payload (WeedHack)", "value": "aee7d24b4b3f422f361930aa3bf84c03d7002419", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474095, "uuid": "236995f4-dea3-4c84-8064-8501721d7b14", "comment": "Malware payload (WeedHack)", "value": "5e849c11f4e3ffebae31e8ad42eaec631c8a06d7549a7abf89bdf7e38540d7e48efdabc58e32d534f77393e5c074760c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474095, "uuid": "3938b300-49fe-42d4-926a-b998a97e5fa8", "value": "T1E44533A5D45258F4BE131024FBB0164776732397F2BAF3E99A7F4BE90BB08964590C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474095, "uuid": "7b5cfb79-ac4a-4809-9965-2dd7e2474969", "value": "24576:FtRc5xVR9tZL/45KeNcgwS4OXOTsX7ygoXSAHaYMyezTgTAD1xO3sj:TRcdRvd45KmwnO+wmzSAHaXTxDq3sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474095, "uuid": "36750231-457b-4b14-92a3-8f520ceb6650", "value": 1234389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474095, "uuid": "e95a2d05-cc18-4fec-8609-4c20cdf87fd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474095, "uuid": "b28ee7e9-a1d3-4670-a4d6-14acc9869bfa", "value": "Deepslate-bypass-1.21.10.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba776e4d-3b6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776548218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776548218, "uuid": "effc4ac0-3fc7-4056-9a71-9c4ded23a13f", "comment": "Malware payload", "value": "84ba3edca7eb2434076b21e9c417555c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776548218, "uuid": "4f44a3e7-cacb-44f1-a3e5-2a6e1b94d68e", "comment": "Malware payload", "value": "bfeb1e62d51dd7111919f41a1f199c923235577c6e3254c518d45639a4a545df", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776548218, "uuid": "248f8813-a3f8-40fc-8e03-bab479aed05d", "comment": "Malware payload", "value": "fe0a5b84578fcead2023d18182824df47af7fbc5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776548218, "uuid": "327560a7-5c0c-4446-affa-6095e9c3a04f", "comment": "Malware payload", "value": "b52489ab801ae60256c8fccdcdcd35ae4263ad38c7607c7e8258f16806a79e546e76427b8e9fe5438740af1830f3a8ab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776548218, "uuid": "f93d6dc5-a775-4539-9835-b790c27b5fcb", "value": "T12672C0B712B7F51CD9CBA637D002972908AEACF0F66320435E382ED4F95009594FCC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776548218, "uuid": "c16063ac-526c-42f3-9e22-cc6248c46129", "value": "384:JiGj5MC/rKy8cwHpW8vUXXXGVXzt9FcSxilmjKaZU6307ST/e:JiG99KOwHdvUXXCXztDc7mjKU307ST/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776548218, "uuid": "1b8a3b1e-f6df-4cb6-acd7-bde5c4580be8", "value": 16310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776548218, "uuid": "d6612889-4f40-49fa-a59a-b5075ec4abf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776548218, "uuid": "612722d1-ab15-4a67-ac50-9f3ba7f6890f", "value": "photo-164686476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbc271f-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534047, "uuid": "727d66ca-95f2-4b41-bb3d-487d97bff857", "comment": "Malware payload", "value": "b8c1446d08befdfe1c5ed566e061e717", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534047, "uuid": "ab8530e2-15aa-4535-b1e9-000b6fd374c3", "comment": "Malware payload", "value": "c0083494469472012fd2108de30850be5ae42b47625c70514e6e448bd234ec97", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534047, "uuid": "a646c1ac-7501-4ff5-b9f5-8756236f0501", "comment": "Malware payload", "value": "8b3aa604facfeff631425e935dac7262cc809953", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534047, "uuid": "86e5a0e8-d284-447b-aceb-b6fc49b0445c", "comment": "Malware payload", "value": "82df0955b711e188e53bd25b4e43a6ce532553b069d888ace42a31e5b7851f7a140203838004e0f398427fcd165ae0b4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534047, "uuid": "37b5ba3a-4efa-4f7a-bd11-d91f8971bdca", "value": "T15546F132E61D0076FE17EB33804169A138FAEE91730FB06E7A78055DC867A8D8B3D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534047, "uuid": "4ba0124b-e271-4d47-8f4d-dbbef2a7d57f", "value": "98304:JX4OmN1CvtAXI2SKrQ1pypGA7q1FyBcZJuSxKtJ+N21Fx21F8:JX44vtB2O+H7ocwJuAKi2d2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534047, "uuid": "19974ff5-61bc-4b46-925a-6104ae3c3ab0", "value": 5402112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534047, "uuid": "65e41127-8246-4e65-b4f6-6d33d45db822", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534047, "uuid": "b1d6526c-0f8d-4189-b3ba-14cf55868554", "value": "Nova-Client-1.21.11-latest.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bd0ed6-3b1e-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1776513639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513639, "uuid": "bf259027-1a45-4b17-a5a5-f8cd775845d5", "comment": "Malware payload (DDoSAgent)", "value": "1a95ba7df644a2dbc05bae392200008e", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513639, "uuid": "61f17be7-29a6-49cd-a5e3-9aa782bf6076", "comment": "Malware payload (DDoSAgent)", "value": "c1925948920c1d753f887a1ec4d32488f059f08acc0a98baa2025bddecb34678", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513639, "uuid": "6fdd9785-74be-4c1a-be0a-f35c4f5d1f8f", "comment": "Malware payload (DDoSAgent)", "value": "2444029a1e1d3e2039b1eeb484d842bca17b73b7", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776513639, "uuid": "2ad70c91-a1e2-4945-bf93-e50f57b4944c", "comment": "Malware payload (DDoSAgent)", "value": "5dd994025da33846d051fa4cc677966f6aa6a571e926ab7cfadf4559e104b3d06eb8c59a77ae21f2375b33787e4b973b", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513639, "uuid": "06bf18c5-adb7-4aa1-9660-765765a9304c", "value": "T11B864A57EDA555E8C0ADD13189B39623BB717C490B3023D32B60F6283F76BD06ABA354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513639, "uuid": "96549bd8-048e-443a-be41-1d9d71e8ce25", "value": "49152:18M+q/H2c6MeLqLNLuXG+w7i4lnHW6sgWAUpvqkHZD8WetxQVe52yakUsZ+9NQPC:18Mjv2P0eDZDEuZHkOesj3gRBQUpEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776513639, "uuid": "b69ad079-216f-494f-8da3-4fd52d4819d2", "value": 8405154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776513639, "uuid": "5ae02482-e82b-4479-8471-7d33084019e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776513639, "uuid": "547c2bf3-ff8a-44be-8276-666669a0b722", "value": "apt-task", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917f1b03-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486302, "uuid": "9df1e441-e586-4443-b8b8-24ab2b67b84a", "comment": "Malware payload (Mirai)", "value": "33e849176678c235c68babd560f97a9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486302, "uuid": "5aa13baf-9bde-4a6c-abea-55b20dc436c9", "comment": "Malware payload (Mirai)", "value": "c2f27cdc6b8a184fd90e55a9fd2a794470f82fa703088f64f8fed6dbf0c0c323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486302, "uuid": "bde19bd1-7c73-4bcb-b9df-0830e50e80cb", "comment": "Malware payload (Mirai)", "value": "ec025043deec497775e92c03a1d370c96ef909fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486302, "uuid": "603859ac-6bad-4f03-a608-47d04f6cba88", "comment": "Malware payload (Mirai)", "value": "f0f49c0ccb13b50d93a68bf3df4b42b86cab9b8aa886ffcb959e2902357cd1efb51137d9191cc718f0f3e15bf135ea62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486302, "uuid": "66b96458-4bfd-405e-8cc1-89d8858b4611", "value": "T163433A60F947C1F0E44305B0016FFBAF5B36B9A60235E5ABEBA52932BCF17920C5295D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486302, "uuid": "7e8d0dda-ac40-4aac-8e5c-cfd8d14068fe", "value": "768:xeyoO2qpMH0kxibkMHbmYZ5zaev3Iigs7kAgmedZvMg7grjtesO:xZoO2qpMH3iJbmOVhIdPdZp7g3tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486302, "uuid": "81b306a2-eb96-4c95-85be-47a4771a8a39", "value": 58516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486302, "uuid": "a5e105d3-2b78-48be-acc9-9835e9dd4c36", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486302, "uuid": "210bc729-79f7-495a-99e7-b0f27547d4f6", "value": "alyssaai586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991fc434-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776473000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473000, "uuid": "50b31315-77fe-4419-9d81-1990dcf994e0", "comment": "Malware payload (WeedHack)", "value": "e6466bb6e5c1404770b5e3e27cdcc872", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473000, "uuid": "71b70d79-4bbe-4f54-a544-e8558e31257a", "comment": "Malware payload (WeedHack)", "value": "c343fe95f61bb2f04a11ef6975890501d8f62551db20222d8203697e99face91", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473000, "uuid": "5128b7d9-d806-454a-b0ef-557659b2ae4a", "comment": "Malware payload (WeedHack)", "value": "49ff46fccdb388e43dbdfed24abb9d6df9f6bc6c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776473000, "uuid": "a45bf227-9552-4b26-8a12-a7aeb41eaf0c", "comment": "Malware payload (WeedHack)", "value": "124462102d454c1b5732f1599f5dbdae19873607eb332156ef66de3658eb355665672ea6330dda2d2b3399d2c3c4a169", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473000, "uuid": "c35549f9-0666-4065-b854-cabb6ae00d51", "value": "T12AB2E13DB288CC72DF8FABBC74DA28A16A4C303AE0D73177705807A5A152ADED7D0541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473000, "uuid": "18773526-b587-4128-967c-0c906219f694", "value": "384:m3w9gntsHohwWzC8f9IcVt1r5B2EGcwxezZCzgG1Tu4MsiGpA2ge5j+I/Xv6FSZQ:o9nrwGt5MEFzZ0LwjGpA45jZpZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776473000, "uuid": "45f156a1-3c9d-4a2c-88fd-263cd7adda03", "value": 25624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776473000, "uuid": "04eac1d9-45fc-4cf4-8ade-9f57941fc7b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776473000, "uuid": "88a06deb-455a-49bf-98eb-ebe81e886185", "value": "Example-aagagghagagag1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5905fb-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498750, "uuid": "eb962632-6e40-4fe2-ad5b-2ae12faaa0e5", "comment": "Malware payload (Mirai)", "value": "5a3765b0500140710595a7a7e221445c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498750, "uuid": "ac4e0b41-1659-4db4-a56d-f3adcbd07b2b", "comment": "Malware payload (Mirai)", "value": "c35d33bfaca43e961a0c6548da113e115ccc92258a452e6d06659ad567a96877", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498750, "uuid": "52ebbb01-5348-4d10-a5da-c103abddea8b", "comment": "Malware payload (Mirai)", "value": "f43832d68c15d2943fcc81fe931c95a82409256a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498750, "uuid": "4bf69696-3ab8-4ce5-a3e6-cf7e22c236de", "comment": "Malware payload (Mirai)", "value": "1ecde4b7b8670f55e9e8e6605dd12dc42fd116ffe326d8861715cc95295c5fbf9a95af5240f0791399e463b97213f5ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498750, "uuid": "59b4358d-5a4b-4341-8e75-f86d383631fc", "value": "T19EE30A46F8819B12D5D111BEFE1E128E33231B78E2DE72029D246F64778A97F0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498750, "uuid": "577d29f7-ff68-4c3b-ac77-6ff771378a0b", "value": "3072:tWJgI13Uf0sI5XyJS9sA2aGcYhrkxx2/+a:ob13s25XCKsPa68x2/+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498750, "uuid": "2e0d3279-18cd-40d8-8e56-5d95042df024", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498750, "uuid": "1a1166f2-970f-46a0-a216-1ae1adc1fdf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498750, "uuid": "b13afee8-1453-4552-9d8f-447d262600c3", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c346ae90-3b4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534059, "uuid": "de4b0080-320b-4189-b707-efc957e98e72", "comment": "Malware payload", "value": "6dc24150874b594e4a281268684d49c7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534059, "uuid": "814ef3c0-beb3-42f6-9fc2-b496031a9152", "comment": "Malware payload", "value": "c386cf8fb90c1343f58918608dd44e140e0052bdaadb6219fc2c1033bf2a8ead", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534059, "uuid": "0a7ee8c0-d439-4285-9af6-13e2bee4acab", "comment": "Malware payload", "value": "8f1ff59df67be78bead2dcef2ec563492b3a95f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534059, "uuid": "34386a51-8b08-4591-81c8-64b50888f503", "comment": "Malware payload", "value": "5e7b6db5ddf79ec749b4cc658b8070b2244aa08e4ba465085069fe3f9cbe28f9ae8f37ff48619a9a18c8c9be9fcf1726", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534059, "uuid": "49835910-7e42-4571-8c17-2d4181e66999", "value": "T107E4237E446C75809E045CBCD9EEAD1AA1DCC0067583AF3DAF132DD49CC16CA7ABE942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534059, "uuid": "3441ee86-6971-4b52-8cf6-7fe4441259ee", "value": "12288:6tUrzPqYNeFptIjCE6pXV1/OJj4526mPf0F4XIztqg4+bsNTv4CUkfghe+4GUsCU:di4mEVJE5feo44RqSGhgh/UFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534059, "uuid": "8d5b276f-3f36-4f6f-ac8b-2ced474d2de8", "value": 691583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534059, "uuid": "e32f4fa3-170c-42b1-84bd-082dc6769a20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534059, "uuid": "e9444c47-9c49-4d97-80a8-5170763c1cf4", "value": "Voil_client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d4f0e-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476918, "uuid": "a94c38b6-a389-483e-909a-b4cffc6b656e", "comment": "Malware payload (WeedHack)", "value": "e3d1ac63e3eb68f2f6e643af256227f9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476918, "uuid": "9824930a-c624-40d5-ac72-5a3eb3cc5bd7", "comment": "Malware payload (WeedHack)", "value": "c54ff24536f0024a2b3792c4dd98abefa094ed42bd6090838694e8c20b387f37", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476918, "uuid": "da1c0f47-9648-49ef-9111-1ab95970eaea", "comment": "Malware payload (WeedHack)", "value": "d60d14cbbe0fac6891926722be41179c224a3afd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476918, "uuid": "dcd5556e-dedc-4f50-b01a-10bc4a2b37ee", "comment": "Malware payload (WeedHack)", "value": "78109ee9c87a078589cbaf76d4b365b491ba2e8b6e6b0d90904b30d3c46224aca630e44413d6d5b97392fb69fe030015", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476918, "uuid": "abccc348-b2b8-4d49-aec8-aaa79c7b8668", "value": "T1BE1533177C8B12AFFEAD4FE29501B6A710112399B47EA70A3C810EDF3D925EF1953990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476918, "uuid": "e4ee5751-b977-4b30-8b9e-9a18aed84dcb", "value": "24576:RXLB7zMGy8EjEryMdGr7Fjaaz0F/6NgJaXb2Asuy6u:RXlvMGLKE+MdGrPy/GgGru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476918, "uuid": "ab1f7e6f-47e1-400f-9dcf-f6d26dfd8222", "value": 916856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476918, "uuid": "f3773983-5aaa-429c-bb8c-f40f9c3863e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476918, "uuid": "ee82e6a1-cdd8-4163-ad31-e1eca0c900a0", "value": "ChunkScale2-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9ba529-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776536998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536998, "uuid": "558a81ed-3b06-4f48-9693-ff2eebe66702", "comment": "Malware payload", "value": "d5890817abd8a6fdf6501200abac468d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536998, "uuid": "2f9aa1c4-e1d2-44a3-8bf5-b0e52dcb0b74", "comment": "Malware payload", "value": "c5bcdf9b83e768d01fcc8689095417eff0cad6c652e94697f010c723eb1963b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536998, "uuid": "2562c1e1-9e89-447d-9c2f-fa4b23c81920", "comment": "Malware payload", "value": "708ac90a92c6691ee8f3ba1ff98a2b1ad307c58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536998, "uuid": "4c65fb9c-d101-4c4b-96f7-462f84e7e444", "comment": "Malware payload", "value": "16eff06123a648ce6982baa8c36b3fced1fac4141a80c8c24eaa92dd31f979264a9326496596c532ad8502b60d378da2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536998, "uuid": "75d13fc6-459b-4a2b-8931-974ae84add78", "value": "T120E75A42A6EB45D0F9F79E7195F652274537BD066F3184CB620C1B2A5F332E08A73B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536998, "uuid": "7c240a95-d68b-4431-8f74-2f6a7749dd5b", "value": "6349935017fab6295626f276167fc0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536998, "uuid": "90b1012f-3667-4145-a490-ba11e1594cb1", "value": "393216:KgO1vAM4wCChmN4og3J0CzGFbyjCujm6KI46B5RVs+p+kQ2SR7rGvHvTUlAX6/N/:xO1/4wC/K+GOShrsxwbEiM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536998, "uuid": "842c01b5-acf2-4c03-bbbe-eb178e72514a", "value": 67051576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536998, "uuid": "d054c0be-bf87-4d63-9c1f-9e77de45862e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536998, "uuid": "8f2c30b8-3623-42a4-8cee-509ff18dccf6", "value": "Extreme Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cecab2-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476941, "uuid": "1c52f5d0-4a47-43e1-b658-88fdc6c41d8c", "comment": "Malware payload (WeedHack)", "value": "f5cc0a6172d1a300c5d101136e559397", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476941, "uuid": "400175cd-e56f-43d9-89aa-938322be5ec5", "comment": "Malware payload (WeedHack)", "value": "c5cc7b886147897f89f7622c6e0ab67b5c57ed85f1e1041e6adb1175f357d9ca", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476941, "uuid": "f5e710f1-2e91-425e-ac91-a153ecfd78c4", "comment": "Malware payload (WeedHack)", "value": "a940e194301b31b65b3fd0af0434094325438475", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476941, "uuid": "6906a381-e048-448a-812c-6d740ecdd2d0", "comment": "Malware payload (WeedHack)", "value": "89da115976bb0e1ea4bdb1555c283dc7769e1f2f177db612133f309f3e4de33005d6bfd57b83f6472cfb706350f96146", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476941, "uuid": "dcc444d6-0784-472b-ace5-4e7b185c32f4", "value": "T1495422189227DCE2FE6115F75F8785A33D40471E8D3ACA720C8A9B16913789B6E2133C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476941, "uuid": "d21351a5-997a-4c67-9363-29e567555f28", "value": "6144:FUEI+CUB4WsGscXsz2vm+d1C44U1sfSMfUb83BQGvuAYIvxn1v4EP8:Fx34PGBkikaeKMfg8vmAzxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476941, "uuid": "d68add64-1e56-4561-81eb-a234d286d17e", "value": 292008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476941, "uuid": "0d533aff-5a1b-4268-b370-e1a619e463f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476941, "uuid": "bb539e9a-e346-4813-aedd-40e692bbdcb1", "value": "Donutsmp-dupe-1.0.01.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67ba6f1-3aed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492914, "uuid": "b619888f-1978-4c27-962f-53e04b297b57", "comment": "Malware payload (Mirai)", "value": "367947179ff967359c6e18aae00ce643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492914, "uuid": "bad371c2-0c0a-4afe-809e-26f419232adc", "comment": "Malware payload (Mirai)", "value": "c6329b749ab154317bb8171e30801d065ff1f0d95cf043c97e744f79a8304bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492914, "uuid": "e1e8ae7f-b6e3-4dd3-b428-21cc54d013f4", "comment": "Malware payload (Mirai)", "value": "a4ed615c980267e6db95cd01df5f4bdf1c5f6fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492914, "uuid": "fc7f1d1a-8c06-43ea-b6a8-1254fcc27a6f", "comment": "Malware payload (Mirai)", "value": "ce8b95c99b818f800c182711e8c43887322fd1baeffd6ffc117d7ac76ae33f52cf012af10766bc7f3d6c179d0197b571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492914, "uuid": "33640cda-abea-40de-866d-0fc5cf69c710", "value": "T13603E0D959D22488CF9C1CF6A5BE02B20F8060DDBA757BCC371A1CCC767258BBA59478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492914, "uuid": "7edee95f-864e-41ae-896d-e3bc17f0010f", "value": "768:KhpGLq2YEQh5q10MxYWt/y/1tgPUcDpxz6TtYYWBbWx:epD2Ynjq10Qt/U89XziWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492914, "uuid": "468f5c45-da20-4369-ae68-32121f8a1492", "value": 38648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492914, "uuid": "b3bbcce2-a76f-49c7-8672-697849e6e33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492914, "uuid": "5609a850-a601-4aa7-b8fd-c088a3defecf", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2689e2-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488014, "uuid": "68eea3b3-e3d3-40e6-a704-a21a2ee663dd", "comment": "Malware payload (Mirai)", "value": "d429e780ba291fd4f378b73e3eaeceae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488014, "uuid": "924de8b7-5f70-483e-ace3-3c5964685a6b", "comment": "Malware payload (Mirai)", "value": "c6b963fd1c6a4f346fe80d6709e07abe757065d8771782d2a1051d9b2554146e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488014, "uuid": "2f95109b-d3fb-493d-b5fe-0168d1e9fb2b", "comment": "Malware payload (Mirai)", "value": "4aba6a62fe809c0e8d5ed2763e676c5e7c329ec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488014, "uuid": "45dd8e90-9355-4350-bbdf-3cc28cea408a", "comment": "Malware payload (Mirai)", "value": "47609691cd82dce266c6a3ecfd7ea67e7ca93ae50332b6a9ac3c470d2d05e2c749e944c5eb5ec49672d7d5d8e9dba6c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488014, "uuid": "caa46628-7e5e-405e-b059-0693fee6bd14", "value": "T1250418457C419E05D5CA33BAFA6E028933477B79D3EA7202CD205F5527CAE8B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488014, "uuid": "87935bc1-eaf6-4da7-bb27-fdeb2091cf3c", "value": "3072:NaAoV56MaoqNeUZtCgF7j/Cpry0iZa06hZS48WDQYByIq8nFtC2Ai:Yh5hZtUjCg1/CJyNZa06hZS48W8BILF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488014, "uuid": "67139bc5-be46-4035-8646-28b794205d7d", "value": 178216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488014, "uuid": "ecb61d89-fb1b-441f-8e5c-eaa0d36160d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488014, "uuid": "b335fc27-2fdc-4860-83ee-8732548325ff", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66097cff-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527461, "uuid": "7efc8781-2a90-43ae-8091-714d07672afb", "comment": "Malware payload (Mirai)", "value": "8ae228bdd386902d6884714737078e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527461, "uuid": "0155e1ba-f388-4eaf-a7e3-dd49fdf0a8b1", "comment": "Malware payload (Mirai)", "value": "c8485b74269be51030096c84bd1373c351982cfd95c6f07c04a0bc9693bc040f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527461, "uuid": "98a71800-f8d8-478f-b769-af03b18b3d22", "comment": "Malware payload (Mirai)", "value": "e34c94fc6065adea171007932661fba3e45cad7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527461, "uuid": "1c2dd67c-1a5a-4dd6-a784-bddd2e074801", "comment": "Malware payload (Mirai)", "value": "809591d50a626200a308852b2e5c0eb8c2c6c76cc0a4cb93ce4da18dc927202e15b04fc9f43967b3dd9e43779a97a5d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527461, "uuid": "9acb81bd-09d4-4225-a230-68cde22cf56f", "value": "T176C3F185BB6369D1C1A242BDA4C00AC387912E318BA317480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527461, "uuid": "8a47e3b9-c593-4f15-8c4e-fa6c162c168c", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnP:0OCDjXG9qTWywxlxTnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527461, "uuid": "7801df9a-0766-4324-9968-8b8c23f1c397", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527461, "uuid": "d6e1b59c-4cbd-49f7-b980-c1fab0f49fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527461, "uuid": "b57eb40a-9cd2-45f4-a7f9-27c0b291008e", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaa0d89-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476898, "uuid": "fe2e4d94-8276-41f8-a97e-9bfcf1f0b749", "comment": "Malware payload (WeedHack)", "value": "1219ebf54ee2f11413c9f1668b4dd828", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476898, "uuid": "843e2b0c-42bb-4ebf-b49b-08f4ee2d9196", "comment": "Malware payload (WeedHack)", "value": "c8d87aea5b567c52cb73659774df155d540b7465507564f351d1decdf121373b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476898, "uuid": "817e58ae-7823-422a-8d8e-08184b75b100", "comment": "Malware payload (WeedHack)", "value": "6c7d0c9bfdf63dd485b764b080cabc11791742ab", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476898, "uuid": "6bcb0066-11d2-4b56-9f12-ae18c475c0d3", "comment": "Malware payload (WeedHack)", "value": "a656f9ad164b07d3843ece8eda6e9acd838af28fd389ab8741dffe484923644fc7638cc280fa33f3a94e966ade4913f1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476898, "uuid": "49c86db0-9c67-4403-9166-cee56618b228", "value": "T160253327544E04AED14E193245EE2C9E6FCFE5B40B0293999D5F7BAE3D49BCCC612CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476898, "uuid": "176b6e21-19aa-4ebe-9ea7-09beac23fecf", "value": "24576:q1lvb1zPd8YUmOaN1biMhAvAldVIv/GH3fRIrrs+tD:qXvVQBPCAYldVIvACsmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476898, "uuid": "ecffe8d3-a760-4291-b312-d1374094f95a", "value": 1000171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476898, "uuid": "0c611b11-4677-4ad3-827d-132f87824ec1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476898, "uuid": "55e4b730-b7c5-40d2-88d1-1cb2b41a59cc", "value": "Anti_Gambling_Rig-1.21.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584a9853-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530444, "uuid": "a27d4a7f-05af-4aef-b16c-65335a23b650", "comment": "Malware payload", "value": "a3773aeade872be33b7c109536774097", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530444, "uuid": "b8e34e92-42bc-41ae-a2b9-94c84d466ad6", "comment": "Malware payload", "value": "caaf1e95bed443a8c2235b0263dec404445798b8d8560694137acb77309efae2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530444, "uuid": "ffccd28c-ba1d-4546-9499-773d713a4601", "comment": "Malware payload", "value": "8d36b5f0e2064195e10a3c3df35938ed9c37c04a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530444, "uuid": "2c481eec-f2d6-4d72-9497-1d50a3afe9b8", "comment": "Malware payload", "value": "90d53db7b52fc4100707510f7d64b5a6784127fc2f3ff864aa9f422ab68bc1ded6882ccfac9ae2800ae5e92a81af6595", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530444, "uuid": "5811dcdd-b010-4720-aef4-38fa0b5781f8", "value": "T152C5023A93688C17D987FE7FDC61D933A43A10D7E21B259A64E98A41D24FB6007D8F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530444, "uuid": "e835d4fd-2b3d-441f-8439-e001a2e272fa", "value": "49152:caw65wXfZcRouYE15hrCsWWHYmUjGUiz7aHU0+1Y13TM:6cXfhrCmoGDzOie6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530444, "uuid": "006db274-ffd2-4858-9fb1-b257a93e08d3", "value": 2507533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530444, "uuid": "7bf30162-bce5-4c17-adb6-66ba970571e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530444, "uuid": "8c666220-a4ab-4c07-ac7c-bc0f158cc7da", "value": "DonutClient-1.21.11-1.3.8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee76577a-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537568, "uuid": "132ea84a-0c1c-4787-9538-b404770a1d0a", "comment": "Malware payload", "value": "cb832030d75c4c4735363966fe1c4814", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537568, "uuid": "9391e9cf-c6b6-45c3-a920-be04e7536fef", "comment": "Malware payload", "value": "cba57c00a6367ed71b7c077d122699a27c5880ca997a2c58b458450ed1d59a88", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537568, "uuid": "da911cf7-c36e-4e84-a633-d11fe877a036", "comment": "Malware payload", "value": "92b68bbc1b7f6885864fc76ecee7063d825dd63a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537568, "uuid": "d5f9545e-8e06-4b15-b0a0-8ab235ee528d", "comment": "Malware payload", "value": "716dd49daf9f3040b575b96709c8b0bf5cdbfe8d18e07a445c5e0c02535b16aca8886da703901bd1bf9867043f2d9e0d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ukrguard-org", "colour": "#168A8C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537568, "uuid": "6b18ceec-2918-47ce-ab43-265353a917e0", "value": "T11661D9321573641262F732159F26A342EDF49A07755AD84CB56CF14D4F81FA190F714D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537568, "uuid": "f77ff0eb-9c6c-4b18-96d7-a406af154e73", "value": "48:klnobttBvVOKCHIzKmjhZ+2+fpP6y4HRCt8mQpndoxS9MR//GsZVEXL5r:klnobttRzCH3mjG24d4HRCt8PdIple5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537568, "uuid": "ed75762e-aee8-4032-8bbb-b287a548c49f", "value": 3345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537568, "uuid": "f025b67b-8057-42b1-9389-bf95356a08b5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537568, "uuid": "d8cc41dc-f7aa-4db7-bac6-9c7ddacd155f", "value": "cb832030d75c4c4735363966fe1c4814.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a41666-3ae7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776490332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776490332, "uuid": "02a2db10-aa01-4ee6-a017-fa40b7c153ce", "comment": "Malware payload (Mirai)", "value": "0ee5e61ee1bd87fbf45fbcfe9b5a04f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776490332, "uuid": "cb1e41a1-7bbf-4cdb-bd0a-f4e6913d10ca", "comment": "Malware payload (Mirai)", "value": "cc105f72dca0ce157c3f5cffeaf4b5cf981fccf71dee6c469127649768ffeca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776490332, "uuid": "e8fc14a7-3af7-46bd-8d6f-6d3db7dd9129", "comment": "Malware payload (Mirai)", "value": "603bb5f7a5fb639ed2a7a91b1055e789f45b0e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776490332, "uuid": "8414193b-7fd7-45cc-9a3a-c86094e59c1a", "comment": "Malware payload (Mirai)", "value": "60becd12d2f8013a7f010149be2d6cc4fbb60c0064de4509a824028ee4cb8aa8ef3118d31f07bc1bd1513e03507d81de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776490332, "uuid": "e439e9a9-89ed-4237-9043-681ec0a6795a", "value": "T160C2E06350B5CE03C8F3837B6A3D5AA722605435A35EED2D73A94BC833460D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776490332, "uuid": "837dc7b3-ed9e-49e4-8ad6-f6c65c9eed70", "value": "768:t5+Kcrb9VDJee2KTgdTHOBcK5ZCAy7siK4:Olrb9veKTg9QB5VTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776490332, "uuid": "1359568e-3ae4-4a89-b5ac-6a38d7ce3a51", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776490332, "uuid": "b18c5e0d-31f5-40d7-b8eb-07a57026196e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776490332, "uuid": "66fd4c6e-3090-4472-ac3d-f246dbf62326", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ce656a-3b67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776544984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544984, "uuid": "5231a333-084f-476e-a58c-8544b82bebdc", "comment": "Malware payload", "value": "5d4e44b05fca23492bdc39e4a7155d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544984, "uuid": "8d52bf53-7224-4fb8-aa86-60b4f9a7412e", "comment": "Malware payload", "value": "ce2fca0db731e36da749a29add68efa34e7a8565a839a25a4be51d6b0f5f9de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544984, "uuid": "f5e2de7d-d7a1-4efb-9e42-7d1ce06702ac", "comment": "Malware payload", "value": "79292bf5f63592ce0aa25352d93cd0fcea0a9c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544984, "uuid": "d0de9ee7-04d9-4d9a-ae62-43731bd045e1", "comment": "Malware payload", "value": "1876ad4bd61216dc2cf7b16e2494f878a8f4c435baf29b24202f2aa31ac77ca9fb97ae1f480958fcd2600c984b95a38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544984, "uuid": "fd4c70e5-3065-4011-8e81-40dc847657cf", "value": "T1F2D622FD59D562F4C5D34A40328743AA71D1316D42EE4C293ADB2D402B26CBF264EEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544984, "uuid": "2f1e05ef-846e-48da-b634-fca1e8f3ace9", "value": "ea12a626d41b5326331c230d1a4427d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544984, "uuid": "205d1651-d719-4f98-8c80-c71202bd63f1", "value": "196608:xJOleXJW70ebQPw9c2KMjwG6jqC/DUAF63AHIb38nRnMDS33aOl5cIO0FTcC/:XOleZB/NMkPjqEDUAFSA0yTKqO0Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776544984, "uuid": "b8408769-96f0-4819-9765-758fc6eea005", "value": 13052376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776544984, "uuid": "99f8e4de-1776-4686-ab5c-66b886387133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544984, "uuid": "23fb8df0-e350-49bf-9b22-67af0e345514", "value": "GaIa\u0445is.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0108ad-3b4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776533614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533614, "uuid": "90bd0537-51d8-4f85-871a-1340b2169a4d", "comment": "Malware payload", "value": "32a72c64ec3b4d330dd35e48a9f4d33d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533614, "uuid": "15156ab2-45be-458f-a1fd-7d9291e3c775", "comment": "Malware payload", "value": "cebeee0aa2b16a9675d9d8ab9f33970d8ad798565f2f1b29d54a58b89fff6094", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533614, "uuid": "78312caf-5c6c-40b2-8ae6-1440d5462032", "comment": "Malware payload", "value": "e7681ec4e30c913ca155127b1aa3cf1e86868caf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776533614, "uuid": "158330f6-81c8-42f7-b3e9-0c515ef6711c", "comment": "Malware payload", "value": "518474b5658225b54aafb487c939c717e18a94cf629bb7c3e8951d36431fb11563c92876dc84df34af2a01fe6e300b9c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533614, "uuid": "a07ae3cf-09c4-407c-97ee-eff88eb46925", "value": "T1E9C7DF86F61CD812CDB16839994D9676B3263E309A83D3C3B804A75D7EF3AE00B257D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533614, "uuid": "217b3aa2-adfb-439a-8907-c18ef15f9a53", "value": "786432:MFf/2gky6d+0T6fjCUS0sXL//MJWG/QEsbnmhShcLFXy8N:MIUP0Tb0yGodbnmnXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776533614, "uuid": "4fbadf4a-5a7e-4698-a190-7b35314d312a", "value": 52789489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776533614, "uuid": "4dc170eb-bbed-4603-8019-9023e184def9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776533614, "uuid": "7690ce91-dc8b-4d39-9c05-5b6a9e6ba05a", "value": "com.colorsms.chatsms.textmessages_1.9.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d67c2ef-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484523, "uuid": "f53151cc-0d52-4e33-89a7-fc03daba8a3f", "comment": "Malware payload (Mirai)", "value": "88987b628c4e4993bbc8193fdd4b04b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484523, "uuid": "7be05ea5-50c8-4c4a-85f2-28c9e18c153e", "comment": "Malware payload (Mirai)", "value": "ced05eb98adfeffebbccef107d117563ee5c3a589103a9f287fd8d1711b68579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484523, "uuid": "2f59e304-134f-4321-b6b7-8c24e776ccf0", "comment": "Malware payload (Mirai)", "value": "7547acfa8a2a4a224b002c8e392d184ccc0deff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484523, "uuid": "3d95f756-08ef-4158-b675-3be80e73a87f", "comment": "Malware payload (Mirai)", "value": "747a44cfcb3ef07c61e47c055d3b2433512272e1c9d671d21b664ca91300a62d712a713b7eb8371604c0f08fa2a956d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484523, "uuid": "8d1a118c-7ce3-4914-b408-ca53e26bc2b1", "value": "T1402308C27941B639C3D157BBEEAF014E3354A7D8D1DA3397C8280B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484523, "uuid": "c062119b-7ceb-4bb7-b4a9-229ae093c867", "value": "768:sJeKpHsmyayL1ScT+GRvFES1un1wnjvsDoCerCw7sC/wnX+6k7wCVy/rCxHghW1r:sYFmSJScT4MjvR7sC4nXPfhWt59seD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484523, "uuid": "d5240499-7c67-4468-b3f2-1528d795ffde", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484523, "uuid": "48d4d06d-1ed1-4165-8433-d7fa6d7a2b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484523, "uuid": "7de79f15-8b5f-4613-babb-c4f3c043ed6f", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fc55ed-3b13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776509235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509235, "uuid": "c8a59db7-55b4-4363-85e8-6ff8ea6fe14d", "comment": "Malware payload", "value": "93dc81df7e2c8ff31a7e35268c4d24ae", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509235, "uuid": "a716f352-c7ce-4ea6-b750-a1231cb1967c", "comment": "Malware payload", "value": "cf0c99b8b06358d2b68ac532b058d34151ba008d443043e63a2733d1e3ffb4cd", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509235, "uuid": "0d8ec7df-fa8e-4c92-a5f2-4778c74ac980", "comment": "Malware payload", "value": "9a3b6ca5b2dda15e224bdc03ee1c5b02782e3a27", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776509235, "uuid": "8a144ac9-5b47-491a-b3f9-bf70bdfec2b5", "comment": "Malware payload", "value": "eaf23933a34b96e35a26172331e564cde9983bf88e986217ee2bd4128a20844389793c6ac0711462e87c35106ab0d2ac", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509235, "uuid": "976b4ac6-bf6b-4d22-904b-d3dbe6bdeb1a", "value": "T1A492C61669B300226957C0BC6BE79746333180079645CE2A3FAC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509235, "uuid": "6bf9d94a-097a-4fe1-af38-ffecaff6e50c", "value": "384:X4FTAsXe7FUFh/+4MAWksb7Rwsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xe8sXe7FUFs3isafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776509235, "uuid": "08a92ebd-ff86-4020-9915-fe4499a04e7f", "value": 20080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776509235, "uuid": "ef88039d-c074-4b91-adc3-68dfa41973c9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776509235, "uuid": "254f1016-e362-4c65-8189-61321253f258", "value": "r8QxLm4Wn7pVs2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69626ce5-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527466, "uuid": "fcba95ad-e4a9-4493-a897-fcc988e43744", "comment": "Malware payload (Mirai)", "value": "808d07325867be608f74f02a348e1156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527466, "uuid": "f3d5196d-4011-452e-b231-09574ad11f81", "comment": "Malware payload (Mirai)", "value": "cf0ef4534a5f906a8dd917ebc4ec7d542964c83bbec56aa49affeadf99729bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527466, "uuid": "81440175-a47c-4e80-9e1b-75a66453fb8e", "comment": "Malware payload (Mirai)", "value": "37738b4f8846fd37e67c485504458637559464d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527466, "uuid": "2481365f-932a-4218-922a-ee3fdc2f6e78", "comment": "Malware payload (Mirai)", "value": "024215c08e696f4c7b9ab231c942202525c27dcc7f9c336151cd471d7f430774039c42c83dcf28c0a58d7bb4c2c8dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527466, "uuid": "f4be63cb-0ad3-45db-9f0d-c74bf5c2b0e4", "value": "T1D6D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527466, "uuid": "7d52770f-3adc-419e-beec-66454cfaed6c", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zx6:xOFgpOEoVv3MXL5NhGOx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527466, "uuid": "52b282c0-2580-4160-af12-2d960fe26978", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527466, "uuid": "abbcb1e0-0380-48b4-a1a1-8f2daaefc10a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527466, "uuid": "38ad2efd-002d-425a-a579-57bffca5602c", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8e267b-3b15-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1776510080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510080, "uuid": "4d892074-16ad-4143-8cc5-edb27f5f30a5", "comment": "Malware payload (EternalRocks)", "value": "4c7890d035a424338d099ba9143ecf6a", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510080, "uuid": "ac58beff-9499-4c9a-bf26-ae43bd82ca9b", "comment": "Malware payload (EternalRocks)", "value": "cf2493bb1f5a23279c80e62dc4c6d9a75fe0572318e8947d753ab9a53ec98c0e", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510080, "uuid": "0c19ef07-96f6-4ad5-95f3-de7e16d6af7a", "comment": "Malware payload (EternalRocks)", "value": "13af54233ffea48689727ce9c77f69f7d5ca6175", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776510080, "uuid": "2eef2854-7ffd-4877-ba5d-45c9c56ad473", "comment": "Malware payload (EternalRocks)", "value": "0f74eca83df9b1cac2b30ca85d5149328e61a0e67042b9a84ce6455667b6e3d1e0ab523fb7c52dac42728daa5f396a03", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510080, "uuid": "193fa321-829d-4dc5-b085-f3eb544d2d2c", "value": "T157163395A3627737D82E5AB25DB1A644626CCDD86BC870070018F5C5AFFFBA300B45AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510080, "uuid": "b5659863-688c-411a-8ce8-130899a499c9", "value": "98304:Rj9HqBmrbiHFZmaV+9Vb3hKL1t1G/wKE77e90NNx74q4c0:Rj9smXgmn9vo1tMIKE7K90Nz7p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776510080, "uuid": "3df2d723-e03b-4adc-a1f1-5c3359f6d1b1", "value": 4411392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776510080, "uuid": "de4e069f-b420-4f12-94d5-7eb1ece6b8e7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776510080, "uuid": "b350020b-c85c-45cf-a88b-06479eaa0db6", "value": "install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbbd703-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776498754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498754, "uuid": "eebdd253-8c05-4f9b-bf27-b012f116a8b5", "comment": "Malware payload (Gafgyt)", "value": "cbfde00fca43e574f4d60ddaf866aee9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498754, "uuid": "3288cfdc-5182-40e5-a4f0-fe13a500c685", "comment": "Malware payload (Gafgyt)", "value": "cf4c18be5c3a6ea93ec7de77e15d41a089c41b8038c8525a44fda6c6bbecbbe7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498754, "uuid": "55b37963-6a2e-486f-ab54-68e736e49622", "comment": "Malware payload (Gafgyt)", "value": "85b25caa360c4bd137c1a6a5727a8c16db1c1f7e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498754, "uuid": "b04a4fc6-4b2d-4d9a-82fa-d14988b51d39", "comment": "Malware payload (Gafgyt)", "value": "53f458b97cc161e905e763eb29297c75d043e752d3cc39351677e7a35a7cf96694a1ec06b1226eabccf052d41f683c67", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498754, "uuid": "f1dce057-c158-4595-950d-4e772f6bdf0e", "value": "T174B3D73726270EA3C2C6247101DB633896BDDE94BDA90ED7F9817DD83F0AD8439592D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498754, "uuid": "a1c23ba9-43e0-42fe-90b0-38e5f73eaf64", "value": "1536:a1bvC6BnZIntcd6NM5GtXIY4UuVzMum1jTGq4Ic5jWnc:konekN8AIY7vum9TGq4/5jWnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498754, "uuid": "5b196e37-b0fb-446b-9d8f-42ab389c6e4a", "value": 109892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498754, "uuid": "4e5645b9-5854-41da-b040-f96d235960c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498754, "uuid": "5072b362-04d8-4baa-bae8-03eab54a87b5", "value": "Demon.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9050bd9a-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545570, "uuid": "78fa2748-c54d-4142-85f6-a5c27d011443", "comment": "Malware payload", "value": "a742d51048865812591a1bd4b515dac1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545570, "uuid": "d4d9280c-9df3-42f1-9d85-74e7a2c3a30a", "comment": "Malware payload", "value": "cf81be48e31a7a62325e5d2c17774229481a260375314acbab80385609d62cdc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545570, "uuid": "f4e8d3b3-9014-4e8f-a9e5-5e7c60e62928", "comment": "Malware payload", "value": "93f7ae7a986d286941bbac88045e5099b45d7179", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545570, "uuid": "fc500ffb-105d-4cf0-be22-f9fc66b7453c", "comment": "Malware payload", "value": "4faf4e9f99230ed9506901a28946808bcca61416cbe78654f87433976dff8625092b98c6236484a50ac70164b236e308", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545570, "uuid": "cb3787e4-3db3-43f0-a220-3351ddeaa01d", "value": "T163C2E11922DD9828DC1A43FFAC4CBB12F93F8041924F761F516108BA5F5A6DE8F4A7A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545570, "uuid": "29ba83cc-d788-4ca7-8403-6dc0ab153492", "value": "768:Y19nEYC9V8JeDsHf46N2nk4rjmGGWq9XN:YDCv8o6fnskujm1H9XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545570, "uuid": "b9fc60e6-813a-4137-9c15-ade126f49946", "value": 25830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545570, "uuid": "87ce9c63-3a09-4b21-ac1e-a1952fd80eaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545570, "uuid": "74f2ff3b-f2f6-4f67-a52f-7bd8a8ed8b59", "value": "CastroLT4Optimizer-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5164d1c8-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776493066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493066, "uuid": "782ad013-503d-4180-b438-8e6347e55a82", "comment": "Malware payload (Mirai)", "value": "86112afd261b401e3e424125b5d209e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493066, "uuid": "6303e7a5-6f4e-480e-bd88-d33a64797106", "comment": "Malware payload (Mirai)", "value": "cf8c0fcfbe5ea24d00c6620c4192b4407ba9c8083e727ee7644210accf2522f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493066, "uuid": "a239e80b-822b-41d0-8546-9588320d61fe", "comment": "Malware payload (Mirai)", "value": "a351e7b6691f4872e0296ee0bbbd2e1647abb7a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493066, "uuid": "f2470318-7eb1-4d1d-82f9-ead3ea3697ff", "comment": "Malware payload (Mirai)", "value": "b209fef3316ddbcd0cd62fc430653b52c6f912e528d42fec98cec87c4c0d7bf17fe6c741619554361bd40d7b3158439d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493066, "uuid": "5ed20bbf-088e-49e4-9746-324a7ea51b45", "value": "T1C7735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493066, "uuid": "d66c6492-5e5d-44cd-8f59-5adce44962a2", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fVA6t:IfmhxCMRkg7IF+7SAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776493066, "uuid": "11e7a243-320e-4c8c-82c2-a15079933774", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776493066, "uuid": "f6a2104e-6a70-452d-8408-7c87056ffc5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493066, "uuid": "20f15be4-8f83-467f-9664-91d8a5577763", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235b01a5-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776526919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526919, "uuid": "a036c632-0a3e-4b22-a0c2-b5d0b6f0044a", "comment": "Malware payload", "value": "0f4f7ee61801505e88d395a5b52d7710", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526919, "uuid": "785d74f5-5be5-4feb-92ba-346327680eda", "comment": "Malware payload", "value": "cfba57ad51d85b052d1b9c24ddb8abe35dc1637df6a3a624184489a415066031", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526919, "uuid": "75927165-5c71-4995-9302-0d19044829ef", "comment": "Malware payload", "value": "9fbc091d8c9930c26ade6f16c324c85bceb6e9cf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526919, "uuid": "1c2ce65f-d3dd-480c-9c57-580320be61ef", "comment": "Malware payload", "value": "58a5eeefb34f3b265a838484a018205fae98e8ed574ce4e691acf52c5ee4002dba8c622f3343924468ad01c519307312", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526919, "uuid": "71cc159b-7257-428e-ba07-96853537f21a", "value": "T1EE33E138F02848F5D82F527CD4113E91240D5147A971BB3BA9780BEB4967C07B7D9E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526919, "uuid": "951fd2db-6494-47bb-b4d0-ca334f5f1d13", "value": "768:wMtlsKzYA1d1JVJgL6ufxQKEH+YvBvR9nSq45mzYoPpf3WZ+WUy59lMqk2FWxn:wMtlsCYwjgL6uKJP9nI5mzNB/WZ1lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526919, "uuid": "138f40bf-e056-4991-9621-6e0ad62355b9", "value": 54371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526919, "uuid": "4ed57931-6542-45e6-82ff-e109ae309e19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526919, "uuid": "021ecf78-7280-476c-8378-623b17820026", "value": "Name_Changer_Plus-2.0.0 (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b01213-3abf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776472986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472986, "uuid": "12aa2fd8-e84b-4136-8de5-f8026874cac8", "comment": "Malware payload (WeedHack)", "value": "def6c999757e521debf7edee1e8f0304", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472986, "uuid": "2c21c0c0-4689-42ac-abf5-2e03eb78b053", "comment": "Malware payload (WeedHack)", "value": "d0971ec5124d824024043b6fc79d1f70c24c74fedc0927899008ce27c1185c94", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472986, "uuid": "bc2041fd-a92b-4502-a599-f18e8cb9a6e9", "comment": "Malware payload (WeedHack)", "value": "7ade3c934fde58080f18725f7c69044898286b5f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776472986, "uuid": "4315c78c-7848-4a3b-9501-a46d8c8cdbd0", "comment": "Malware payload (WeedHack)", "value": "5ae0e8978841ceef41ca9d11f14048ad0b60089cd223a3df80e920937de14e4d46acbd07e3b902c0ad6c56f5eaf40f29", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472986, "uuid": "a6c235d6-9103-4b33-aaeb-adfc372603c4", "value": "T191C5013A93698C17DD07FE7E9C61D933A43A10D7E217318A64B98A81D62FE6007D8F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472986, "uuid": "13241545-c73d-4b1c-9a7e-9849529429a5", "value": "49152:5awC5oLvlcRouYE15hrCS3f8vAiYR8kUdZC6qx0IRp62W:RcXfhrrZiS85dkg8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776472986, "uuid": "3296dee0-80c1-492d-bb94-4634bc661a93", "value": 2507317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776472986, "uuid": "80917a30-8f2b-4f6b-971f-8a87d1c622b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776472986, "uuid": "d92a526c-e136-4c48-a6b9-048e61c4ef8b", "value": "Duepy-Mods1.21.11-1.3.8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c30d231-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477059, "uuid": "af22d514-805b-4e71-91e7-28bc288c8ebe", "comment": "Malware payload (WeedHack)", "value": "74232d14263624ec05631dc616fa99c9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477059, "uuid": "d74c194e-a933-42d8-8093-00123fa89636", "comment": "Malware payload (WeedHack)", "value": "d144746fcf586db228025357fc2ade36f27d0753d21b9d21cdd910f7d2112af0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477059, "uuid": "07e25806-2199-45c7-ab02-af79685658b6", "comment": "Malware payload (WeedHack)", "value": "f56021abd69763735d00349cc3a213b9669928b5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477059, "uuid": "4573ce87-07b1-484c-8f03-e091659db27d", "comment": "Malware payload (WeedHack)", "value": "114c77ec31de3666aea17ddb7d34da4233969ae671503035b8dbe2c4043448a99e03563e2670ea7be6ecdd496e044d77", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477059, "uuid": "e7b501bf-815a-4ab7-be1d-8c0284d8df59", "value": "T122E4C787F1208AC7F44FDA7F14514210AEF0E4704A07F2561B6E885A6FEB9C89E653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477059, "uuid": "c5aef56b-d84f-49da-9135-cbcb54f795cb", "value": "6144:W1eMX5Uh/W94gpr2TEPjhMoge/BRReGUuOJubBi94CUj8wu9/1fp3x1Zr2T:WdHuuLW9R/1V4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477059, "uuid": "377c1a48-ccdd-45e7-b724-1f79fef2dd35", "value": 702597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477059, "uuid": "2cfdcd10-81f5-4c74-88e9-eb1a44c1eeaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477059, "uuid": "7147c932-d5d4-4e9e-80e1-c6c05d4118ca", "value": "Radium_1.21.1-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935d5302-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488023, "uuid": "00475b5d-a0fb-4102-a0c1-89799139798f", "comment": "Malware payload (Mirai)", "value": "293ece7b1e3834926d06aa721a8ece9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488023, "uuid": "2f82ee86-0e71-4bdc-a7da-809974d6c3ec", "comment": "Malware payload (Mirai)", "value": "d2a74aa5108e5f931482f2975c2552244170f0844c6c1038761c867f67b7f5fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488023, "uuid": "68964833-4db9-42de-ac82-e0fa5a84e930", "comment": "Malware payload (Mirai)", "value": "8bbefe62ed8f251923f3c111d6ad6daf023123a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488023, "uuid": "a2eb28dd-6ec7-467b-a034-1e29ffb016e4", "comment": "Malware payload (Mirai)", "value": "f2133b0322e46f815db63d52bd5566494776fcdd2627f43403d5873cb9f91f316ee5ef833df5b2665edaae80ae52ddcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488023, "uuid": "8bb7f6be-8ded-42d1-b9c6-8725751b1f10", "value": "T1B3241A42B8418E16D5C522B6FA6E428D33173B78D2DE7212CC24AF547BCADDB0DB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488023, "uuid": "e969b54a-844b-484e-8d28-e9ba0838bd84", "value": "3072:4onjr+J7I8RfDfOSi3Y46vQ1MYNDf2a3Z6oisAzSuc2anRmbjq/7aS:Rf+l/Ff7SYRmbf2a3Nismc2wIjq/7aS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488023, "uuid": "a978759b-920c-4f54-bcf9-445ffdc18f9a", "value": 210324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488023, "uuid": "6fd39ac7-6455-4d7f-9935-d9ea46cea319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488023, "uuid": "c31c0864-1a92-4dfd-97b4-18f30ce19d39", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5b3c84-3b34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776523175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523175, "uuid": "766a0213-5251-4cce-81d1-6d2b88bdd701", "comment": "Malware payload", "value": "92d42d6b836b592e9266e79e2796ca6f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523175, "uuid": "caab3296-035d-4801-beef-3539548dfdc3", "comment": "Malware payload", "value": "d344a9b2294db5f32e9726e4edf8d65149566832d9f5c90c6581cdb97d4e62e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523175, "uuid": "bc1fe2a0-1b2a-4067-b150-a9d5f7c5dfb8", "comment": "Malware payload", "value": "a6c1e5935f589e0c6b203fc664af4dd3446b4b4a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776523175, "uuid": "f34d2e7d-6401-45cd-8af8-f7b9335e2ea6", "comment": "Malware payload", "value": "b063f31db4c4d26e4b23fe537e557e7cf012b0f263339f32e182b1839cc458179ce4b139f774114ab8af66bbdb00b020", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523175, "uuid": "f7cfa718-7728-4848-8e6d-1bc46f0f3e49", "value": "T146967C07EC9115E9C0A9E63486669253BA717C485B3133D72FA0F3782F77BD0AAB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523175, "uuid": "67a99ca2-7923-4207-910b-def7cf0986d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523175, "uuid": "f9cbbc55-7291-4183-82b4-610b5d526f77", "value": "98304:Xfde5NbjROl5YhbSoYwEtfNK73wklaIjNXI1MkV33osiE:XfabIl5YhSoYFfNU33lHjN4CkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776523175, "uuid": "885c56b8-f056-4289-b021-6a745d781418", "value": 8703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776523175, "uuid": "2e9eb841-4dc8-43c3-a901-90359b73b05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776523175, "uuid": "37bc26d2-5a76-48dc-9f20-b7adb6acfd65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37abe78-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551320, "uuid": "694077b6-6570-4f12-9d65-656f9eaa89fe", "comment": "Malware payload", "value": "6a66ec5fe6dba70ca002f8d097c0086d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551320, "uuid": "2b381d37-b2ee-4416-8e8c-1f97deaeac38", "comment": "Malware payload", "value": "d3a6b4e0f61e98d4cc87ee78b775fd0db76acaec0094fec8800fda443a40735e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551320, "uuid": "71978c46-48f9-419f-92d0-bda336373948", "comment": "Malware payload", "value": "d620edd93ae16527de33686889cf24743b42a7f8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551320, "uuid": "26b5184c-44d7-4b5b-b675-42c8aea2d850", "comment": "Malware payload", "value": "4743e278708387222907333eb5bb9efc675fb4a7639e29261e81a3fb28578ea50fa4db39cfc65854cd1aa2903f7432e5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551320, "uuid": "b9bf9569-339e-488e-b556-2bc529f8f325", "value": "T1D885CF11F8AF2878DD439231D2454D31157935C5DA0B219BBBEB8B0FAA26EC4934D3EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551320, "uuid": "1a3be8fd-df2f-4720-a286-511e32ef5704", "value": "24576:8fL97t0G6yjZ8ozwrEEbU/M6u28zayLmMJwELpd2ijk4N7OBVJSzH8Gv8bnc4rbk:8fL9++JzreUEfe1MJ68ZeUcGvmcWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551320, "uuid": "758960cf-2093-4b31-a151-32dec6747cf0", "value": 1838724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551320, "uuid": "5668f60b-b71f-4b66-a716-a7996d1e691b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551320, "uuid": "7af49071-2a18-433c-9d2d-73054e5c794c", "value": "Sodium-0.8.7mc1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d7ccda-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551272, "uuid": "120239b9-aa8b-4c92-88ef-68b8a428bae7", "comment": "Malware payload", "value": "f85d1492f56517ae3517c73654c8b4b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551272, "uuid": "d36ec263-c0a6-4a1f-8361-7a9848c078e8", "comment": "Malware payload", "value": "d3a959495b5a2aee4e62d3cc95b1961b4147e42c89c4a1b26c15e853c66cd89e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551272, "uuid": "0b41fea0-95e1-468d-8deb-f30e8a98329f", "comment": "Malware payload", "value": "8600e6282e32a5c57e284cf1c38550e77d259b95", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551272, "uuid": "e11baf19-62ca-4559-afeb-3dd7c19c1f34", "comment": "Malware payload", "value": "cd181e662ed9434586db86a5a6544b93aa8a2767392592a50e8b0812a693517b948a888cf001ac5ad22f2d1e21d00828", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551272, "uuid": "214cabd2-3ba7-4350-bfab-223ae5c91819", "value": "T134C2D12B994DB223C60B2372755BFDE13F8E0741660237BC6D55E849A68377793893D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551272, "uuid": "fc8a84c9-1a4e-49eb-82bf-5a597b552a1d", "value": "768:irnP9nTJ5rHLiWu6e2+QKlINQ7GqgjEzZ8tcIXnRWcy1txYQromXE2hw7MG67wk:iTlJ5rHLiWu2+QKlqQ7GqokZdIXRWcyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551272, "uuid": "09691207-1f80-4fd8-924f-7613c73264ae", "value": 25768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551272, "uuid": "8bbd252a-b526-4ee1-8ad5-991326e5092d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551272, "uuid": "a460dc83-5d3f-4c7e-bbfa-85257e450c3c", "value": "cracked_radium-1.3.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bd7468-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494199, "uuid": "db6d5bdf-56a9-4fdb-8d3d-dda306862855", "comment": "Malware payload (Mirai)", "value": "0bc30f1cf8152ae19c03f3b4faed18cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494199, "uuid": "78664d05-a3ca-4e76-9e69-9fd03fd6423c", "comment": "Malware payload (Mirai)", "value": "d4caee185f73fb3fb15d7248db87db47998dbe6edcde4b6622b8cb1fabf30c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494199, "uuid": "d398e9f6-9f03-4151-8c2e-ed7d8e4a181a", "comment": "Malware payload (Mirai)", "value": "8833ccfc1b19cba8b65aa6a283b70c66635781ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494199, "uuid": "14b6fde7-79aa-4b91-9e23-2e4e6cdb34ef", "comment": "Malware payload (Mirai)", "value": "9d057d056f5a5b68346e30cc987bbfc00174b7c987047b7e870373222651d6b5d0cb2b4a751fcdf99a758b83ff56d5eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494199, "uuid": "445900ec-87b1-46f9-a253-c451b327c3ae", "value": "T1D2533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494199, "uuid": "4f73cfc4-7005-4fa1-b5a0-1a94e3542941", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpoz8yU:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494199, "uuid": "aa12905c-ba43-40a1-b65d-e300852fd5d5", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494199, "uuid": "a19cbeb3-9477-43db-82cd-291c633fc73b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494199, "uuid": "36405707-3c26-4182-8597-ca462b40f537", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc57f87f-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "0cd47ac5-2a42-4980-aeae-6595cdc15347", "comment": "Malware payload (Gafgyt)", "value": "e70edcb0a274008d4b8d7ed25efc0433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "81839037-3625-4f63-a06c-9921356e3b8c", "comment": "Malware payload (Gafgyt)", "value": "d55090f67a3883c43148e37fcc766053ce291e0a5e899f65c740983223d902ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "aebd1842-426e-4e8a-9bc5-97141798cc02", "comment": "Malware payload (Gafgyt)", "value": "1e253056daa52a6d356f1ba0bdae0c7d8edfa2fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476925, "uuid": "10d47678-3d7c-4582-83fb-27a798dd4d50", "comment": "Malware payload (Gafgyt)", "value": "21a02c167992ae43d01fef77351cbec6fc3bb0cc0cf0ae0eee38c20a6599dd6ddb1c0a54223f4ff38768b8602d043477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "484151ea-50c8-4970-a8d8-dd372f0dab5a", "value": "T125C32997F800DE66F40AEA3605D70735B630FB720E531A7263573AA69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "50b80312-0ddf-4fa1-baef-0a0a14d99e19", "value": "3072:sMIrcVdOAnowHfbEqyasKJ3APbenmvI0PDGnSQNER:sMIrcPOAnowLyajJ3+qnmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476925, "uuid": "8547308b-f8b1-4f21-b548-17c5876650f7", "value": 118298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476925, "uuid": "40811bc0-57d8-4d1d-b93c-36b67ace8aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476925, "uuid": "26b9f941-924d-454d-bf15-bf9b51d79210", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f748b6f9-3b57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776538442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538442, "uuid": "ef9fff88-3f08-4e5c-b5db-5b8a1142c1b8", "comment": "Malware payload", "value": "3e66049d75c9780fd7aeb045e0e2a04b", "object_relation": "md5", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538442, "uuid": "e487f1db-3e37-4cf3-9871-7efda8f102b4", "comment": "Malware payload", "value": "d57525529cf0d87d3c74034ad9c0ad68e73a7ef0bc1fe9b60326151b8e2fafbc", "object_relation": "sha256", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538442, "uuid": "2254d154-aed6-4d91-8398-fbe3c8e8f3fd", "comment": "Malware payload", "value": "0ba2a377be4c0a48281a39b0035e5b70f0e7cd65", "object_relation": "sha1", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776538442, "uuid": "99f38ca2-9b51-4cb4-b37e-2410bfd92f54", "comment": "Malware payload", "value": "7c4bb0400774cc038b19b6f41c11e122a932ff36161c6296cc03d017b25f9f7e017bf171efa3d22ac5a8ebf58f2b8e6b", "object_relation": "sha3-384", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538442, "uuid": "89219fbb-e1e7-41b2-a283-20ff04d939c9", "value": "T1420733282B7186CAF3C1E176A14A4F37C3C8DAF775929BE665B752D28D980D3072DC81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538442, "uuid": "133830a2-55e1-4156-b004-5421f587c280", "value": "4d17be67c8d0394c5c1b8e725359ed89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538442, "uuid": "b6bb77ba-9323-4129-9179-2afc198d88b5", "value": "393216:DyBuIGDA8EgfvSlIzAnn3vrY2KMAtVx9PiN5hiXPku2lLWtw1O:tI8KKMnDutVbPmAkuIKtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776538442, "uuid": "41b97453-215b-44f0-9b4b-1171225ab9a4", "value": 17834147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776538442, "uuid": "38eca320-30f7-45d8-96d8-17c731c9a006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776538442, "uuid": "5353a627-0fff-49a9-a233-3010761a3aa7", "value": "CloverInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1353b41e-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537200, "uuid": "ee499716-1d71-41a2-bbc1-2b6e44167eb8", "comment": "Malware payload", "value": "983a3f503dbb323b224446987760af15", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537200, "uuid": "0c37918e-2a61-4885-a8a8-f7d8a29f4968", "comment": "Malware payload", "value": "d7639876f399b27f0ab2e09a7b3fdd8e32754fd7b5210fdf5a4f5b0461d7b80c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537200, "uuid": "4a5539c6-e191-4c8f-9fef-12c25ed7511f", "comment": "Malware payload", "value": "0e69b5c9847560b8e2e51619bbbcb148ebe05edc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537200, "uuid": "c44cb61b-cb62-46e1-bc8c-7bd121513565", "comment": "Malware payload", "value": "51bf6d5300d53c8d55984677a88c49a51265c976ba8f570d6a8596cbe9796a0ac64a0b19722419860b4b5c0316f21f5e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537200, "uuid": "4d3fec94-d5f0-49e9-bf9a-9c6c4129ab5b", "value": "T134C2CF30C249CD71D8DA4CB166F57E7B386E178281CBFD0B962545DB06A3EAE9F181E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537200, "uuid": "70899fc6-7573-4193-9f48-811c05e3d8e5", "value": "384:7Y3w9gnte77GlINlxmui2Pl2PhUm8BfONB2ljANQkCCII++SyJfKflEXr:29nEMINzbii25Um8xthM3KyNKte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537200, "uuid": "802afd91-5cf2-4ffa-a90e-5128c1905edf", "value": 25779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537200, "uuid": "708d0fb6-01af-4a72-9c4a-3645793fbfcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537200, "uuid": "3b5200ca-b0f0-4922-926d-667234312b44", "value": "Prestige-Addon-1.21.111.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a98b29-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527452, "uuid": "a56310ff-9b24-4429-987d-0cb4a23f6660", "comment": "Malware payload (Mirai)", "value": "841f62a925229de2b586fc4c98117b90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527452, "uuid": "f13909d9-4cfd-463f-a8dc-a25c1d75bf01", "comment": "Malware payload (Mirai)", "value": "d7bcb05fa2e25538a52994728c958291a6e4e294e262d6dff40ef11dcfc696ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527452, "uuid": "c0cb9987-a1e7-4ecf-8873-1ed2caafb735", "comment": "Malware payload (Mirai)", "value": "b1273025a1aecce61f170e49f4fe36b003a01ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527452, "uuid": "aa679057-a03a-4418-a58e-18ffd863d256", "comment": "Malware payload (Mirai)", "value": "9fcf437696371b85e12d84155085ec54d82fdc88615d490f26a2f65fc1dca57ca60cf6ee84ca0171976000b34ebc9e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527452, "uuid": "9a2179f0-8eb9-44fd-8b5a-b3b0d6c2b5dc", "value": "T1FDB3E085B210AA55C02672FCB187099093B17E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527452, "uuid": "99e941e1-f47b-4215-ba82-97f4fe4e34e5", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuM:as5zqhr5Nzy7w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527452, "uuid": "f584147e-d619-4e08-8530-97296405d268", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527452, "uuid": "67a37add-e93e-41c2-8033-c19ed39217dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527452, "uuid": "078fa2cf-4267-440c-a32b-28133d4c710e", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b5d292-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545665, "uuid": "0d5dffa3-60ee-46e0-a6cd-586cc4706778", "comment": "Malware payload", "value": "45a1b7bee5f6b48c87f19f37ee22b854", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545665, "uuid": "6c3e56e1-6031-409b-b044-9ab1fe63a814", "comment": "Malware payload", "value": "d7eb2bd82ba425aabf62ff7ee986981e2179ab10e59790d69a45f11a83aa45e6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545665, "uuid": "37edad33-cabc-4698-9b9c-62fb2b381019", "comment": "Malware payload", "value": "7fc96face297af18cec85f8154e40549b0f93873", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545665, "uuid": "f313a575-2a3b-4c43-ac1e-e9df0b2d3e19", "comment": "Malware payload", "value": "d2048e3ef381620c3e3222aab3ac97d4d08beb276904d0d942c5c41dd54ca5fd6d0a14da549cbe322895166bfdf2aa12", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545665, "uuid": "6b9cf708-1d25-4a3b-99e0-7b47808cef82", "value": "T186D4230BA7CD91498943BCF277695CA91364887B3B8D0BF98C5E2432A7E45FA8F5C035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545665, "uuid": "eef8528c-67bd-480e-87e1-d798c61e67b4", "value": "12288:HMsPvtrR11PYxJKBqqPNyTMDomDpUhz77VpJWSxMDvIpaRORCjI:HMcF911KJIqqYlhvTJejKe2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545665, "uuid": "ad1a0739-f779-4b20-a0f6-98d307f95d5c", "value": 609735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545665, "uuid": "f1a4f1ff-1506-450d-93e6-17783e9316a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545665, "uuid": "0d54bddd-43d9-4227-8ef7-cd90bcb4fe63", "value": "Unconfirmed417033.crdownload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb38ce4-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494213, "uuid": "67b344dd-7f74-4f45-9941-095d3842b16f", "comment": "Malware payload (Mirai)", "value": "22543bc9273af4fd9c7b919e0ac4086d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494213, "uuid": "f5e7346b-5ab1-4959-be9d-a231696a4949", "comment": "Malware payload (Mirai)", "value": "d8a1adde3449ab38d4e9ce3cf17cd1dc1214587b1ad3eb7f009a8f38ba9ebff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494213, "uuid": "dbf2e6c7-3a62-46c3-811a-ab97ded46d0d", "comment": "Malware payload (Mirai)", "value": "b6ea4aabb518cc771ef4260f414da2138cbbf7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494213, "uuid": "d5339256-9a07-457a-9721-6c279210d839", "comment": "Malware payload (Mirai)", "value": "af0818c6c53a13786dfb88062cc10481c8e8c3512130f92b39bebb474d693930524b65388e62d808874996a01406b001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494213, "uuid": "c446aa69-417b-4668-a6fe-63223e67fede", "value": "T1C653F791B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494213, "uuid": "aa42f0f0-6ff7-47e1-8edc-1ff69ffa47de", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pXN:dn3QxJpRISDMKf5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494213, "uuid": "ca3524ce-caa9-49c4-abab-4d7907f5558b", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494213, "uuid": "1c746dd6-35e6-4fb7-a1ae-e0f05812fb78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494213, "uuid": "20b64743-07e6-4e9b-bf58-548dca3a7d97", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0a30e2-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488007, "uuid": "8be0cfc5-17c2-4881-a617-7c7fa46e0893", "comment": "Malware payload (Mirai)", "value": "8147238fe17fde2336df7f7788ecb84a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488007, "uuid": "d203a671-ef1b-44a3-bc23-3d049f5776a2", "comment": "Malware payload (Mirai)", "value": "d8ab6e667c653c35f3903a4ec4cf9c17ea02fc414a1c15b20ed5ab8ead087677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488007, "uuid": "c6503324-4615-41c2-9a99-dab9a3b18693", "comment": "Malware payload (Mirai)", "value": "85e9a5bd2802debc1f2a8722e7315755a54aa744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488007, "uuid": "948e2674-50ea-4126-9425-b6d6dc7ec348", "comment": "Malware payload (Mirai)", "value": "b94e17be1ff884f87da3329bdabc688152afa42633e0850990a9d66c711e8548364352cbe4b6a046c774f313b60f9dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488007, "uuid": "a1bad4cc-7e6e-4026-aca8-3ca3a7d5b4a0", "value": "T1AB34E791A4119ADFCE0158FA73AC4F342B817C74861B1FBD5D559898A28F8DFF0C6BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488007, "uuid": "0890c9f7-c413-41ac-95db-edb62c4c2d14", "value": "3072:EcXtMBlDxZ+eWprFHXrzEz5uc/6WSU91ifhBDL665Wv7uaby:Ec9olDU3rzCfCWB9MfhZBkvXby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488007, "uuid": "deb500f2-0fd1-4034-aa2b-b0f81e03e576", "value": 251268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488007, "uuid": "f916daf7-44a7-49a5-8612-6e05a06965d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488007, "uuid": "2143f243-eb66-4383-843b-b926ed560799", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dc0ef3-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530437, "uuid": "32b2365c-af7d-4a35-9524-1f5cffa5a02d", "comment": "Malware payload", "value": "74626352d66274dcce84062d94765b74", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530437, "uuid": "efb02716-508d-444b-9b72-32b531560697", "comment": "Malware payload", "value": "d9475ed2fe2854031ef18afe50a231afcfbd27a7a64d2827cad0b67aac00692d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530437, "uuid": "87f810fa-795a-4a93-8997-0da777f110e9", "comment": "Malware payload", "value": "ac5e62587e4f2b9574783a0f3e055496933a0f6e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530437, "uuid": "29ba8aea-c687-44d7-aeb5-87679c5a82d0", "comment": "Malware payload", "value": "4ef36c5fab353cf04b5869862a0b56911cb58ea7c8e2a789ab287be8ab473fac5e18f5c18f00375634aaccc9e6203039", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530437, "uuid": "fd2fd50d-16e4-40fc-b5e6-69365609e76a", "value": "T11D951213AA1C14F8FD7357FCE618DF122CA818D4E62F792269FC4B9E18176E4934532A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530437, "uuid": "425c6997-c7c5-41dd-8a90-84fe35846853", "value": "24576:XE5P0ltJ5/VB/HhIzWDCJBWAmtnJV9m8iJSTIxVMgMelK7zB4B1Nrv15xNjEYCYu:UF+trWzH0pri0kx+gMeKaB3TPx/pBw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530437, "uuid": "895b8f17-bff1-48a3-a943-3441c285b481", "value": 1918331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530437, "uuid": "ba18d8b1-9932-47c1-9ebb-7e9a37790bb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530437, "uuid": "e8ffbac8-3f84-4b88-9fba-b16de9876150", "value": "Client.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a9029b-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476932, "uuid": "59dd9397-0dad-426a-9c03-949102061642", "comment": "Malware payload (WeedHack)", "value": "200df4d844c128e3dbe50d2d357c1362", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476932, "uuid": "b3476214-da72-432e-be4e-b26db37cff26", "comment": "Malware payload (WeedHack)", "value": "dae4f48c83d19926d6f97b7dcefc8f2af9b206d5d31cf9c9767c5a17f8750064", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476932, "uuid": "1601809f-179f-4caa-b51e-b7e9ee7154be", "comment": "Malware payload (WeedHack)", "value": "90fa11ecf2b8506e123c1534a475765e64d29ec6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476932, "uuid": "da517f7c-0339-47cb-ae95-965e8dc4b8f0", "comment": "Malware payload (WeedHack)", "value": "6112290af72f941695d6142bb4fdfe9744456856c54fd652d0aa5feb7db463595404d9e2a314f99c0f8a033a8aaedbcc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476932, "uuid": "9720fa28-fd99-4444-8a9d-d256d5e04264", "value": "T10F3533FE90310D1EFC76F13B70A67D138D8E7E99A785FA9268842D4DC98E94B3013A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476932, "uuid": "44f94e3b-ec8f-4238-9fc3-e1570bff4b7e", "value": "24576:pYglyabp20dMBpSZKOBORwuwk+KjdRDqo5Aj+ddh:FZF2DHSfOROklJwKdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476932, "uuid": "34b1fca9-93a5-461c-bbd8-77d5d4a2d7ff", "value": 1135070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476932, "uuid": "4e5d7655-f239-455c-b56c-16043fa32209", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476932, "uuid": "23980503-17a3-4c86-9042-3faf5beaa32c", "value": "DonutEXTRA_pre_1.4-1.3.12.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e4c8e7-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477021, "uuid": "e0babcdb-8508-4f5f-a0ea-728d23f12867", "comment": "Malware payload (WeedHack)", "value": "4aacea3f63d9dd5f4a9b5c2bab96081a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477021, "uuid": "185a74fa-d64a-4282-bddd-f7607ba83609", "comment": "Malware payload (WeedHack)", "value": "db12a22ced308e1fe793e3439966bd344c702f18978cc31f0e2b9cbff17affc0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477021, "uuid": "9c20a1b8-64c6-4637-8125-c49e5d8cbda7", "comment": "Malware payload (WeedHack)", "value": "5932c6588b477c4b3502a5c91aa8cdc1c3567e79", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477021, "uuid": "0c391b48-15fe-43b1-873f-f24fafb1db61", "comment": "Malware payload (WeedHack)", "value": "4893ac6cf34cb3a74e1474d455dbf664feb3febc85acf933a0b445959f9fa5335bc2839ec09e99bdac6cb780f8f129f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477021, "uuid": "97c0f74d-b25e-457f-931f-f1413fd0b12d", "value": "T1666533F6EA6B7D0AD217BF3166DE33CF32951ED620840EA67801421DC02778D94BCE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477021, "uuid": "eddcfc7d-2188-4ae7-a910-3cf47b26b413", "value": "24576:A8aKI2x3S1/zoMXAQv6piw+x62y4lzv+N4M+pkpp1sIrP:h3S1/7X9iY/xle4M+pkppHrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477021, "uuid": "fe8354a2-20bc-4f20-8776-1acf68c5768b", "value": 1459779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477021, "uuid": "10a7282d-82a0-48bc-a351-0dbca3499d36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477021, "uuid": "3e3f4a35-593e-4bc8-b509-7016b30d1d16", "value": "kryptonclient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05cf2ee-3b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537974, "uuid": "b596b6bd-d99d-42cb-a2cf-aa5dfb665260", "comment": "Malware payload", "value": "8569528c70b8ed1a69e43d896e7ecc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537974, "uuid": "3eee3699-7782-4b64-ae45-ac17e50e8d56", "comment": "Malware payload", "value": "db49759309c946efb1f2d7b9a2efec86f3f94a52e2c450f47bf10a7000d1172f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537974, "uuid": "bfbba394-0d54-4099-a174-e39f58eb6752", "comment": "Malware payload", "value": "9487fd26136af43ba826972352461f7af44cf9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537974, "uuid": "3488f1f3-20c4-4067-91f4-b343768970a7", "comment": "Malware payload", "value": "f513f8d2cb98461615d830d3ae5d2a9a112af6c576ac6215f645707b778bf48bd57d948035086d54997c780c1f6ee0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537974, "uuid": "58b02582-73d3-481a-b41c-dde903c11d06", "value": "T137D53B43AD928895E01A8139BDB772687E76FC2C0B3273D32B457A755EB7BC01939708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537974, "uuid": "80fa97c0-4997-475e-9314-d43c1265d2cc", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537974, "uuid": "940c891f-c8c7-463d-a420-a40e77bd95c4", "value": "49152:0A4UrRwe7R3ave4cn7Q1KCuhqWyrbd5QET:0AT1pj95YWyrLQET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537974, "uuid": "be89b448-3719-48c5-945b-9c148d052d4e", "value": 3008144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537974, "uuid": "f1caa542-7ed5-4972-a955-373a3dea9518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537974, "uuid": "7a8a274c-57b6-413b-85b6-b2b5bab59c04", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ad7b56-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492946, "uuid": "c4db8292-01d3-4830-9ec8-86cda730d829", "comment": "Malware payload (Mirai)", "value": "6b66f93ff2c5d7c344968cb947aab735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492946, "uuid": "9da04ab1-8eb0-4f85-871b-db557c753917", "comment": "Malware payload (Mirai)", "value": "dc1a24392b265827aa2b6c10bcf9471c2c0a0c36fd0c6e4843652f0d183256b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492946, "uuid": "3c61c846-59f1-40b6-9dd8-2451e8aaa074", "comment": "Malware payload (Mirai)", "value": "67dcecb85a16605fd30aaaacb138294a768fc103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492946, "uuid": "dd0587b1-8db2-4fec-b608-e17fd8968a01", "comment": "Malware payload (Mirai)", "value": "3eaca72676f8d9f255e18c262397664ab03396399affba9c67cc0e335a31eec4136a605488034ba5ae73974d374d94b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492946, "uuid": "c47ae91d-446b-4ddc-891b-080514341ef2", "value": "T1CEF2F146F5EDD740DCED89384CEDB8090C11932D9AA8D4FB9B89793C2DF4F462628492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492946, "uuid": "ea888cad-6432-4cfd-a929-42f47d2711d6", "value": "768:3j9JFwkShNFPuB87BgQXD8X8YSpJrA+MAvReT0adLyqGKNnbcuyD7UHQRjF:35wkQvDUn0rAywT0ad+yNnouy8Hyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492946, "uuid": "fa079733-87b5-42d7-b19f-91fe2f6639c1", "value": 35940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492946, "uuid": "c87af5b5-fd24-4c8f-8f4f-bc56b9d681bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492946, "uuid": "8533958c-0d99-4f12-a503-8831d54cf5ee", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4802b8e-3b75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776551295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551295, "uuid": "6a73bcc2-b6af-41d6-b8dc-b309cbcdbd80", "comment": "Malware payload", "value": "b8a3e2517a83340118e3c2e082c362d0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551295, "uuid": "26b9a281-7cb4-4a6a-85ea-fa693cf4c946", "comment": "Malware payload", "value": "dc7c970e462315029d48e0baeec16954b332aeec32596aade3f85e85a078f82d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551295, "uuid": "fd83a361-2f76-4bf4-9a06-6cd4b177fe6d", "comment": "Malware payload", "value": "1824029db30c5beec1edae62c0e55ea7457e9989", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776551295, "uuid": "ca47de24-b00c-4fd2-bf9c-051fad5d6b7b", "comment": "Malware payload", "value": "6cb417694cd1a8b9b8214b42619ab0c0821a46841ccd67c03cd6d8b017841187b5ae427a7428186fd43687dfdf6e26bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551295, "uuid": "fe873575-1834-48a7-b6fd-5d4b693d4751", "value": "T110B533396F24D117D2261F7A8E806DA344B9F4483754DA7ACB388CD2B7AEDC84E150F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551295, "uuid": "0d8afe7e-d334-444c-ae0e-1c3d5499aa65", "value": "49152:mL2U5rcMD2XiduYbnitdCbOohoxjSAeemsZ0eePbUTU7qjm+6P9wE/4+x/:m75rtD2XYdDiXCZ+SkmsrrwqjmXL/DV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776551295, "uuid": "34e18ccf-b3b3-4086-bc7f-b4814a865caf", "value": 2430012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776551295, "uuid": "1f72c22b-2f60-4d6c-a5d2-ae301ad0931b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776551295, "uuid": "a799cea8-2a55-4692-8333-016094dc592d", "value": "Fabric_API-0.141.31.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996f6cb6-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488033, "uuid": "f0c0494c-cfbe-44a7-bd25-34ed8a3b3476", "comment": "Malware payload (Mirai)", "value": "11b78245606e86e3afcc68e673434fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488033, "uuid": "37738b8c-5a6d-452b-a8d6-217a67d98c87", "comment": "Malware payload (Mirai)", "value": "dcfadf7eba33ae22c673fb29aed7324c71d06425b1881d0215e02fa024a27228", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488033, "uuid": "454c86e5-6c68-4afa-859f-357bee0e1c51", "comment": "Malware payload (Mirai)", "value": "1b990de55cdff385e185a5b69b1ece54b61929db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488033, "uuid": "228c2a91-7f2a-434f-a0fe-cdd8f57febe1", "comment": "Malware payload (Mirai)", "value": "869cd25d8ad490c9b239a2002bce8be5dfc308f9eba3de217139c8ee7b8207d9a35249599eec772ae4a90ff4693f6b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488033, "uuid": "40c8db58-6b2c-4f28-b874-822ff0f403f4", "value": "T146140842BD51AB23C1E232BBFBAE418D37196B69D1EB72069C317F5037C68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488033, "uuid": "5df25640-e45d-4207-a3da-c36e53a0f101", "value": "3072:k2ZsyQexJPJEWc660WZTySpInRa6xdpAovsNl1IT+gFtMmga93:k2hGww2dpAksNluvxga93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488033, "uuid": "9adf8303-a1f4-41aa-911b-1aadc0650342", "value": 204548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488033, "uuid": "bf185ece-bcc4-4d57-af14-bd82436b7f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488033, "uuid": "72946d09-9b32-4592-a1c8-f6b488dedd42", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951d9cc6-3b3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776526681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526681, "uuid": "1be5dcd1-ad3b-4b18-a631-7f3a40ed0ccf", "comment": "Malware payload (Gafgyt)", "value": "a9ebba2f324c76429b16f61b0c009c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526681, "uuid": "42495dd8-c946-488d-ae7b-f39418a2f394", "comment": "Malware payload (Gafgyt)", "value": "dd11a8346ee36709c8421b2329f367757eaeb8105c3abbd72c1a94943a34be3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526681, "uuid": "2eb0c4f8-74cc-4b71-99bf-1427d60c9a01", "comment": "Malware payload (Gafgyt)", "value": "fb3dff7bf7a127d0e2561aafd97ab200b9074c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526681, "uuid": "c8248f6b-41db-4a79-9750-046282150240", "comment": "Malware payload (Gafgyt)", "value": "64db5f524b76e1eb283222820a7c00cae3200d4d2bdd1eada933e505e62e8c9bdcdb795dc0e3e9e0960bd8d331285b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526681, "uuid": "b05d872c-4b6b-4009-9b73-4110ce565c54", "value": "T145B31A037B0E0B83D1533DF02A7F2BF1979AFEE215A5A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526681, "uuid": "5b21e131-6b33-4a47-b7c1-44c6f8c00956", "value": "3072:4BbSGHdVzg8+/1LnSjKcXkmNG605d5h9p63:4BbNCLn4Kh8G6S5hK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526681, "uuid": "9a400bca-f0c1-444e-9c1b-6822c73b6d3e", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526681, "uuid": "924a837e-b5e5-4751-a0d6-d88d6b15c1a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526681, "uuid": "f48ee4fe-64d5-4235-8808-d17b3615e05f", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b0427e-3b4a-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776532590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532590, "uuid": "c4c6dfe2-f374-4643-b59d-34ef767ba925", "comment": "Malware payload (njrat)", "value": "ede9a6d7829aa21f57abab54fdb50674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532590, "uuid": "620253f2-e719-4c20-a806-0c802b938a89", "comment": "Malware payload (njrat)", "value": "dde0d1e276e74093558ffd62305abfe94101d3789f0fb533eb4a87b5886ee08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532590, "uuid": "aae03563-17e0-4644-8904-cd736b26f3cc", "comment": "Malware payload (njrat)", "value": "ffb4559dc947c80061072da08a347b672fc0d23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776532590, "uuid": "572c2cfe-4fa8-440e-879e-d4c754bf5175", "comment": "Malware payload (njrat)", "value": "67090399dcc81e9e37c6ff2eb229773e65b8263b610fa9397c383fd271f171482fdb120c2db92162d031986b98f5059b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532590, "uuid": "832e1c69-8f63-49ee-9132-fa194c799810", "value": "T1A2043987F601C2A1D0A84A33C557D5F00E66BC5FFB2BAA2F35C4BFA23933594990B915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532590, "uuid": "98bc52f6-6e24-441d-8745-248d21192e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532590, "uuid": "f646c099-7926-4082-8919-d38f6609a208", "value": "3072:VhhqvZwqoNewaRJ2x36NCJylCsph/bnabBz65/M6If+3Js+3JFkKeTnq:0Z2VCn/bUxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776532590, "uuid": "b68796b4-cf70-4a0b-af77-5530775accad", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776532590, "uuid": "8d5e15ca-25f6-4e50-87d5-3ce9b35d46b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776532590, "uuid": "4c9e0494-2b9e-46df-b1b1-d17b1bc8b76e", "value": "jellycrackersmerch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f949fa-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776526898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526898, "uuid": "b0f70411-0d99-476e-a9be-bf19528f1be7", "comment": "Malware payload", "value": "851d358a854ae37ed719f3cb43d18147", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526898, "uuid": "067cd307-2332-43d5-b083-25a7ce58d26e", "comment": "Malware payload", "value": "dec64ab327c57b29da029016f36f7764e5e1b672a849c984195bf52697db5221", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526898, "uuid": "ef073f1e-4430-44b3-ae74-de455753f9f1", "comment": "Malware payload", "value": "f8c5f5f9b907f570f365a8f30e6e187879395c37", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776526898, "uuid": "8492be85-4907-40c3-854b-0b3fe3dfd73a", "comment": "Malware payload", "value": "8d8d1ef2ac9d51721b5e5daa6b4dc4b5ccaa4e0f1e910ef632507415158ff31536dfad6fd4297d3c30d669f4793db409", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526898, "uuid": "5f3b2700-3ff9-4c40-9cc1-c07ef641dcd7", "value": "T1607633FA9F30B236F596F4B8AE48F745DC4252D66232E621773DD0A2B147CC7128A14B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526898, "uuid": "e6462007-1aa7-43e4-93c8-ffc6b5bc4679", "value": "196608:hEBJmggIetBYCQXQCVh4/z6jy3RZYXvfQJLfdnJLUvEBZ7nf2+OBk:hEBJmxpYQCVh4/uMZAXQJBicBZ7f2+4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776526898, "uuid": "09dcbce3-bd0c-4a2d-b06f-08c6bc204179", "value": 7817169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776526898, "uuid": "1dfc94c8-a57d-4e4b-9cd2-102b853f0973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776526898, "uuid": "3b249409-6462-4a58-b7bc-8e5744ea79a9", "value": "fabric-language-kotlin-1.13.10+kotlin.2.3.20.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314010a3-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474114, "uuid": "50f968dc-8ac2-4fc6-b48a-00b993271847", "comment": "Malware payload (WeedHack)", "value": "dbde90b0fdd820befa066efdd8a7872c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474114, "uuid": "975f52af-f90b-41ed-8579-c3ed5af8fc7c", "comment": "Malware payload (WeedHack)", "value": "df5d3eb3d69d7701146022b6bfa2b59bec9fb3944e2ea0b92f9066704d2f64a7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474114, "uuid": "a8a5fcd6-f010-48c6-8a22-de907bd50ee4", "comment": "Malware payload (WeedHack)", "value": "ec5ecd64436c75fd68b203bffbbabcb2108ca7e2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474114, "uuid": "2b53efbc-bd27-44f8-9df4-17fb26a12d3b", "comment": "Malware payload (WeedHack)", "value": "3c54d9b72cbdf22dd64509b0ced8d8a36ce8350606879bbe8fa94331c934c927108c22bcecd391f57085b450717478c1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474114, "uuid": "59aa6530-3a95-4343-b67d-e323a08dff79", "value": "T1650533B4F582E72CEC65C4E9C5EEBD63A560C6689240E0253ADCCFE97609CB3631DC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474114, "uuid": "496f9f64-9a36-4a11-9b16-d49f431e2626", "value": "12288:+yQ9Jzt0vQmdAd5JiCQSwfyoZ2OtO6Ffd7JGECmCHmztypK/hR7MUgDot7W7xI:j+z6tMmSwam2m1HVGXmCG0M/bLt9W7xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474114, "uuid": "9f648784-74c6-4e15-a784-49fad6c16b3f", "value": 824736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474114, "uuid": "d819cae4-17db-4327-a5c1-ef345dd25be5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474114, "uuid": "4831a1d6-f99f-43dd-8218-fd5752c4083a", "value": "DonutSmpGlitch1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d02230-3b67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776544912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544912, "uuid": "46bb9411-1b7f-4cb4-83ef-1f757780b926", "comment": "Malware payload", "value": "d8bab3970132958165ad8664f56c8e16", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544912, "uuid": "a3041c20-a8e7-47b8-9c87-1f660cfa879e", "comment": "Malware payload", "value": "e003ff2649ab0410aa5d6678fda17df3f097d5f36fe94c200204974456e95247", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544912, "uuid": "c8f8017c-4203-4e22-b88d-2cdc28b84cb5", "comment": "Malware payload", "value": "31e4a7166af07ec4c40dde04f1e4fceb605a771f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544912, "uuid": "a62011d0-44b9-4f56-8a4b-94990eda1a59", "comment": "Malware payload", "value": "d2804b964637e565eda8323d8b137a70e5533bcc83c82411b2676992558a6103104a7bf5d7e227a7bb38fd7e93ff7e92", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544912, "uuid": "77852207-d953-4298-96e7-d5c6ff0bfa8d", "value": "T1B357335BC4D329E7E077C838633A85D4C576ADA65E86C33D9078738759BB78072B22C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544912, "uuid": "978fc105-a6f9-4365-bda5-4ffd18ca92b4", "value": "786432:lU9B6nWqd6p7GVIB68UgoN8dIML566yI8x6fSR9qqDJB:lU9BcAseBxtg8d3I6yJ6qR9lJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776544912, "uuid": "26338edb-2ea3-4222-85c2-8d92c17211e4", "value": 29650944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776544912, "uuid": "d6c2cefe-ac4e-4b7e-bce7-a5ac530e3016", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544912, "uuid": "1e9e35c4-2c3c-45f5-9c28-f2ea93575ed7", "value": "77nr7tds37.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe8cda7-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477092, "uuid": "6e235bcc-a9ec-4b56-b1eb-4f573ed97593", "comment": "Malware payload (WeedHack)", "value": "1914fc6a240392a4de58e90a64f9753a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477092, "uuid": "27a4c90d-3d7e-4584-8560-5f7c1ccb7e26", "comment": "Malware payload (WeedHack)", "value": "e07d10fabafa9115276d06ca1b89c3f0dd938c17b5ac1369166df8054c95e02c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477092, "uuid": "c5bb11d4-fab9-4980-b533-d249401d1be9", "comment": "Malware payload (WeedHack)", "value": "7f43075b2ed7c81c625857bf6ef7d14a56d3ac04", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477092, "uuid": "40c21695-f830-4045-84ce-204bcb341883", "comment": "Malware payload (WeedHack)", "value": "91fbaed996db8d6783b12250ec1da206c238fe4843f387803675acd47d70637e717251c7f622979e6b8b51b85d4c5798", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477092, "uuid": "3140bc7a-d064-454a-a7ba-310bec60cca8", "value": "T1B3A52333F6CC48A1EC5FE536E0D05822265D05D4E94A37AF3EF4A8AF683F5D84796620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477092, "uuid": "913368be-d343-4342-81fe-277311d24f06", "value": "49152:1oSe697KbtpqwaWzH0peb0EoWzH0pFcag8bO:2SeE7IqwaWzH0pm0EoWzH0pFcDWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477092, "uuid": "84fed1c0-d3fd-44af-b4b1-ab7fbc242290", "value": 2264752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477092, "uuid": "df19a6b4-451a-4a4c-b07c-94bd66d0eabd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477092, "uuid": "077fd977-18e6-4990-ae25-9d77822b2cc2", "value": "WaterClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e0c07c-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486334, "uuid": "6577b0f1-c0cb-439e-84d7-8428f13823da", "comment": "Malware payload (Mirai)", "value": "a39fed393f037a7b557dab1330fdda64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486334, "uuid": "9ccbc6b6-7138-403c-9442-9b49a1624114", "comment": "Malware payload (Mirai)", "value": "e0b6c9f7865c16a3ed3538622b3217fd83dd32782231415add71ad3b10adf741", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486334, "uuid": "1b66746c-c0e7-48c4-8a6c-9fc915f6940e", "comment": "Malware payload (Mirai)", "value": "205d5340abe52906980cc5ecd13ff6889b23b174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486334, "uuid": "884c364b-5c6c-48a1-9a92-52642c413cef", "comment": "Malware payload (Mirai)", "value": "4223277d8ce88743f773a84aac31ea947674b4742a4f1b65d22faf4ed72e7a925684e87378ae73b199834712714c7ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486334, "uuid": "8257bc2b-8341-4ee3-a806-1c24578ab7f1", "value": "T195530959F8408A23C7E521B9FA9D554C37535BF8C2D972028E205B317BEB89B0E3BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486334, "uuid": "438a1e62-f079-448f-b88c-58c597459d1e", "value": "1536:8PBNq2M6iq++J7mAh7xt7FuHd7m/A3dDQwps1bOoJ32UYfjJ9KAP:85AJqrhmgkm4t7oM/QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486334, "uuid": "4c1dea05-9c5e-4412-8282-89920884b20f", "value": 62804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486334, "uuid": "7d524c72-1bca-410b-9806-d7197bfc6529", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486334, "uuid": "9c43904b-015d-41d8-8cd9-18eaa36d7d7b", "value": "alyssaaarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639a0528-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776497821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497821, "uuid": "c87050d0-9b0c-4afd-9d2f-6775c97c7e4c", "comment": "Malware payload (Mirai)", "value": "75980dbde307e78e001c91120bb83c4f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497821, "uuid": "514411ad-fa03-4b61-99dc-a6d9b195ff87", "comment": "Malware payload (Mirai)", "value": "e2459e32c53244f377be7ec9f6ab3c8f535a686285dc0ee770b0933aaf6e23ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497821, "uuid": "47cb373d-cf31-4eee-b71a-3d06927cdcfb", "comment": "Malware payload (Mirai)", "value": "153b2d798b59c91af12076824ae120fc485e101c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497821, "uuid": "e0496be5-57d3-4c9f-a02d-12f0ba3fa157", "comment": "Malware payload (Mirai)", "value": "1e7478e24ded292a8bef5ef75bdf8153cba0c77da0e81cdd7e54d8e084dd5858241430351d63247caf174d21233e7d06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497821, "uuid": "e53ee6f6-b6c8-48d1-83d6-87ec12f4ea0e", "value": "T193F33BC7F800CDBEF80AE73748530905B230BBA255825B376257797BED3A0991977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497821, "uuid": "513fa73d-7069-4aa4-85db-fcfd23bf0304", "value": "3072:ZV5yc/y0cSWqyAl9ed9/1qVM9uBSAsgcVljbiNLHbDLTi:ZV5v9yAfed9/1qVaursg3LHLTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776497821, "uuid": "e464682a-b6a7-427d-b9b6-934b55c9739f", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776497821, "uuid": "16fc6795-e7e6-4a2d-a083-8dc4c4a0f811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497821, "uuid": "9c206b65-9f78-4d1e-ba7c-a5e1d9732ce7", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6038dd06-3af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776497816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497816, "uuid": "fc56fd4d-f08c-4694-a75d-0e3872dcbd0f", "comment": "Malware payload", "value": "0c9243109906db3547a681d8559c72a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497816, "uuid": "83c1d5ed-28e9-4ad3-97a1-2de3fd9dca54", "comment": "Malware payload", "value": "e24b40efc6d9d9986cd8499c0900c6ed486afcc8ea7adf3191670eacdd314cd1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497816, "uuid": "c334a83e-9705-4c88-94cf-b30506dc2922", "comment": "Malware payload", "value": "2c9406884d5883f73368e1d528702a7ce201e01e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776497816, "uuid": "d384b3a8-16b1-42ba-8918-2dc0e48656b7", "comment": "Malware payload", "value": "5ed3e07a8b0f0208643be9b60e74f530379291f2a1dce3159d5c58021f146bcf9ad35f874ac3c34d1eaa2dbbb26eba7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497816, "uuid": "ee34b0f2-3b31-478a-a2ae-d1b0b3a407c2", "value": "T10331B4E212F01837F78A581DF3508999B88ACCAD0FF48B1C9C0D1572E94D87D7A13E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497816, "uuid": "a45d635d-0dbb-47b5-976b-0c8405aac2e8", "value": "48:hNwIWwIX3IhwIrwI23IT7wlwk3KwywD3qwfwa3RqwMwR3vawhwQ34w8wB3Miw1Yq:h+GCdJ5jWSLTrrIMRrt1jiWp9FU1J15j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776497816, "uuid": "9dfa96c4-18f7-47bf-bca0-5316b68e9188", "value": 1656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776497816, "uuid": "61570098-f35e-4cfb-bd4f-43f69d2f1873", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776497816, "uuid": "868a9e78-457c-4557-b32a-cd7a50452132", "value": "haker.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24011f5-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537037, "uuid": "10140a2e-4270-47d8-af53-946528c374ff", "comment": "Malware payload", "value": "b1b149eb5ee879711788996e310ee265", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537037, "uuid": "bdb9f973-eb6f-4757-a7e3-ffa5f8653250", "comment": "Malware payload", "value": "e2f86f243e78314bf27675234a7e11335eeff1398f1094eb2555f12c408509ec", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537037, "uuid": "781a8517-a21d-4c2c-97e9-94e06c3a5cdd", "comment": "Malware payload", "value": "b59f4ca1b54472541bac30c4f894664952c72c7f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537037, "uuid": "c126134d-294e-4176-b2fd-72ec3f86b744", "comment": "Malware payload", "value": "603879d83e460860b460a911ce377b3bc5844e6b525990d0f4c8870b0f10ae39c1d19c6f38a8263d3182cd77f9ec6d8b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537037, "uuid": "5bba26ae-b2a9-4a9d-8bb4-3c93e8348a1a", "value": "T1E6D31205B03E9A96CB4385A448598B5B8F6A12C811647FF099F32AF74C4D69CDFDE48C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537037, "uuid": "d4cd4a09-bd5d-4449-bf1f-bc18593fb950", "value": "3072:ss2VjEewTcx6ARehyYzfmgYT1WhRObzPhSVdZawLu6pssTiYWClRR5:s9VYeKHAhYjh4Wb0PhSVdZfiZeRR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537037, "uuid": "54a3b0f7-3e84-4634-9861-025bb43f3d4f", "value": 138278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537037, "uuid": "ef865654-c3dd-48f8-8e46-c4ec042a55e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537037, "uuid": "8699e3ca-553f-41ff-9b41-b45b5861056e", "value": "degeghe-2.2.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7641cfda-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776527058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527058, "uuid": "96cffda8-7636-46ab-ac80-8658e24f8dbf", "comment": "Malware payload (Gafgyt)", "value": "be2f095d7c5595e30fc6536aedaf946d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527058, "uuid": "599463e3-46b8-47b1-bf57-6d7cda4bd13f", "comment": "Malware payload (Gafgyt)", "value": "e3c053bbd7fdf8a19675fda0402ae0676bc14600922feab68a1467de9484d2a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527058, "uuid": "c32a5f9d-1d33-43ba-94d4-cb677217a4e2", "comment": "Malware payload (Gafgyt)", "value": "bed760e4373164a3031d0e08ca8a6b8da9caf392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527058, "uuid": "054a7b82-5016-4f7e-83c6-cae1bb92928d", "comment": "Malware payload (Gafgyt)", "value": "ac972fc9ab17e6ea84c4e9c048aa0d53f0f30a0270943ec68ddb00b514f256bf078a9a114c058c6bb59772b4af02ab1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527058, "uuid": "7ad27dfd-08da-4840-85ca-b0a4f9c94a3d", "value": "T110932BDBFA02CE73E45310F112EA6B218971F9FB1823E682D7647DA09D511C19A16FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527058, "uuid": "73862e52-9c1a-43af-882a-e6af996aabec", "value": "1536:0Hv8hVUQyPQTUgrLyEyr67aUvAEGafYxRDe3Z2NOqXJ33xZSEgk:IsU2UgrLo67oIYXep6J3BZSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527058, "uuid": "07cac145-75a7-4149-ae36-eb6c36f4adcc", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527058, "uuid": "32ff91e3-3473-49ae-a391-59e08aca2a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527058, "uuid": "ae3af909-f617-4fb1-ba77-9b5e22fd7410", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec58bb67-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477005, "uuid": "51606fe9-58cf-4461-873e-5b18fe2e1f15", "comment": "Malware payload (WeedHack)", "value": "3c445ecb283ef2d4be8f5dea078e77d5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477005, "uuid": "5215f0d0-8362-4913-af56-e9602461e8ad", "comment": "Malware payload (WeedHack)", "value": "e48274f2bd5b274f221606538843487a4a52fc7c6ffd91f5f4aaa6ed3db83957", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477005, "uuid": "bf8b497f-5501-4fcf-9465-6229f4b6624d", "comment": "Malware payload (WeedHack)", "value": "f1696b6199297a339473d96a0fb11c969d301fc6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477005, "uuid": "00afd098-ec33-414f-b92a-d70918d532d4", "comment": "Malware payload (WeedHack)", "value": "b01ddc259791cd4b79440d973525600d7f3847e5961f30f3c5c2b4c5ae2f4731e377806877e8ae393c5c202c182c81b9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477005, "uuid": "3a121463-dc04-4c35-b795-0e28ed8a1bad", "value": "T16815331799AAB55A9EB85FF62C2C03BAACD34C3A460A1D18FDFDF91748B1040C9977C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477005, "uuid": "705aa039-1188-4e8a-a69a-172e4fc98c74", "value": "24576:QqDPiJSDNFS9hvF+KfZjn8u1dGUM5e444QeKUyCt:Qqjis0xZAu1gUMw4YeKUlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477005, "uuid": "bb53bedb-75f8-43e6-a93c-a7c2a641dce9", "value": 886365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477005, "uuid": "9170bdb5-2148-4e1e-99a7-d910dc46c7fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477005, "uuid": "1cdeae23-ea36-4224-a49c-32e50f175b12", "value": "Gun-2.1.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac605ca0-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537028, "uuid": "595b83c5-57e1-4db7-8520-5daccc79a979", "comment": "Malware payload", "value": "a010d10dc6f37e81bdf32554d526f422", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537028, "uuid": "7646d561-88fb-40ae-b4ef-b8c7b87f5032", "comment": "Malware payload", "value": "e49a7557b15227c594e8e7947d1ee21d71dfeba54b33bc0b4c351081fe3ebfee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537028, "uuid": "5cbc5f26-d6b5-4b75-95c8-0d203afcda3e", "comment": "Malware payload", "value": "fa6ab10014c95ec08678abd912f198430e701427", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537028, "uuid": "34c791bf-49f8-4a12-8854-66c059705126", "comment": "Malware payload", "value": "7523c6963741e7dfdcb111d23a20a69ae72020d59132a8b74708702788c699d6bee58406d29638f83761a4a2b856516c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537028, "uuid": "883e1199-943e-4af7-abc4-e148c293ac0f", "value": "T14FD50276E3688C1BF907FE3ED851E933A47651D2C217659A60BD8A40E6CFA900BD4F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537028, "uuid": "5a685b28-3c0d-488a-bc9a-2f07381d7f84", "value": "49152:QawrEOWkH4osyNTFr48Tw5v9J7XLhVnXpdxOpIi1FGZWhtwJ+c:ALtpFrS9J/hFXpf4tLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537028, "uuid": "51f4950e-4edf-4814-bee9-b55b11a039d5", "value": 2821917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537028, "uuid": "70a9b23f-722f-4e82-bac1-4b5c8f2dcd4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537028, "uuid": "8800e3a7-d524-4f84-a125-b4671b98de52", "value": "ClickCrystals-1.21.11-1.3.8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0dab9e-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530504, "uuid": "efdc2e35-ebab-4c00-911a-fc5ff99f02d1", "comment": "Malware payload", "value": "da732da95f84989a0c42ee19de850b23", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530504, "uuid": "f6f92b08-bcbc-40fd-8e8a-6372c77c7de1", "comment": "Malware payload", "value": "e5a9ad06b3be7fb4c5b90105361fa036ecfa49a4162c08df6638a6e23c3e3c83", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530504, "uuid": "93e87d44-0e91-47f5-b8bc-de7b033d12a8", "comment": "Malware payload", "value": "d99990d9a253d3181e11cc30afb2a56c3d3861e0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530504, "uuid": "dcc46dd2-e624-4e20-873f-491aec78c75c", "comment": "Malware payload", "value": "e4cecf3a5a988288424c02cede9af5e41b268667ff2fc1a7423dae7a9ca8184d278410bc492b471d7bcf60c771d7d919", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530504, "uuid": "b7f2f19c-cf92-43b5-b28a-5f08b2012115", "value": "T19DA52333F7CC5821EF57F536E0901826261F05DEE94537AB26F4A8AFAC2F5984B97600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530504, "uuid": "51ea4976-fed3-42b5-b4f3-068952c41c2f", "value": "49152:1a5Nr67nuLVptAWzH0pwx7PUWzH0p4Xdg82g:g5N27aptAWzH0py7PUWzH0p4XSHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530504, "uuid": "9c149db5-5001-4bd4-b5a2-1fcc27adb8d9", "value": 2264848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530504, "uuid": "01584025-80e6-4f7b-9f53-5cf5d9066753", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530504, "uuid": "2e02556d-2ff3-4eb5-a5f6-d27ece4dc471", "value": "WaterClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf0a802-3b67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545266, "uuid": "f4cdb61a-c442-40e1-8681-46994eeb5de0", "comment": "Malware payload", "value": "f54d0331fe6474d5751775f0cc2a3b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545266, "uuid": "1226f79d-2c52-4a18-898d-164b48716a3e", "comment": "Malware payload", "value": "e5ca97bf9f901bdbd4b5883e678f76480d60e30d9cc74183406093892bb0b185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545266, "uuid": "10af4a08-a047-4938-a1a0-5f9870d3f81d", "comment": "Malware payload", "value": "6b0981ce77c14767214648b5681666ad7d542aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545266, "uuid": "a1678e87-1ce4-4634-9f02-367ff563566e", "comment": "Malware payload", "value": "eb45ff43065a0f48d223afa7659724ac8850b1e56083cb98946fe6b72b17e69cd6ac9c4fcf9904b993d492056e952d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545266, "uuid": "0ddf690f-f2b9-43f2-8815-31d7867e9f67", "value": "T112C623E74AE292B940D20640618F838934C5A54D51FD1D293EDB2CC2675CEAF668EFF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545266, "uuid": "23f0d261-318b-4a5a-848b-6f04ec4f1157", "value": "2f260786b1135fc498272ea0577b0445", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545266, "uuid": "b367e8a8-9c23-475d-9e0f-6774c3747f5f", "value": "196608:JY08bCh0Y3k+DJIO+VCvsI0iGWjlJwKU/dyfhBK55gXX9op/Zb9Hk7ho:sbiv3ksIcsneJQoK3gH9qMho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545266, "uuid": "8c86d772-662d-4a07-8214-0cf724498272", "value": 12347856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545266, "uuid": "eaf29c28-66ae-4381-abf5-25b1ee1617b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545266, "uuid": "b9ac7458-5d29-47c8-b9a5-067bd55b0179", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959327da-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776488027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488027, "uuid": "e2ff0340-475d-4074-aa3a-5de0df69b811", "comment": "Malware payload", "value": "a3352c814510fd4a7c968d749f70da5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488027, "uuid": "47e3db27-434b-4c9d-8bfb-cdf9e6d91d50", "comment": "Malware payload", "value": "e62663f3502d678ec6cbfab2de1cb291df766f1ed05e6d19ff962c3b9362aa07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488027, "uuid": "b762a914-c25b-44e6-828e-bdbb0ff523e5", "comment": "Malware payload", "value": "b53f644da7c72d30046c8c1832f495d30e97f08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488027, "uuid": "edcf6d56-0c1d-459c-9313-cfcda89cc93c", "comment": "Malware payload", "value": "fa0397acbcd59030f5418aeefa57f2c65c19803cfa8be2a95f87e67c01521990daddaeb8a27ad6950c4b7fc06421a512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488027, "uuid": "500c6e9a-61b8-4b6f-a2eb-26b07e5a3c80", "value": "T1F4141902771C0F47D1A37EF0263B27E083ABE96118F4A684751EBFC99271DB21445EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488027, "uuid": "9a48745b-2eb0-48f7-91d8-43fe852dd045", "value": "1536:0+B82hbbIcRqi/5AiJL/SW5qgHRjNixomzdTI5ztlowOqd+uhFC46z2T1xvAF2/y:0khoOOgL3qkExoqhoLoEFN6C+FwxZoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488027, "uuid": "fc8c33c9-f37c-49ce-819f-27e581879599", "value": 192380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488027, "uuid": "09bcf117-e7aa-4fd0-aca0-c422a2cd6556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488027, "uuid": "ef45e395-1811-4ef6-b760-601749e16e71", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac678b19-3b77-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776552060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552060, "uuid": "172ecb3d-9ea0-46f5-81ed-eaa69225f61f", "comment": "Malware payload (ConnectWise)", "value": "a5cac65f45f27b3590c76f259cc88861", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552060, "uuid": "d60aa4f2-7195-4c46-a107-fd7b5a5313ed", "comment": "Malware payload (ConnectWise)", "value": "e696be9abe6b2b9a656f33e7aed8092f73f94ae439f680305e5dcc0fb430f4b3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552060, "uuid": "cb690136-6ae7-420e-8fcd-913e436a83c8", "comment": "Malware payload (ConnectWise)", "value": "69e43d2266d936d46410005a11a8836a1b06ef3a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776552060, "uuid": "fce66dae-10c0-4872-ba11-cfba40254f14", "comment": "Malware payload (ConnectWise)", "value": "a34aae4422fdc3c1cfc273eefd89278d4d599f7da426cabe93552db0b34a1f47fff4035d97adc2a2b2914c602c5f3315", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552060, "uuid": "187f6625-664d-4121-9740-907712d9b614", "value": "T125D61211B3E595F6D0BF1678E87992655632FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552060, "uuid": "b38bbee2-3f7a-47af-beba-abbbd17eaf70", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552060, "uuid": "af9e8120-57ab-4a29-b7d1-146b84db295f", "value": "393216:0CXvI5MvHxxJRCXvI5MvHx6CXvI5MvHxbCXvI5MvHx7:0Z6HxVZ6Hx6Z6HxbZ6Hx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776552060, "uuid": "66b0bfe8-487e-4508-8ba5-c2500897eabd", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776552060, "uuid": "c9b1827a-a9a9-4a1e-a74a-3395737c5d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776552060, "uuid": "39650def-a23a-4ef2-a59b-cb8447c09d71", "value": "Eventscape - JF3978 Project New JFK T1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef24b0d-3b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776530428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530428, "uuid": "e8d14932-8f3f-4f96-a0d2-7c161252771e", "comment": "Malware payload", "value": "4ef402d78e6e380f468228d2d7516536", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530428, "uuid": "703b1984-ecf9-40be-827e-312372a5bd00", "comment": "Malware payload", "value": "e7574ffd8192f9716587e39417cfb94fa1b60e2a23686ed5fdaf643607561c31", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530428, "uuid": "76e7161c-96d9-446b-bdcb-0263eb1cd1d4", "comment": "Malware payload", "value": "af551cd8ce3a966ad88bf016f404bb5327e3919d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776530428, "uuid": "d8cb6b98-3423-4210-bc8c-51fbf2d29aad", "comment": "Malware payload", "value": "6d1273df22351c8c6938eceb1648d8071bb415df7c0ec78e07a3d09c84446c22daa1c45f798dfe5c39048700c574f341", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530428, "uuid": "4546f1c0-86df-462c-97bf-7ead60be0ebc", "value": "T1E6C2D0631D1DFA79E90F077068819DD1A96D8649D246AA2BB881473F24F3EE6C30CFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530428, "uuid": "a8275b4c-c511-4f4d-b0b2-a2b12958decf", "value": "384:H3w9gntIBJGaUKPMDZw3WQeugEDGwS4Lg7vN0Y3zZzBck7Y1TNVtXo5FXKgth:X9ne4aU4MDZwOuJK1n0YDgkk5D4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776530428, "uuid": "ab57e84e-23f1-46fb-9916-6e82d4f015c8", "value": 25740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776530428, "uuid": "9c1b5a9a-d24a-432a-b7af-03831d23d59b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776530428, "uuid": "fe0f059b-ec2e-406f-b416-9d7a14f33cf5", "value": "Ciscos_Fantasy_Medieval_RPG_Lite-16f-16f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935273e1-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776498760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498760, "uuid": "ba16cdea-2272-4c44-b755-ac1bdcccd16e", "comment": "Malware payload", "value": "908a5a1f7e2ccfbfb55e3d3f742c3d57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498760, "uuid": "3dcbaaa3-fe4e-4e3d-a7e4-b988c1929ac9", "comment": "Malware payload", "value": "e794759fb9185c4bc5e4b095be3adbd41dc0c42661953bee49cdf259ad7f72c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498760, "uuid": "36c34c16-4ed5-4308-8f61-e122917894f6", "comment": "Malware payload", "value": "8bcb7b83f2440bb854bb9b9fa27c4b776bcffd4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498760, "uuid": "dbf9de22-5e95-4fed-8ef2-bd15cf5376be", "comment": "Malware payload", "value": "6d1e66d8d7803f5fdd3aaa630f0761ecd8a9ea482a66846a414a5247f0a7e54371ad0e6b45912e6a05f8bb6b7f018d5b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498760, "uuid": "e4d49e5a-b703-430c-b7e8-e2ebca91c541", "value": "T15F93079BA60D0BAFC65B4AB128A717F0CF6DF560019A51C6B50DEF8007F2D706863B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498760, "uuid": "2117ee88-99b3-4118-a164-9b3a28087a98", "value": "1536:SQMZdaVuuma6rBIbRC0RpXeXRIrsVwegrHQgH75ewkXgm1jT2q2I/fjAoc:STZUVuuma6rBp0TXqVwegrrfkXgm9T2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498760, "uuid": "f24089ac-da57-4737-aea8-f28b91c12b27", "value": 97622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498760, "uuid": "660519ab-d99f-4686-a2de-a0865fd336c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498760, "uuid": "50856854-0178-42e7-a9ac-130682a7b3e0", "value": "Demon.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79adf709-3b3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776527064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527064, "uuid": "124ba75b-007e-46bf-a828-11894ab161a5", "comment": "Malware payload", "value": "f21ee2c5f026ee528ebc34df0d3240ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527064, "uuid": "48a8a70f-cb6b-4773-bfb2-b86ceb952a6f", "comment": "Malware payload", "value": "e8d70a7158bc83a0a49af74feaa379706a9989b943caa58f1d2c46cff851daa5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527064, "uuid": "3a25d2d4-3dd4-4e80-b526-4d0e15952da0", "comment": "Malware payload", "value": "ed5f4de1fe374060048ed1373e08a5f980c7e117", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527064, "uuid": "b7c756b3-29ba-4584-b685-a6fb75d79d99", "comment": "Malware payload", "value": "2411aff6c6e52c74d0571af9f051503841e12c6b80276e8e9597e2d34e40e9aed8b19294beca93f4a5dc23e9e02396a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527064, "uuid": "6f8a2b52-73fa-4dc9-9b4a-66fed1ff2f54", "value": "T1FA515E9B02009B319608858FB7F23235620BE18E5BDED749FF48AC2C0FC5D5C728AE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527064, "uuid": "dabb1c47-624d-4031-9bac-d7aca1256cac", "value": "24:y32JMO4biBe9uZ5EuEnE2EhEYqsbwl6JUfdKhM3s:y32JMO4biBe9uZ55cvyysbw1KhM3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527064, "uuid": "f6f409f1-10bc-4dde-a5fd-fe9187fd6c7c", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527064, "uuid": "221c3e71-4122-400e-8b5b-a61c15b1e1b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527064, "uuid": "2d66cbd3-03ed-4706-9321-d83b1e9d6c8c", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52010a8-3ae5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776489395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489395, "uuid": "78e11c90-ae96-4926-859b-04ea9f658d2a", "comment": "Malware payload", "value": "a8199b681c8017506d7e63d82d022fb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489395, "uuid": "7ea0eac5-0aff-4ec4-9ff3-994cdce9c03a", "comment": "Malware payload", "value": "e8d775962833c04940686a3310963341e26de171034fa7a7c934a5ccba4b02c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489395, "uuid": "43c81fa9-edf3-4987-9f12-645bc35c542c", "comment": "Malware payload", "value": "540847a3f77f8000324bdcac5ade6b6c220cc56d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776489395, "uuid": "39a5dd89-9799-4080-b07b-debab46cc08e", "comment": "Malware payload", "value": "a4c28f891b3b217c0011ae5a90322efa48ac9fc0c1bd1fabcb10ef077d8e9bc57d945d326d3a1ca0b2dd31033a3cf35c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489395, "uuid": "01691256-f49b-459f-835d-47a7ae83821c", "value": "T17D968E12FC9254EAC2FEE1308A975722BE7078A5833177E31F909A6A5635FD47A3D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489395, "uuid": "d3252a03-6a5f-4c09-ba66-4eacc15776c0", "value": "196608:MfP28TQsQsANoP/MRonPdLxd5cPC8S7yHLxzXb1IQ39MA:MnlM5nRonPdLxdWBKSLx7ZnKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776489395, "uuid": "60d19c06-c2e5-4c0d-bb4d-a63c4a8b20d9", "value": 9365076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776489395, "uuid": "ea528279-0655-4cef-b04b-3c0cda7a0f58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776489395, "uuid": "84f22c33-f9ec-4387-b0b7-dc6bd1eef01f", "value": "hey_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294268b2-3b06-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776503307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503307, "uuid": "12f867d2-d3f4-49c8-aef4-bdd5d50df69d", "comment": "Malware payload (Gafgyt)", "value": "c354b0c012ad5d28196be575ad662208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503307, "uuid": "3e491b46-e8a1-457d-b54b-9fe99bf17a5b", "comment": "Malware payload (Gafgyt)", "value": "e9564236bdaac13cb38601b461a76c1b497ae21c85f524cd6f623587101b20e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503307, "uuid": "c83424c9-526e-40fd-99b7-24f4e0eedf94", "comment": "Malware payload (Gafgyt)", "value": "38b9e3285e136bd33c5b8be68f88cab1dca12644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776503307, "uuid": "94f56989-5807-4fe4-96c8-ecfde5e045a4", "comment": "Malware payload (Gafgyt)", "value": "9856403fdc0b6dfb9e38cf2e818c9e635acd9d6a2c01fae94abe8f1423d5e2e7b47ea782d898c6ea01820ba72e9ab0d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503307, "uuid": "2ffb366c-5cb3-4b4d-a0df-bd7aa005c47b", "value": "T1F8D3966A3E21AFBED5F8877547F34AB0C384219226919B45E36CEE2C5F7168C084F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503307, "uuid": "4599b06d-d6ca-4160-9fa4-4777f3ee208e", "value": "1536:T7jO1Tg6q+PMEkt2rKPzZpaOTqmCAje3QT3VBPJtMmi1fhWxS51Mlfc:CyVzqmCATrXPJtMmiBhWxS3Mlfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776503307, "uuid": "63bf7afa-5709-43f4-9913-c257b484c34e", "value": 130541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776503307, "uuid": "d466dc90-de1d-47ff-bb7f-28eaa26b90a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776503307, "uuid": "d3d5f8c2-eb29-4ea4-bf30-f52093d4c213", "value": "Demon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88357c7d-3b66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776544698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544698, "uuid": "c03c41a2-ecb6-4c96-9dc2-21e59a46bf7a", "comment": "Malware payload", "value": "5ec525ecd02d50eb7a4724880eef30cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544698, "uuid": "c33b9e15-838a-45ff-b897-a2dc8d7bfc63", "comment": "Malware payload", "value": "e9b129489dd4994148f74a6ada715f1b3fcbb92522eff0668ccd328035f51fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544698, "uuid": "924d9e31-9f58-4a6b-87d4-3f179c0fa871", "comment": "Malware payload", "value": "78c1d1c02ce4158cad85cffcd31080a79c9d8fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776544698, "uuid": "5a9695a3-37a1-4212-9ac1-bafe4d5ce9a3", "comment": "Malware payload", "value": "543565f1f250e449e73c9ca46e9aa6372cb1b5d95f99f571f9dc4fd09b366f2d5de2b845b6eda751905e37d81c9a72d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544698, "uuid": "310fecea-be80-45a4-aebd-742404407e8f", "value": "T163F49E86E7A416E9C677C1788657871BF771B40603109BDB26A84A6A3F13FE12F3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544698, "uuid": "3fce8f36-51d8-43e9-a31d-e1e6cff3afe3", "value": "600fd47beda2e1d1b682520dcce4b061", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544698, "uuid": "bd60a0e3-e093-4312-8ecc-df2a4666f4b6", "value": "12288:cTz+S+PuDDFxvKkCrdj8dVhBawO0giJ6pBMC3VncawwC2BfEWmep7iyB9AE:7XupkF83aUoBNVuwClZU7iAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776544698, "uuid": "2e5e1eb5-cc4f-44de-b427-b520bf01183b", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776544698, "uuid": "705b9c75-9dfb-4f62-a1cb-d14d3d6633fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776544698, "uuid": "d241dd40-7b29-44f5-8fb1-935ac5e2c3ea", "value": "boostext.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8f32b2-3b81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776556172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556172, "uuid": "2af401f7-bba3-4e1c-bab0-a1c5470417c2", "comment": "Malware payload", "value": "28e552dd460f0edb3b34ac5d7a231f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556172, "uuid": "8612d7d8-bfb9-44ed-8240-10e302a18805", "comment": "Malware payload", "value": "eaf8b81e5f3613747f572bd4c08ae175de32c6b6549c6ce819ad79db1e8ba0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556172, "uuid": "04f164f4-f68d-4267-b54f-825a98cddc52", "comment": "Malware payload", "value": "02ba0a9ffd69d083081122cf804d2b57b6efe6b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776556172, "uuid": "2dd1f419-6244-4cc2-893e-111b74f3fcb5", "comment": "Malware payload", "value": "176c0848efe415b7dbc1e4e57f93cf424019cdda946fd178e10ed3470e3e636e21bdd3886acde6bb5ad63d3f3e3f09c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556172, "uuid": "6bb45258-8b9d-46d2-bf54-5cd000d8be9c", "value": "T12CA68C02FDCB04F6E943093105ABB22F63315D068F65EBE7EA407F29F97B9951836249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556172, "uuid": "8fca5cba-09e1-4a57-8437-831db850e0b5", "value": "98304:JeTNetxBDzXYngOEuVPaxwb4u5E/8DDZ2R8PjQBnAHK8gIJyuU12kH/3p:JeY/xqVpLa/aZ2iCGK874uU12kH/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776556172, "uuid": "164392fe-0638-4ea3-949c-8c361d634495", "value": 10227604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776556172, "uuid": "95c56d1f-1f02-4150-89ad-e1c83b40fbeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776556172, "uuid": "c09e3bcb-16f3-4659-ac89-98c3a0221b43", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e73856-3af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776494206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494206, "uuid": "e81f35ec-e085-47b9-ba4a-3e962fc7f6d8", "comment": "Malware payload (Mirai)", "value": "bba5fd218d83001b8cdbd738221fc870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494206, "uuid": "f10d636e-f7a0-4ad1-853a-5181d9eb62df", "comment": "Malware payload (Mirai)", "value": "eafe14e9fda6171db41d7b6e78d905b82117c2de8a5bfe8889560132bf8dc9be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494206, "uuid": "58a6426c-3739-4acc-9f65-ee940350ea3f", "comment": "Malware payload (Mirai)", "value": "9b25e7af349eecec18bad8883d83f9a37ad6b23f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776494206, "uuid": "1718c562-d961-4a17-a49a-783f940baefc", "comment": "Malware payload (Mirai)", "value": "700becd5544483b38ff57e305a08115f9992983c61e6c9cf6a9c47b6e50bbace2f585b96b0d984a9393465a89628fea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494206, "uuid": "df814a27-8f33-4df0-a8f2-6a7e8ca607a4", "value": "T136538D75D15DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494206, "uuid": "c4121578-e2a3-4264-938c-e17da9571a13", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776494206, "uuid": "46283cd7-0c07-4c7f-a8ac-6dfc153ef065", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776494206, "uuid": "130f98b9-df81-4fd7-bfdf-6e680f534b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776494206, "uuid": "a8018e03-5911-4505-9ce7-c9c694e26421", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a9d297-3b61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776542467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542467, "uuid": "ef05a952-a4b3-487b-904f-7f38c7860fd1", "comment": "Malware payload", "value": "cdc201e236cfc72ee36670166b72114f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542467, "uuid": "3cffe160-16ba-4c11-bad9-bcc6b10c3bc2", "comment": "Malware payload", "value": "ebe891df3802d21c34d1821c5c772d77de4c6e71eb84690ec19aecb923a95aca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542467, "uuid": "62c08ff3-0774-4045-92ce-404902f68f5d", "comment": "Malware payload", "value": "09c010d250aff0b9b748a58c37542035afc5f993", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776542467, "uuid": "b2da9d48-583b-4e74-b085-6cad3a0bbc58", "comment": "Malware payload", "value": "e17563d65f80082ff3a12426ff644066c2ffc5fecbd760d7e4bd4ff1154674f49a3bd3807e6227a7bb7cc47a52e91c29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542467, "uuid": "0d822bb5-fe40-460e-8a40-2666be4fe3da", "value": "T133B67C73945334D8E1A88D74D11415527EAC384B5738A3CBBAC471F66BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542467, "uuid": "90382c49-ef5a-4240-abe3-46581e0f0293", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnao:sXyWSpV+Wu7rI3JE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776542467, "uuid": "0bd037f4-6a8c-4ecf-9238-8988a262ea94", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776542467, "uuid": "fa383f6b-1906-4bab-8d48-dde8ac4f2494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776542467, "uuid": "f136c591-242b-48fa-a884-84df74facea7", "value": "ebe891df3802d21c34d1821c5c772d77de4c6e71eb84690ec19aecb923a95aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2d52a1-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776476983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476983, "uuid": "fcdbf12b-e21c-4152-8d72-62a0af4ebaa8", "comment": "Malware payload (WeedHack)", "value": "eaa57998674a74c4a56ed808c5797ec0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476983, "uuid": "f90fa23e-2634-4f64-a6ac-325dd78a113e", "comment": "Malware payload (WeedHack)", "value": "ed05a7f010b0a5edfe25fa50c43dba0437673df0842b0ef721506a56ed774070", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476983, "uuid": "b548e150-142d-43e3-a6a1-5fd7c398015f", "comment": "Malware payload (WeedHack)", "value": "a1028359dfc2b6e94f07bdeaaa0687806ecdc899", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476983, "uuid": "043675db-e2db-4743-ad0b-62ebc63b9a8a", "comment": "Malware payload (WeedHack)", "value": "fd8cf1a9d8e2d883db0f3cddf179249be9c45c1492ca51ddaf786ec0aa6c4c6ca0d1e76123039fedb416d9806e210144", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476983, "uuid": "30bfe270-e61d-43b6-a50f-637fed2986a4", "value": "T16E95333AF12BEE97C12DD5743475663B8F0FC4150111698EF3E3F32B85A63901A6AE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476983, "uuid": "bc0419d5-9f8a-4f14-809f-d0c59045c690", "value": "49152:JqMUEQZIOvUhfDvd3VYKxfIr7jJIIHCgDsyhMNJbDGW+0RqJTvY:seuIO8pjYWfIPjCErDfh8Pd+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476983, "uuid": "25e16c94-32d0-43db-afb8-6343dad27333", "value": 2043695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476983, "uuid": "a9ed3391-67f9-4bd5-a027-73b3d6352e6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476983, "uuid": "99447bea-2976-4164-9696-577e78896f13", "value": "Fokjiu-1.21.11-fabric.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41ba460-3b3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776527618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527618, "uuid": "2bd4ed7f-1c7d-4541-aad0-3b1fa9baa88e", "comment": "Malware payload (Mirai)", "value": "2bab202991a0ec84e50e5b7755eb587f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527618, "uuid": "0e3e16e1-af48-4e9e-aa4f-5d0c6b357487", "comment": "Malware payload (Mirai)", "value": "ed285955c9f99635abde25061ac497e89ac9a79f0a41b136fcda3c052b04955c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527618, "uuid": "0cc6e2a5-b23b-422c-9471-88f1f82aa496", "comment": "Malware payload (Mirai)", "value": "9a887ef50194d7c147a521ed31a178cc8ad7afa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776527618, "uuid": "9b4b1480-34eb-4268-a29b-5fbc2aaf5072", "comment": "Malware payload (Mirai)", "value": "b35bf9cbd224c0645c873fb485544667bc09279ca81259acee949f816f2c0a2e8aaf455a2587ab23574dff8bfcc15cb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527618, "uuid": "89063b42-4567-479c-b4e9-a5156b2bdae6", "value": "T1D8148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527618, "uuid": "a4b9618f-38a6-4f0d-af01-5320dfcdbfb2", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxy:bOVfbEdxm4iubM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776527618, "uuid": "c4b2e623-7b20-4d9e-84ec-766ee6243071", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776527618, "uuid": "cba144e3-cab4-42c1-8d9d-b5a177dedda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776527618, "uuid": "fbc00c84-ea26-4125-9fcb-e5a82779d73f", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aedf73-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776492996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492996, "uuid": "a4ecc305-b23c-4b5d-b141-76c30bc7eba8", "comment": "Malware payload (Mirai)", "value": "a1aba2f612017f60ef819cbee280affe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492996, "uuid": "1d7b42ad-4b92-4fc6-8087-b961a7bbdbec", "comment": "Malware payload (Mirai)", "value": "ed7b88e7f1f603a0e0a80e671c13de1701e4601e0685710d0570de726c72efba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492996, "uuid": "d2171d36-741a-4d5f-8eda-6e21303134be", "comment": "Malware payload (Mirai)", "value": "933b0b05b3073214eeefa6c848169474125ded0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776492996, "uuid": "99197753-6143-4194-bac2-6ae92cd18093", "comment": "Malware payload (Mirai)", "value": "e8eddf3ffadd14d179a32a2b2e9b7c99b68ec3b332425222ecf91dc619340639c16b41af5185c20f9d11e97cb1126ce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492996, "uuid": "ac85c6c6-b8cf-42d3-8818-6fd0707a9cdd", "value": "T1A3F33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492996, "uuid": "15f68cc9-bcdf-4811-871b-4a01cb0f536d", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6MjyHDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6OyHDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776492996, "uuid": "1020e756-142a-4370-9c41-48d5685d68e8", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776492996, "uuid": "8c90da88-3714-4054-8c9e-1ffa26ebdf02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776492996, "uuid": "3eaa34c0-d6a7-4bac-8268-662034742a5a", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779f3746-3b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776539516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539516, "uuid": "f32ad985-0998-4ba9-8268-169e2ad4ff42", "comment": "Malware payload", "value": "e074a19b91cdf4b8ddfe9de9f534ab99", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539516, "uuid": "ebc1a062-7556-4420-bc74-1867c6845166", "comment": "Malware payload", "value": "edd3f38e7eff35c6ab5a0e2dd8cb71a0011611eaba65611c2991c0be84f6b927", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539516, "uuid": "85aea03f-7727-4c82-b452-d8ac55a299c1", "comment": "Malware payload", "value": "117d9c425124652f1d477a0249faab4cc906dff9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776539516, "uuid": "20105c5e-770e-461f-a975-85f1c6646ba0", "comment": "Malware payload", "value": "ccfd5cc24fe4c9cde9a890ef3885660bb03d64b872228baa98d0a9edac1d009fd8237381e2dcf2d2081ea79703698763", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539516, "uuid": "3485b092-d403-4d5d-bfcb-fc6056eacdd3", "value": "T12EC40222D26C3474E9175334F48DA561781F0291E087783EF9BD1A9F6D1F9BA8B18BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539516, "uuid": "ae2cf31f-ad24-4c7b-99a1-d1ec47b35852", "value": "12288:daKQZcTkfdeuMZzeUpuBEGSGbV/tADb+/5Yd:daKQZ/deumZcBEGqP+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776539516, "uuid": "38f57cdd-cba8-464e-985e-d798951a59d7", "value": 595725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776539516, "uuid": "467e672c-a5c1-4d6f-8c26-ba575e68abf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776539516, "uuid": "a32d99d4-173c-409b-b473-32426947193e", "value": "astral-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4eb675-3b5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776541884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541884, "uuid": "a59cb744-a153-4bbd-8557-194eb5433cd1", "comment": "Malware payload", "value": "4b1411f6a746a7345ad4c1d4ea102669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541884, "uuid": "1953fd61-8fba-45d0-be67-7d7ea9a7bcb4", "comment": "Malware payload", "value": "ee52bbea96c48949ef04346ca478b7bfd85c4f829cbf68eb04444c9b58dcbcec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541884, "uuid": "f50c0e25-4c94-4521-ad0d-9c60684b0e3a", "comment": "Malware payload", "value": "39a48fc6609b9d0250c0c945413f469914d2f01b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776541884, "uuid": "e5b65cc0-00b6-4303-9377-f0b09d1f958d", "comment": "Malware payload", "value": "717a4bf9016317474f6468cd6b6e8ac96248c9b98a51737360d7f59c9179519d07cf6eb88d2271b0e3d10ed3d25d76af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541884, "uuid": "5d4f9aa7-a362-487c-a296-843e89e93c31", "value": "T176B57B4ABCD518EAD46A97328DB72682BB30BC0D0B3363C32E4566792FB2BD05C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541884, "uuid": "8b119fc5-bdfe-48c9-8dce-1df0eb43174d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541884, "uuid": "72f2b496-808e-419f-939b-ac29d70c2555", "value": "24576:fW5BFDMn5D5jO3qKpH1+s/VBYebZggZCL6Q4zYs74QnCu+OZTtXEOtPSz5wt:fW5bDMnjjO3q2+kxN0sB5+iTVE/Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776541884, "uuid": "34d58a77-be1c-4b74-8d57-7a3a5e2dcda6", "value": 2341592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776541884, "uuid": "fe10e489-355b-4e73-b2c8-676ab00f276c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776541884, "uuid": "2409aab1-eb37-40a9-a3e8-26052b63ad1a", "value": "\u041did\u0435t\u0430\u0440\u0440\u0435\u0433GUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd9a065-3b4e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776534346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534346, "uuid": "72e7924a-6c20-40be-b2f2-058d053fb308", "comment": "Malware payload", "value": "48a0f9442aaf6e39ce8aa5959453c430", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534346, "uuid": "703a6c30-e86f-489d-988f-21a9acebdb97", "comment": "Malware payload", "value": "ee9cc68472aeaba2a50cf0f49a5cefbf3af247ceb8d42018edf891b0be6f696a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534346, "uuid": "cf0f272e-81c8-41da-961d-f04ba3df1ae0", "comment": "Malware payload", "value": "cd5a1aec94696b7dde66d4a293c18f9babc1f6c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776534346, "uuid": "4815941a-2fef-43f4-bd41-9e39d80820a7", "comment": "Malware payload", "value": "d6bee6abf4554f998abc4952db5aaa1fdf8ff4973326136c21c3bf1195381e62db2cb1b8ae5fb3c4d2c83435c9121120", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534346, "uuid": "64888471-86eb-4090-972b-8e349de3f986", "value": "T155137D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C05A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534346, "uuid": "763ff2c6-db62-49f7-bbd4-1afe0f9fc991", "value": "768:b8s9NyXsZztCz9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b5HusZ9cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776534346, "uuid": "1bc780ac-5406-4bf9-b357-6ce840088f18", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776534346, "uuid": "08030127-f3c3-4d2a-b2aa-8a5d75cf887b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776534346, "uuid": "7edd92ad-4ab9-4f74-8d77-d9a2b63dc87d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bb9ee8-3b55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537179, "uuid": "31f57f8a-ba88-43f9-ae6b-2be91fafc81b", "comment": "Malware payload", "value": "eabe68756c38064eccc124a887fce778", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537179, "uuid": "d070e5f1-e6d2-436e-b4b4-1ed73fdf143e", "comment": "Malware payload", "value": "f09254d5e5ad67fdbeee55f67925d5f17defa51700643bdf38ad420e4892ffb5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537179, "uuid": "18b2111e-4934-4ae6-8345-489643985bd5", "comment": "Malware payload", "value": "ed9a86c9e049f3f1f18f552ae0e35a45168ee503", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537179, "uuid": "4294ba1d-637d-4d98-b328-9f4e9d454987", "comment": "Malware payload", "value": "1b5fdc22b100ec422f460af92d3fcc213d658d283b03bb23d24b47114949fe906844a1a1b5d0d4a3c55d62ff468e6570", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537179, "uuid": "38194635-d843-453f-961b-d1a1a4b7ccb1", "value": "T1F6A52333F6CC5821EC77ED36E090E822625D05DCE94677AF26F0A4AF682F7D84796604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537179, "uuid": "137b8af2-b85f-4409-a60b-3f3c03b78ed3", "value": "49152:u0Gai9DKLtxWEWWzH0peTYo0WzH0pIE2g83D:ZGaADqWEWWzH0p2Yo0WzH0pIEX+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537179, "uuid": "e58456d2-aca6-4fea-9fb3-fb98fbbc3a6b", "value": 2264884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537179, "uuid": "45572811-8dce-4bb4-b436-93e89f99233a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537179, "uuid": "4060b819-2e4f-4187-a520-9fd271043ea7", "value": "Nova-Client-1.21.11-latest.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b345d949-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476910, "uuid": "7ea3a4ab-7b0b-411a-85a9-c05ee47b3fdb", "comment": "Malware payload (Gafgyt)", "value": "b7afe654a7b332aa31be5779db5a9da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476910, "uuid": "a9783eb3-2412-40b6-8a2f-c9b733463521", "comment": "Malware payload (Gafgyt)", "value": "f0d65338065ee6726d47d1522450f0dbc8e4821dcf99a236e0290e1728e6e60a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476910, "uuid": "7fc130a9-e7f6-4f33-88b0-e3c096b2258f", "comment": "Malware payload (Gafgyt)", "value": "4bae0c09ad2f7eb2651ed48016b34389498ed867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476910, "uuid": "21e4338f-7eb2-4488-a161-a249e95530ee", "comment": "Malware payload (Gafgyt)", "value": "fc972113f3260f9f66381f80d108c3b1b531f23f1875cea987341e3b551eca376f35826256b6ef76bb297239f784719a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476910, "uuid": "438dff24-1754-4fee-866b-251525a326e6", "value": "T169C31905FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476910, "uuid": "41d608a6-6369-44d6-895e-e929a382c43a", "value": "3072:4DJDZ+6lJQTnoo3jKiXb6DwXg/5hLNF9u+CyhAnjqojwQQRh6RYAvZR:4Gb6yg/5hLNF9u0ojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476910, "uuid": "3b5d8562-9a04-4623-97be-943c2eaa40a5", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476910, "uuid": "a9ab9379-67fe-4929-acb5-0eb04eea6696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476910, "uuid": "cdabcf5f-be8c-4a03-8716-e9ca8c615218", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e064c44-3aee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776493061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493061, "uuid": "ca4ed02f-083a-422c-b152-acfa8371b5f0", "comment": "Malware payload (Mirai)", "value": "13782e89cc41b3f61b6cd1ed4182df09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493061, "uuid": "e185f6fa-37c1-4fe3-8daf-c378eb51cc26", "comment": "Malware payload (Mirai)", "value": "f1587218861f338f7ac63197d1d1b3bd3d1a20d4b4cf9cffb62bc3e4dcd444d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493061, "uuid": "957b2642-63ea-4ab7-9c9f-14910ce3f73d", "comment": "Malware payload (Mirai)", "value": "6e93bc43d6c1c4e8cfff6948b065035ace84ad84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776493061, "uuid": "04d315b2-4d27-46b4-9ea6-72d3d3043e60", "comment": "Malware payload (Mirai)", "value": "158e1f04fdd05fb6a1109bcd7ec17b00bf731c1b6587e53eded5a355614a131740a4e448a5566e0614d64c5bdaa9fa00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493061, "uuid": "54265b9c-2c06-4990-a17d-8ec2fd5107d8", "value": "T1AB733985F987C6F2C4474830416BFB3FCB32D9A511A1DB0DDF5A9F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493061, "uuid": "7903c30a-e9c7-4f03-96cd-9177a7014cd1", "value": "1536:Wt6dVFeGBV9ah2tYeQmP7uW2wORzBbkivom3aJeNdLNn:WtSjBnah2tYe3PrXORzBbVvHNdLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776493061, "uuid": "919516ca-632e-49f8-846a-8034cb6eb988", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776493061, "uuid": "55bc29f6-c22b-49dc-8357-93b2a4058265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776493061, "uuid": "97477496-9cea-4356-92be-7f08c17537e6", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af58f233-3b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776512551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512551, "uuid": "67b7cee7-0d1d-4447-b1f0-a702caf07d4c", "comment": "Malware payload", "value": "1c49c9c507439ced65d857b7797b248e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512551, "uuid": "7d760934-1073-4240-a5e7-bc658b4e8537", "comment": "Malware payload", "value": "f1c1377b376f041c968d55e41f8624426036cdaf03b50659fee4b747385e4fd0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512551, "uuid": "54915ecd-8571-4f59-9e5b-c087ca5d1914", "comment": "Malware payload", "value": "5ef620bb5b44ba1d0c2b29d20bf2473267ce415d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776512551, "uuid": "47294462-6c40-4c5c-993e-cdc5213d1af7", "comment": "Malware payload", "value": "07fff99897f786fa2432dda042101384b410d3b2dd1458e86b6f2683d330880c59dc15d20b52c7c22b9b7ef0b1ba91ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512551, "uuid": "3dd55bbd-f4cb-41b0-a49b-ab0e6bfc2868", "value": "T18E136D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512551, "uuid": "49774ec7-1258-47f1-8b9a-7a40ca23e29f", "value": "768:bSXRWNGxVX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:belx6cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776512551, "uuid": "f18521de-b59a-49f3-9134-ff5b8e21e7a4", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776512551, "uuid": "fca13265-d441-4c59-bbc7-5c7fc5844a29", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776512551, "uuid": "8e52943c-ba61-4d5a-8a70-040939056cc3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd092e78-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776537082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537082, "uuid": "4575b06d-897e-42c0-948b-9676a5753a08", "comment": "Malware payload", "value": "2529d8d3cb976e37b068d05e5a40d185", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537082, "uuid": "615a44fa-7d69-47be-ae06-5db422c48939", "comment": "Malware payload", "value": "f2cbb542266710e3f97589bf8f30a65601d2cb5a3210107de297d8e45a504b27", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537082, "uuid": "5c6db01b-2a20-43c9-8422-38e309a36b66", "comment": "Malware payload", "value": "1e5a1a070dad2483638c6a308508a760b1520f2c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776537082, "uuid": "760b8841-08f3-477a-8381-9afb5d11c22a", "comment": "Malware payload", "value": "7f0b7ed74fb87587b90320700795066d85f3aae7985b195ff100c1863d1e87abb5d174c2c0c8680b0105f0a3fa4e3feb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537082, "uuid": "29b16d86-e58d-4d72-8ca2-18c7c1c1727d", "value": "T12F2533D6CBEF8E413986712CD6AC94F41DD77B49076D9384E3DB1C60AC329B69C0892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537082, "uuid": "a72b2098-0b12-45d5-bb1c-387780fade45", "value": "24576:BVQbNWTCbV17GmBoyAEc+ZISkpIiSfg8JFq5h6K2hrH:nQbNWC1ymBocc+ZIWimCEhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776537082, "uuid": "4ac71794-7f8a-45e4-8a60-2c9032bd245e", "value": 1051932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776537082, "uuid": "c00d05e3-81bf-4a5f-895c-81f0012d26a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776537082, "uuid": "c9b8d23a-3518-4093-82da-a2fb4e4ef660", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b5523e-3ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776487998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487998, "uuid": "d097fc0f-b443-4967-8bf9-d551d5185b64", "comment": "Malware payload", "value": "b0426b03418c176582045ac06745566f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487998, "uuid": "a7e657bf-5f42-4c75-b6d4-b92f54861dcf", "comment": "Malware payload", "value": "f2d13c04e197ef02c716044392080dc3cd525734bf6daada9e0ac8d9265105e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487998, "uuid": "396ff301-ba6c-4472-9e20-bd85f9a498d1", "comment": "Malware payload", "value": "3972098267a77242a50d2ade44aa48476365bd9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776487998, "uuid": "0376aa03-948d-4b7d-963b-89ca179cb9e2", "comment": "Malware payload", "value": "a7f0fee3cabee9ad9dd21f15273fc8d3733ce1e6a628083a18a1f922d451c2402e1b8f78e47c6106bcaf71a2c8c0bcc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487998, "uuid": "8e1be56e-a3de-43b9-86ae-b61443704b30", "value": "T171530272A345C911E04B7FD6488DB3425B96C3E632BA46EB5081E703632671EF963C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487998, "uuid": "a21fb5ef-3116-4a77-9f80-2c9bc830730e", "value": "1536:QAlQcECQ0zTPjqlWSk5oUhB6t3+mqu7ea4uTG4tZ9hgMmZTRm3i4u+qgw0VuE:7RzTPelWJEx+aN3C4BhhmPmy4u+qgw2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776487998, "uuid": "f2e40658-6bb9-445f-b04e-69a3ce1faebd", "value": 64200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776487998, "uuid": "bcb16f59-9173-4da4-9730-927d4cf808a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776487998, "uuid": "781a08f4-66a9-42f3-b026-2331ec546612", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a639f9-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545586, "uuid": "8f5d8793-0ef4-4fa4-963d-c55b189f6553", "comment": "Malware payload", "value": "61ace205f56ead5243b287d414f9a102", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545586, "uuid": "e34d9f61-03ef-4f77-9221-0d1a3f5642e7", "comment": "Malware payload", "value": "f4b77ec19c8d04dc402aec3773f25d7e3b11201dfff6f27b7ad5d28bb183584d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545586, "uuid": "9006e6ac-85ad-418c-9bd3-bf61748e5c3d", "comment": "Malware payload", "value": "3f456461fe4a7c2498bd1e146a327089f0897200", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545586, "uuid": "f7fd2cf0-c1b3-417e-8250-d5f6829f9d26", "comment": "Malware payload", "value": "e7139fa5104dec93c2949738c543c18001942b861616d86eb18c536a176225e538a29e2c02b44d47f1f94c9a2cf4f614", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545586, "uuid": "bb0888aa-663b-47a0-bf7e-3258c96f644a", "value": "T1DEB2E07CDA675411E44B4B35044E2FEABDDF43C681CB5EE619B08B8A006236FCB89E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545586, "uuid": "b141d748-5a7d-4bf5-b568-ef58df123281", "value": "768:JW9ncAVCGvtElcylWy8y074fwkepLoQLS:aVCGvyEuarf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545586, "uuid": "82ce27a2-7542-4b13-9d79-5bf32dd662c8", "value": 25658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545586, "uuid": "fc5bbfe0-5c12-47bc-9dd1-94040d26f9ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545586, "uuid": "ea7bd27a-594f-4d51-9c7a-104e9ac76431", "value": "Example-1.0.0-21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b72ab14-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484520, "uuid": "a3ba3e04-a155-4bf3-a05c-dc6fabedf465", "comment": "Malware payload (Mirai)", "value": "25e7abfd57024a76ed16de19f246258f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484520, "uuid": "ef4e5158-b9c3-450a-82ff-e8d3a1f7d520", "comment": "Malware payload (Mirai)", "value": "f58158981b352b790d3c53fb755f5868db7f04b4429e318667bd639d642c320a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484520, "uuid": "c84f3538-4912-457d-a5a1-4e00ed1a7ca7", "comment": "Malware payload (Mirai)", "value": "16bcbfeee0681526ed75e5c8a5ee9c4a6cc6014d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484520, "uuid": "0ccf63ea-861d-4f48-9e52-273a12c2bdfa", "comment": "Malware payload (Mirai)", "value": "4decde092c5cde777b6d7da27bc7c31ec34289d8196646461b5791ecb0a3c845b5163d67ac28e097b56cbc4ea0d5b20e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484520, "uuid": "082191a0-1389-415c-b912-7c1ada06ab18", "value": "T1A02339C4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484520, "uuid": "efae2015-ad70-4c3a-a0c0-24f6f9b57198", "value": "1536:4LInPCqAAXJLE7cxtdl8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdl0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484520, "uuid": "048cb988-d1c4-4758-8e24-8129a5470836", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484520, "uuid": "019864b4-798e-4590-9ee2-1562ae36e0f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484520, "uuid": "b6e3731c-e464-495b-99e0-4bc5d09e7d30", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea9d02c-3ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776486297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486297, "uuid": "ad6dd79d-9f57-49f0-9f16-850c5ca279a0", "comment": "Malware payload (Mirai)", "value": "b17bb9c96e92ebe6dd83f56492efed82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486297, "uuid": "320d66b4-4469-4361-8fc8-c58d876ba302", "comment": "Malware payload (Mirai)", "value": "f5a4a397dd69f549bb9fd1b7e2d8123cbc2f02542d54cb584422027fa82d1709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486297, "uuid": "0156fb6e-500e-44cd-8c4b-556cfa7797f9", "comment": "Malware payload (Mirai)", "value": "c4b77cb2d1338eb5056022accc7bb12405a4a6d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776486297, "uuid": "ff65692f-382b-4772-a763-eb1b434db813", "comment": "Malware payload (Mirai)", "value": "21d1e1c229612842182f44d9053d091f4f064a20f825a2dd9f10dd2edb596e8a0ed0c389b4e59c5409d7186d0b839abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486297, "uuid": "a395a979-f93f-4b6d-8595-281f932cf5e1", "value": "T1FB636DE1F6167E7DC8AB2D3D948E2B4A7F1C5FE05A439110A0B2BE471AB31531D22DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486297, "uuid": "1c551c26-a705-44b0-861a-ffb0efea921f", "value": "768:FAHzyqbrtHyW+WNrf4UI7PgfVf910/Wt0FI02YW1sIiceZpvsUMCMt0vC5N9Eia4:6xRNcrmHKu0V2IpchUntvC5NTa2043P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776486297, "uuid": "a7c6b369-0517-43ce-87ff-6c88a89b8dea", "value": 67124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776486297, "uuid": "7a6773dd-4410-49df-88ce-66f2ff2c380b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776486297, "uuid": "9ce3584b-ac87-4c56-b270-56b3436bea01", "value": "alyssaam68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62147f96-3b08-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776504261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504261, "uuid": "e788537d-e65a-4467-a54f-d66018ff9d76", "comment": "Malware payload (NetSupport)", "value": "f7c9d8e37c610a778d6706c457610a39", "object_relation": "md5", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504261, "uuid": "b9bf0784-9db2-49df-bfe4-720bd1030bee", "comment": "Malware payload (NetSupport)", "value": "f8eaafdf19bb4e7b861a1666e1f275ab51053876649179cb489028336eed4f89", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504261, "uuid": "29521394-4ac5-4951-895f-47d4452ca1b1", "comment": "Malware payload (NetSupport)", "value": "1c450780f64f2cbeddeb9707369437ffb74fc99e", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776504261, "uuid": "8a2f4490-fef5-4314-972a-e7c5b10eceff", "comment": "Malware payload (NetSupport)", "value": "9512c71203499a341594c5361c958372fd0697c245e7975ae3fbb4ca7f6566861a0b12dde52e0cdc27f56451e2ec1676", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-248", "colour": "#A4126E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "noexample-com", "colour": "#B93E94", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "whoiamso-com", "colour": "#F6DBAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504261, "uuid": "cdac6981-aa11-4115-ba1b-eca989bfc1ec", "value": "T1C2F05CBF50A91D3BD14305C89D49756B81C78B5F48991EA152CE67610DB6B3E09D900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504261, "uuid": "d27cf197-1363-459d-a2f9-b7869763ef4d", "value": "12:2huRs9AHNi/deoiGFxXJ6Dptt3V1MIA4bCPs:2huRs9+aDPrZ6t30Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776504261, "uuid": "be35cca2-1538-472c-8467-84f0d9b26ce3", "value": 479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776504261, "uuid": "12784aee-83fc-4157-886d-6ede5760579b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776504261, "uuid": "a850e9c7-f941-4b4b-b7de-df82230ed72f", "value": "f8eaafdf19bb4e7b861a1666e1f275ab51053876649179cb489028336eed4f89.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a7fa5a-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477068, "uuid": "8d9f7ac9-6e41-46e9-a5cb-f45a3b081974", "comment": "Malware payload (WeedHack)", "value": "c7e1c733351d9234348a2142a9935e22", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477068, "uuid": "723d4b8f-ac92-4360-b6e6-079b3c1fa594", "comment": "Malware payload (WeedHack)", "value": "f9fb0fc27601ea4d472d845da834e8d3281cbf33c103dc95f29abef27f18b032", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477068, "uuid": "a37ba05a-c13d-4e8e-9f61-14b70803d71c", "comment": "Malware payload (WeedHack)", "value": "56e1040d03d8fa76354dcbef3e9ab44fcd07a0da", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477068, "uuid": "6dc2360b-2838-4615-98c8-02eb10ad43dd", "comment": "Malware payload (WeedHack)", "value": "054af7fc52300cc56f8ce624dc07dc5409d59050e6a526f65472195ec09a659441e14e6918d9b4c7e83f278fb8b84c15", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477068, "uuid": "b9bd50c2-165c-493b-b1c4-8d69ca84fb8a", "value": "T164E41253F139485EC41FDB7E010A09B776B8A8B1987EF95B36B297DF00878895B4278C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477068, "uuid": "e2df7210-288a-4b35-b8d9-baf7e57b5ee7", "value": "12288:+zK96yagCagX2Dp8bqMYc6xTNObnw1fri345s52nIzOPgxzQ:cbyQa/NRMu2jwZrO6lrP40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477068, "uuid": "faa96f8a-bb4d-46a5-987f-40b14ff0d66d", "value": 704736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477068, "uuid": "ff899479-d1df-45b7-b265-3155c187605d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477068, "uuid": "6cb84a7f-b844-4b33-a0aa-386f99559534", "value": "SmartTweaks-0.2.8_BETA-clean.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fba3b84-3b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776545596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545596, "uuid": "2a86be46-4fb6-429c-84b1-15078c3789ce", "comment": "Malware payload", "value": "f3a17f26279d2fe879a41557e5470e62", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545596, "uuid": "abd4103d-9876-4d46-bc08-1a4b108150aa", "comment": "Malware payload", "value": "fa3c81cdc511d1246896927f24614c0fdb0ecfadf55f09529a0d463e6d8add85", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545596, "uuid": "bd7b9f6f-b4c3-4ba7-a4de-6705e441bed9", "comment": "Malware payload", "value": "cafc45f1e6e775beaeb90f42ec88fbdea72a8cb3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776545596, "uuid": "a2b1f2e2-0f1d-41de-a6f8-1568e0066615", "comment": "Malware payload", "value": "faf3fac3c370f10986a0705f3b28e02fa125ad0ea9933e6b1467b83c4c80de6cbe69a0095e11683c7fff9fd1a18f273d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545596, "uuid": "1f504cfa-9f85-4be6-ba7c-33be46d8f5d9", "value": "T1DEE4C787F1208AC7F44FDA7F14504211AEF0F4704607F2562B6E885A6FEB9C89E653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545596, "uuid": "b050f217-094d-4d5d-8925-737ecc584ce3", "value": "6144:W1eMX5Uh/W94gpr2TwPjhMoAs/Td7ev+8O0D7BMn4LUUnDY0/1Kp3x1Z4bN:Wh9D8lPvj/18WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776545596, "uuid": "b5b7bc52-bb38-42fb-9d97-745f1ffb07d8", "value": 702564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776545596, "uuid": "91921a3f-f2f1-477e-9181-6199e75eff1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776545596, "uuid": "8124e5d2-f772-4222-a2ce-08c362be2163", "value": "Krypton_-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9b7da7-3ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776474139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474139, "uuid": "0392e094-ecc0-4a4c-b58b-6a4909127b7a", "comment": "Malware payload (WeedHack)", "value": "e33620a535bb4da824dc0bdbf066987d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474139, "uuid": "f7c8f089-19ae-4bdb-8f87-4e34abafabd5", "comment": "Malware payload (WeedHack)", "value": "faace69e79c5e9420bc5504c9fd6b4f2f85281eb89002762b52987560f0c2b26", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474139, "uuid": "bcbaaa99-0e9c-48c6-9823-093444e0214a", "comment": "Malware payload (WeedHack)", "value": "d249eb70114dca73e780bbec2938375baa408815", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776474139, "uuid": "ec0d8142-bfe0-480e-836d-58e9fba84877", "comment": "Malware payload (WeedHack)", "value": "879eaca3a7778837970a86abad8ef599d3c130cb761c71606eae5516e970222c395c6a9f273101c479aee1e918f9c766", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474139, "uuid": "cd0630fe-a3ad-4767-ac6a-596333bd2981", "value": "T1ECB2DF258825D625F40F6E3C12F1AE253E0A01D4FAC5ED9DB9916D3DD022ACFE6892DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474139, "uuid": "90fd64ed-eb90-4fc7-86eb-a8a5a8f7eddd", "value": "768:29nUtDr0lM9N9eYAmBqK0gDhZHoZNmaG1MjJ638S:xtMloNAmEK0gDDHyMaG1MF63F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776474139, "uuid": "3bb146c5-4bf6-458c-bb83-14bc5d71ad0f", "value": 25707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776474139, "uuid": "90e7cc1b-0f99-4361-9402-afcd8b16db38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776474139, "uuid": "4f15269d-d340-48b3-9dfd-d8f3f48d8427", "value": "krypton-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cd9b48-3ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776476915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476915, "uuid": "9e220160-a40d-4e50-aa3e-6ed7fca86332", "comment": "Malware payload (Gafgyt)", "value": "7d1a23781ab4e502a7a4ffd146838764", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476915, "uuid": "dec3aa3c-9ad7-4476-8fd9-7ff223f39f1b", "comment": "Malware payload (Gafgyt)", "value": "fb2e27e8d47838721bba3a9e51c7ead6e214ef54ca80665b3165ec3a9f1ef201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476915, "uuid": "4bb76394-df77-4707-a46b-ec00ac818b85", "comment": "Malware payload (Gafgyt)", "value": "8fdfa6af5f6a025ff235b365af92caf57c90f7dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776476915, "uuid": "3986f2a2-24cc-473b-9287-81ac7687d067", "comment": "Malware payload (Gafgyt)", "value": "fab2a9ca10cfee01759245737ac0d8b8fd5ace425d09ce9b5f5028feb9eba7bdc30ac4b6cf115c621d365ed5686cf4f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476915, "uuid": "8881fdef-248e-43a6-8f39-0c79e2f200a5", "value": "T146E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476915, "uuid": "ae7a78bb-966e-469b-beb1-8b32abf0a038", "value": "3072:C2ttgUm6Oq+lozL5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++zL5hdC8URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776476915, "uuid": "d9872ac0-43e6-4d99-9e76-cd738d632c73", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776476915, "uuid": "c23f9d32-f9f1-45b4-9e35-eab3790134aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776476915, "uuid": "5a849881-274c-4085-be16-09eea79d112f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9dba4e-3ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776484495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484495, "uuid": "5747dec3-0f27-456e-8d41-ddae2a761c3d", "comment": "Malware payload (Mirai)", "value": "d01c36066f3956d5c6eed81ede83ea0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484495, "uuid": "970a3ffb-de7d-4e0c-86b3-f7123369b9ff", "comment": "Malware payload (Mirai)", "value": "fba371894d19420e5511101596eea10157032fc7301c5abb2317e6e6ea4fea53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484495, "uuid": "7f4e2905-398d-46a7-9c0e-9332a19d286f", "comment": "Malware payload (Mirai)", "value": "b3b5375e282c6ec6dc5f827d8e7011aae738584a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776484495, "uuid": "12787de8-b3d0-4c75-81eb-6f2a648b8ff5", "comment": "Malware payload (Mirai)", "value": "55cb68fb8a001c8c3a5cd66da6943b293436fb8f7becdfeba324b65364f040d98b34c636b3785b8bc19f30fd7dc321ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484495, "uuid": "0a5f8cc3-7e5d-4e43-932f-0ba11a6e6611", "value": "T11B63961A3E218FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484495, "uuid": "1f78c56c-4b5b-4d20-a243-2e36b9ab8a91", "value": "1536:AHNFnXDuPq/SyZBp9tgI0v6bqfg/Kkz73o2x8tW:gNFXDKGruI0SWYz73o2Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776484495, "uuid": "2b6c5a40-11f7-4964-b320-7e5d33c8abfc", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776484495, "uuid": "b9c82c1e-850f-4324-8b4b-3db322d97908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776484495, "uuid": "edc2cb46-826c-4b2b-834a-3882a8881110", "value": "Josho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241ed870-3ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776477099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477099, "uuid": "dd0b91e9-2436-4d0e-988f-fcf3427460e4", "comment": "Malware payload (WeedHack)", "value": "5f2014543dca269e5d2a4d0d037c6c16", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477099, "uuid": "91b6e643-fe68-4869-ac02-21333912bcae", "comment": "Malware payload (WeedHack)", "value": "fd33b9c15b259a52c7ac0260e912eee0b9e91b9de443857ff578af9c9b37221b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477099, "uuid": "7af3130d-3fa9-49a3-846e-306d0e82120b", "comment": "Malware payload (WeedHack)", "value": "75267bebc4f3625d1bb801de109d568ffd063e0a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776477099, "uuid": "5d24fa5c-5728-4563-ab5e-5ecab821fd0e", "comment": "Malware payload (WeedHack)", "value": "b6750ae95b1eb0e2b7e26d9a40ae4d50b5bf479f6b4bf9b53cfe5ebfae9e04bbb469941d247a599e61ac876df2fcd29a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477099, "uuid": "2c367c2b-bed3-4f40-be97-e793af73f02d", "value": "T165C42276E3A809BCDB430130E593963A3B2E1590E5E736F76EF44D670BB31D9AB24211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477099, "uuid": "d05a6b61-db67-49c9-bc25-626332bf62fc", "value": "12288:x0lJzuoLoxhBMCWUogibPNnCnoBLT1ERmaJIXlT5AARx1J0:GzSxhBbogiKoBP1ERmfZ5AcxH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776477099, "uuid": "78fb6173-fc39-4764-aace-6fa6dcda2c54", "value": 583671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776477099, "uuid": "9d568202-31d6-47e2-a2d5-7171a210b097", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776477099, "uuid": "98a90eb3-b00f-461a-9f31-dfca88118221", "value": "XXLPackets-1.0.5-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727a0ada-3afe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776499994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499994, "uuid": "e4a8fca0-d92e-49da-bc05-9a16a029a8ea", "comment": "Malware payload", "value": "4065c795fb7f23414e423b98aacd49dc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499994, "uuid": "3bd0c643-6467-48f9-884d-79c70c98cca7", "comment": "Malware payload", "value": "fd7c0f6fb3ce15e5e5f713147fd64365e9cdab0d2c23f89aed91005a3ae9e58c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499994, "uuid": "343a3bab-7dc6-4479-aecb-545bbeea78cc", "comment": "Malware payload", "value": "87d03b4fd88c20b0cb6d58d75545f0267203c22a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776499994, "uuid": "40944246-fa45-48cb-b3cc-2d035aa7cacc", "comment": "Malware payload", "value": "42d60747f4b98ccad046174ccf28ec1533bbea3e9df49afe1b06b60bbaa34f3d1fc66fc67f46fd13ab258599f79e2ee4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499994, "uuid": "f9d29a0f-6cc7-4bef-a49a-d8c8fc4bfa62", "value": "T1E807CF81F5AA447EC8F690B4561F8273F5257C9E0312D59B6908FA647AB37E02F2D3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499994, "uuid": "242f012a-283d-4709-b704-03d11232d582", "value": "196608:coe5RiGlWOpfMHJq5vSnVoo3/nUyfZy4HkcsCXa+eThOzPfkYSX1y5LBibBdHq9:ZcRiGlWXHJq5vSSo3fUyfZyI/fkYI6Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776499994, "uuid": "95f90221-6a09-4223-a9bf-cdb349336c3d", "value": 18455612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776499994, "uuid": "be45d3d6-b2b8-4d43-86b1-de50bdaf2543", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776499994, "uuid": "688c33e3-9c73-4a57-86cf-8135a71c0772", "value": "deutsia_radio_(1.7.1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b939b3b-3b54-11f1-a769-42010a9c0008", "comment": "Malware payload (Plugx)", "timestamp": 1776536892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536892, "uuid": "672aaa35-0b55-4459-b0af-f17f8355941d", "comment": "Malware payload (Plugx)", "value": "a2fcb656949609db8cf21dfbc9f0e43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536892, "uuid": "bb9643e5-5d51-4202-9911-1ef1e582247a", "comment": "Malware payload (Plugx)", "value": "fe002e42fa0ee025f26a518dac4efe51be8ad7dee2493d971c01cda89eaa1927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536892, "uuid": "4710343f-92b5-4e3a-b97c-586b05615ffa", "comment": "Malware payload (Plugx)", "value": "4919d924a19c1fef08a287b01e5824a4c65ec19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776536892, "uuid": "5d71af16-99f7-4ea0-8d33-8163e4de6406", "comment": "Malware payload (Plugx)", "value": "64a71c407189e8a6ce3a1e119120ef12b60e6b4823696a7ec8d8724f8640abb45c43048ec06017e8d52958525f1b4cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536892, "uuid": "9514f9a7-acd5-4481-9939-1b80f2119e87", "value": "T1D3E74942A6EB45D0F9F7AE3155F652274537BD066F3184CB620C1B2A5F332E08A73B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536892, "uuid": "b8e22b9b-85e6-49d3-8bac-5d7a86c5c34b", "value": "6349935017fab6295626f276167fc0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536892, "uuid": "1d63c4ce-aff9-48b9-8bf4-0c2100c3d969", "value": "393216:UgO1vAM4wCChmN4og3J0CzGFbyjCujm6KI46B5RVs+p+kQ2SR7rGvHvTUlAX6/NK:fO1/4wC/K+GOShrsxwbEiMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776536892, "uuid": "e341d16b-d35e-40e9-a8ba-b5584db8a648", "value": 64706698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776536892, "uuid": "e45e8c04-3224-470e-ba99-09d21f0c2757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776536892, "uuid": "c34467fb-eb78-4cf7-9be1-e23526a82d16", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8346d7b3-3ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776488855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488855, "uuid": "64266ce9-f44e-48f9-97c8-0a704a60ce15", "comment": "Malware payload (Mirai)", "value": "83c11030f4309aad0bb98d7d2ea12e2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488855, "uuid": "3ee43efc-ee3c-4526-a7b3-e7cd40803abd", "comment": "Malware payload (Mirai)", "value": "fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488855, "uuid": "cb28c56c-6f4f-4b92-a27f-42e776cbedbc", "comment": "Malware payload (Mirai)", "value": "cb6cac324518e28df9bee512333a2329c8df2ef0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776488855, "uuid": "fa44cb9a-d982-4251-be53-a858c6f22350", "comment": "Malware payload (Mirai)", "value": "ee495dfee8799b3c3bf03b2d361d434dd43875a89792d42435123e13aff96b0f044817490c3a51d005a0f5c81373699a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488855, "uuid": "6ad31788-07e7-4a50-bb3d-724728c96f45", "value": "T18E91C387A561CC771DF19F0233936B70A4C0CE932CA7DFA8D9DD08AE69A4514328F997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488855, "uuid": "ae5e760d-5d85-4dc2-9e5e-a32557269585", "value": "48:RWZC+N9iGyv92z9JY96p9Lq9/2919Wx99A9U9V9T7O9YQbMdMg9e9TTAskU9fNdF:Rf7mMTWVTAski/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776488855, "uuid": "9b04066b-f67e-4f6a-87ae-def63a79cc31", "value": 4207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776488855, "uuid": "a01b6c3d-d6d3-4000-aef6-72f163298116", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776488855, "uuid": "c0392067-5a5f-45ea-be2b-32a4f360f369", "value": "diicot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cdf66b-3afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776498764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498764, "uuid": "d8bf6554-5cb2-4a0d-b5fb-b6ccb8ff1f7f", "comment": "Malware payload (Mirai)", "value": "94469023717b6d08036dabff9748f75b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498764, "uuid": "5b73d374-12d3-4744-bbd9-ef163843c975", "comment": "Malware payload (Mirai)", "value": "ffc179f338f7546f7bd043de0cae339c21967ff779f09d506b86e06362886905", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498764, "uuid": "ec704b3d-a773-4fee-a068-6cecae4dd984", "comment": "Malware payload (Mirai)", "value": "c922c26f28002342174be1985ca344f074c3ff26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776498764, "uuid": "31b45e1c-c189-4658-8362-542236db8397", "comment": "Malware payload (Mirai)", "value": "b4f6143426e3482413b7f7b1fbe50975af3a8db092d6a94e1a41b475cf5a707fea3f80aec0a1391da80f35caf973c624", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498764, "uuid": "a9b30414-f478-4332-87ce-3b59d89d6c2c", "value": "T18EB3D501EC506733DAD22FBBF35A82CE773196D86B873381952D2AF05B85BE81979150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498764, "uuid": "8a884450-28a2-4456-9e2e-1cc20dc04f41", "value": "3072:nCwnryYPxkhJjh8hOVlMQaQg5huSHC/lOCaYejQAiSgcK+3Cgs+TMrPSbyCENvq9:1rxD5/H23m7nmQAEXxz+vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776498764, "uuid": "1b92ab22-8a53-4e36-b8f1-ad0c7bed2a57", "value": 113332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776498764, "uuid": "82427ebb-ceed-4ca7-bf9e-cace55903638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776498764, "uuid": "27555891-0471-4a4c-a710-ee6c4a17ec5a", "value": "Demon.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }