{ "Event": { "published": true, "date": "2024-03-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-08", "timestamp": 1709942581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c2efc73c-2848-467a-8fd3-1212d7bb41c8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5575035c-dd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709903041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709903041, "uuid": "4f758344-712d-4bb5-8d4d-3f3a04f171c4", "comment": "Malware payload", "value": "1f6fdfe6fb0fcda923b6b07c555234d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709903041, "uuid": "08d452fc-8241-4e48-901d-21d020153eef", "comment": "Malware payload", "value": "013c86c9eb7691e645d32336f93e0374552ed3b1674bbf3f7217c765db3bfb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709903041, "uuid": "c017ef59-5eb1-459c-86f3-f2985704991c", "comment": "Malware payload", "value": "6f7af4cd953a3711da734b178b73c1772410cd6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709903041, "uuid": "b07eef50-95cc-4314-a2aa-2079978e084a", "comment": "Malware payload", "value": "102364f4530861a7aef73903dd2d3f3ca0bf058625d3231c1831970c5675124ab23e3cfd722497900c0c5599afab1847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709903041, "uuid": "fc2006b4-0ace-4388-92cd-8d40743b3e19", "value": "T1F055D01363DE8360C7B25273BA65B741AEBF7C2506B1F96B2FD4093DE820122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709903041, "uuid": "0dc4db3a-3b54-4138-8216-995d480bcf31", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709903041, "uuid": "b2f9230c-019f-45dd-8f70-f7ad149bb4ef", "value": "24576:Xtb20pkaCqT5TBWgNQ7adzRSvUBdEj1Lsr6A:UVg5tQ7adNZc1e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709903041, "uuid": "c021ba4c-0c6e-4f15-8073-bfaab0cd0455", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709903041, "uuid": "74a7740e-8e64-45f0-8465-d1911f0617aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709903041, "uuid": "0f664a89-2a62-4767-b908-477e97837e65", "value": "013c86c9eb7691e645d32336f93e0374552ed3b1674bbf3f7217c765db3bfb51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194e1910-dd2d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709889626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889626, "uuid": "bf0efbd1-ca3d-40f3-b6ad-771c1ea5060a", "comment": "Malware payload", "value": "13dcd6f1fd44f7f15651153167b646cc", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889626, "uuid": "920d38b8-5455-41b5-bb78-6d47e0d3799f", "comment": "Malware payload", "value": "01ea7197094b9acd50605bda611111eaa822230f81a3cac4b47a2f9d01e146c1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889626, "uuid": "aa5fb9e2-6129-413f-8bd7-8b17156952cc", "comment": "Malware payload", "value": "8953ea5dcd8d32a518bb0286cc6482ed54ba8307", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889626, "uuid": "8906c834-dd48-4d9a-9953-174b1fec8607", "comment": "Malware payload", "value": "eea91f772ad21c53bc00d8d2484bbdf13ada42df8935d039ddffcabc43049d0cdf78e77f017c71b40bd1d1277aaf3907", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889626, "uuid": "804ce652-0d8c-4cdf-b756-068bdf5f7f32", "value": "T1D2464B47FC9546A8C0EED63589629253BA717C485B3023D72FA0F7282F77BD06AB9314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889626, "uuid": "45b4bed0-a5a9-4021-8cce-7e6fa154febd", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889626, "uuid": "7da8f3db-74b6-4a1b-bd08-d140c24f4424", "value": "49152:0r8ZgqXcYZZRO3Mbgdw4grqFKjpAXds2r73aBWfj75EDGZv3iCStVTwiT3fV:9ZXcX3MMdRsSs2r28JEQdkNwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709889626, "uuid": "34345f78-8571-4d3a-8f91-abf5286499a0", "value": 5620840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709889626, "uuid": "92be492c-2cf5-499f-981f-21730a7f973f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889626, "uuid": "34c71e4f-15d5-4ad7-9e13-fa7f52a57bcb", "value": "Winver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcff1ac8-dd99-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936393, "uuid": "2440e82f-4068-4c20-a514-7843093e2df7", "comment": "Malware payload", "value": "bc37d330f0255bf0553f90ee225716ab", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936393, "uuid": "afaae117-f01a-4c51-9570-b4af2832edcf", "comment": "Malware payload", "value": "0200dc0752ec5f0e1cdf6d5893d2bb8a1a168181df24107ca702d37a7113c858", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936393, "uuid": "1d547f2e-23fc-4fab-8909-d40be68c003a", "comment": "Malware payload", "value": "fda00f2a3344e850a781459d46e0020e8c8608ef", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936393, "uuid": "7e34523f-db17-40bb-969a-57cf4c97049f", "comment": "Malware payload", "value": "aea0d386b5b7a3df64ed20078f12be5d7eaad27a0f87f097436938f51795df76d09c2e4bb78b4d8a555454d0b4e5dfb7", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936393, "uuid": "b151c309-a6b4-4a3a-b280-e791fde06064", "value": "T1E286073AA810BCD1077E7088A15C39DF5D5DAF5F57A85A34F80430E53AF82B0DB6D568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936393, "uuid": "4b224528-661c-43ce-8758-10c3ed9a4174", "value": "192:T79QuRISWGDVWGDw2BVP79NQeSmG/4KDzvFaRieje:T79QcIERJaf/ntKiSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936393, "uuid": "499f7ecc-9c2c-46ab-9fda-e374ac446c9a", "value": 8418078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936393, "uuid": "f9d80fef-21f9-4600-a583-51f3681e831e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936393, "uuid": "d0d98f2c-da38-48b1-81e6-0b8bd5acd9b5", "value": "ney.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb56ce1-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921334, "uuid": "8eb51f84-91e0-419e-b862-ce8f53919cd7", "comment": "Malware payload", "value": "4c23fb124ccc72388a8e4b02ac7fe80b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921334, "uuid": "60d97af9-564e-40fb-9546-1df228795eb2", "comment": "Malware payload", "value": "029bc227746ab3fa3d9c6f03453995c382759e15f3031335773cb201734ec2bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921334, "uuid": "8d7d617d-a6f9-4ea1-bf6c-c4d1efa92e10", "comment": "Malware payload", "value": "6de3beab9b5c8eaf5f94a54265d9879c634fbe37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921334, "uuid": "61e4245d-bd35-4ed2-bd7f-bd4b9a37f8ec", "comment": "Malware payload", "value": "d8858874ed7a74add74b5c18b47fd6628cfc7d22d342f1842da2baca0a6a994ff56ec7c65fdc75b0e5eacee304ac4ad4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921334, "uuid": "15bb5649-f357-40b4-b004-17bb3fafa114", "value": "T1193309DAF4028D3CF80BE37E54164E08BA71A3C55283172657BBFDA3AC731995963E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921334, "uuid": "76e32316-7caf-4113-a0a8-6b712c8310f8", "value": "768:qPdvkYev0cD2f2bEv/0bZ4mgcO5NrA6PmNR1HNpL86876eGGn:iodaf2weZ4mg15NfPmNRtNNH87ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921334, "uuid": "8b36f8d8-f4e8-4e13-9077-f98cbf658e49", "value": 50308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921334, "uuid": "8397221b-8bc6-4763-b63d-222ed4457947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921334, "uuid": "76d1aab0-1f41-4c22-a8f6-e212ba1cd070", "value": "4c23fb124ccc72388a8e4b02ac7fe80b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da31d4da-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917008, "uuid": "7b1e471a-503a-4891-a6a1-d0701687b89d", "comment": "Malware payload", "value": "db986c7fc1f3b412092bdd9eacb4705b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917008, "uuid": "28a8e877-4abf-4461-8180-1ab6de99bc37", "comment": "Malware payload", "value": "060b99c715e092e8c8c3d747547c5f2a6b76467ecb9acca26a2838e487391094", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917008, "uuid": "66bb4c5a-6f78-4f2a-991b-007df6303c5a", "comment": "Malware payload", "value": "f6dac4723215c9a76924eb735a64ad18d663e44a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917008, "uuid": "15ffa8af-b130-4226-a7e9-e9a92db09ac5", "comment": "Malware payload", "value": "6237eeb2f8584012cfef7c2b5345b1a27d4fe6f26c54229e61c3bd299dd8083379c19e0b37a24bc0e934c84cecc388cf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917008, "uuid": "7e75f3bc-ad6c-48dc-bcbd-290bcf0f3fff", "value": "T1CFA423393816B7552E3235FF820405A7892CF484A757B837FE2F2DE75517AE898403AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917008, "uuid": "dfcdf131-29ae-4b07-a591-36f78d3577d6", "value": "12288:EOWLAJLbvisAdyTLUgdNaNxyD1jCuGMiuxvfEU73Ms41tfvy8O:eAJLbarULUgdNPh8Miuxdi1tSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917008, "uuid": "c8705a01-d3cc-41f4-ab77-de1b58cf4a4d", "value": 489521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917008, "uuid": "9b89b639-13d4-46f9-a243-021917c045ad", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917008, "uuid": "d1aa7338-251c-4ff2-950b-c0bb464bd5c7", "value": "Morton Glass Works - PO.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc04e7ee-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874974, "uuid": "670adb93-24da-459b-8692-080daad55eeb", "comment": "Malware payload", "value": "402e23ba110926ef89f8aa54a43ad20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874974, "uuid": "4c1c3cb1-3932-4ed5-9aef-81f7317a4056", "comment": "Malware payload", "value": "071b76763835e66bca3bebf2f8ea797928d91302deff23421fc49eb4988a8e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874974, "uuid": "c6803689-eee3-4d35-8825-dfd385c50ae4", "comment": "Malware payload", "value": "dc62a7e189e6662c013906f902d7016e15671f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874974, "uuid": "f14e8740-c640-4107-bff4-f7ee85084f54", "comment": "Malware payload", "value": "ff902ad57aa3446fcfb7f734831ae33550a19de55a86e33262adaf95a3c9fd6e4bf6c162bd6c598f44aa1c4be3dd2bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874974, "uuid": "a561273e-24c5-4bc6-b7ee-43c920901735", "value": "T178E57CA2B80C75CFD48E2BB88D67CD46591D03B9072248D3A86D75BE7E67CC116B6C38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874974, "uuid": "5364b12e-7aa1-456b-a51d-1b5fc63828c7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874974, "uuid": "9ebcf1c5-0172-457a-a370-eed5dad7280f", "value": "49152:ZHuFG2Tc0l57/Sxi98WnFR81ogsLIxd9W0n9s:4G2Q0lJci9nFR81ogsLIxd9Wus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874974, "uuid": "c9a6c1a5-801d-48ab-aaef-388a503cf6a6", "value": 3194368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874974, "uuid": "33a6ebbf-c5e9-4241-91f1-95c36e3fa94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874974, "uuid": "2c14a9c9-ca3a-422d-aff9-303cbc966105", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11186.27690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9511d1-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935618, "uuid": "cf002c26-3fb8-43fa-b0fe-0631888d3958", "comment": "Malware payload (Mirai)", "value": "41cf3b9f6014a27df50c112f1fc72761", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935618, "uuid": "c3b4b923-5925-4f17-827a-edc73939b600", "comment": "Malware payload (Mirai)", "value": "08754e95304e2dd17faa071e67710c2ab3378dfd1e041af34841d26c05066476", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935618, "uuid": "95cc62c9-fd4a-42bf-972f-c02d928341d0", "comment": "Malware payload (Mirai)", "value": "a12dd20338ca62ee0a64f48d4890dbe28402aaa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935618, "uuid": "44de6f60-2a94-4c69-a289-adf774caee54", "comment": "Malware payload (Mirai)", "value": "4fc84630d603f745fcf4465856b9ac7e10e0329459531942448a07cfa0f68d72da9cc6fa12b8d20e0dcb4f3cbcdf8375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935618, "uuid": "21c51b5d-237a-48ea-87cb-6e1ba5420f1f", "value": "T1E2C2D0E07726FE31C420AC3DE52A4D8A3A51067CD0FF353654259D358FC269B67B84BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935618, "uuid": "30a55cac-f840-437e-a671-748d15aa60c3", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwra9q3UELu/:OKy4qfqoeJdXWgPL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935618, "uuid": "b0e934a4-e1fd-4062-8d53-b92952e88b05", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935618, "uuid": "9946467f-1363-4ba1-8d45-6f18145d5d61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935618, "uuid": "22dcd642-f832-4c23-97f2-5bcbd64eb039", "value": "41cf3b9f6014a27df50c112f1fc72761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db7ff37-dd80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709925496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709925496, "uuid": "d6b0dd3a-41ff-4bb7-8797-8e8dfd26aa78", "comment": "Malware payload", "value": "8a23347b733420472a1ec0a1eeada597", "object_relation": "md5", "Tag": [ { "name": "Donex", "colour": "#EB0165", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709925496, "uuid": "0a0e1a12-cd0b-4263-ad91-4315e5692089", "comment": "Malware payload", "value": "0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca", "object_relation": "sha256", "Tag": [ { "name": "Donex", "colour": "#EB0165", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709925496, "uuid": "d724b194-3201-40b0-8527-8bf6d5784737", "comment": "Malware payload", "value": "21eae7e488b145fa3618627da99c3234696c0f15", "object_relation": "sha1", "Tag": [ { "name": "Donex", "colour": "#EB0165", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709925496, "uuid": "3cfb7a2b-cf0d-4d9e-8440-7c32aa9c1160", "comment": "Malware payload", "value": "15a9b9231cf2f742c5afc4a337b55a274884bb42a8fb2170bb108d912d0435a03f6c7c0c85b874e1764ef0e54d97ad1a", "object_relation": "sha3-384", "Tag": [ { "name": "Donex", "colour": "#EB0165", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709925496, "uuid": "4d93e43f-59fc-4e9c-a78c-3cc59813c9c8", "value": "T1AD24AE21B580C831D9B30D7656FDD77ADA3DBA30172496DB53880669EE603E1B33CA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709925496, "uuid": "18334737-b86a-4c45-8c8c-8d7786689651", "value": "8c15953665973cafd1715edd2e4e4284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709925496, "uuid": "5fe2ed40-61fc-47b7-b42e-7f029186049d", "value": "3072:FnS2A9r4wpzL3syZUmMkZFfAQ2FUAElR8MRC3KevxEwYSidYj6zxe8pxU4iR:ZSFr4EzLvC1kP4Q7XlR8MRCXYZR5c/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709925496, "uuid": "d97cea43-b5fd-46a1-a054-c62f3771d903", "value": 229391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709925496, "uuid": "78cf7dc4-b34d-4aeb-a891-8a0c3e36f0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709925496, "uuid": "47f5e480-69e5-4ec4-93d0-e8d32f454311", "value": "8a23347b733420472a1ec0a1eeada597.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8a7d83-dd60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709911589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911589, "uuid": "4fec5801-ec33-4765-8639-b40c474c683a", "comment": "Malware payload", "value": "9ffe4f02cb568480e9475847474a647d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911589, "uuid": "a4b01947-d006-4476-b273-b1633056f92e", "comment": "Malware payload", "value": "0b253fe8a257daf152d4c6124a21cca1034003c6ae5f45542d9a7d89c3c9c4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911589, "uuid": "07688805-bba3-4d4c-9530-653708c5f0e6", "comment": "Malware payload", "value": "0a33b07b7af98f4e549a3b5d63b5efb196ffdefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911589, "uuid": "5fac5272-8d31-4482-9f38-969e084bb222", "comment": "Malware payload", "value": "762efee6959377d22e45047eeae83e1024836667813d186f92294c3fc07841091582d85fd9c98d19272084c8ef6e788f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911589, "uuid": "ea0396ab-d99f-4e4f-9fdf-58d4c7fc6b9c", "value": "T16C05019436BC6B65DA7D83F70531988027B7792B15A5E30EACC570CE0E31F91621BB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911589, "uuid": "c9bfb868-5f50-484e-b726-2affed047740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911589, "uuid": "96309a13-1aa5-41c7-a24b-92c38b8a4edd", "value": "24576:UNY13P0Y0uBpDLms0DFd8UWuQHl/vhwAL77:VBIuBBas0DYUFqjwAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709911589, "uuid": "03a33e78-5a75-470d-912e-6b53f625ee24", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709911589, "uuid": "99cd3597-cde1-4ba6-9750-764045cfc2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911589, "uuid": "fd08935a-5414-4b80-8a9f-647c3fa61253", "value": "rproformainvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a167df9-dd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709934724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934724, "uuid": "1cccdcb4-624e-41fa-8c69-5549a81fac9d", "comment": "Malware payload", "value": "7edaa021c3183428e0d727039949bc99", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934724, "uuid": "7a446f1b-f734-47e4-8106-539a0f826dc4", "comment": "Malware payload", "value": "0b3fbdb25a5719e757b2c6a92aa0eb665214a309f2c13cd360c6f5390a5697ab", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934724, "uuid": "e3b5bd65-40f7-4d47-bdbd-be1c7d2a0b6a", "comment": "Malware payload", "value": "36891f37dd99a7966eacb349dd2350023d951551", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934724, "uuid": "2c372b7e-a462-450f-a6b3-b1fb937acfaa", "comment": "Malware payload", "value": "f81f744929619a6bf36277d6c27e8716b645095c1f478ab6cb3e4f94fe4ef03054d47b301551238f3bea7967a4e1b2e5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934724, "uuid": "1c7c00c6-fba9-49fd-96c9-370dac699c65", "value": "T1DA812052640983208376D4FAD7289FB6DF0E204BB201180A71B6D1BD3F3564A97F9BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934724, "uuid": "9d040062-450d-490c-b1d3-c1531866de2a", "value": "48:zqylQEQFz3crlxX9Nr4exUo0u4UxyiUG4RHgyfxXvSxUs3xyCgxRujNyjk5g3v0L:fvC5p/RHFzy5c7N9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709934724, "uuid": "50184c0a-1990-4742-a074-9525727bccac", "value": 4048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709934724, "uuid": "b92f4ac8-f649-4b0c-91d1-dad56236ff38", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934724, "uuid": "28fa98c0-1622-4a50-9d99-36e86904c409", "value": "Windows_Update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3671ac-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874890, "uuid": "937b41d8-9131-4fb9-aa2f-35804463a68c", "comment": "Malware payload", "value": "d3586f3810f62090529a7f17b8a0aa04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874890, "uuid": "69f21d7e-a226-4aff-9ab8-74b9f0a6338a", "comment": "Malware payload", "value": "0d2b86622029010a09acdfe1d5ff1bdbfeed78a3b1ef027797378594ef4b5e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874890, "uuid": "bcc085ad-6b46-49c6-85b8-aff765d21010", "comment": "Malware payload", "value": "17afc4b923c27f3da5cc1a0fe72127c6fa8c3b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874890, "uuid": "2db71b01-de1e-4155-a59f-7fe4a4226379", "comment": "Malware payload", "value": "691620e43b7bf81171d4fa70cea809b31592604f5e43f8f3d5bbc54c6bddca254c08581242ab548fb1ce6c7c973e731c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874890, "uuid": "02600fed-328e-468a-8125-0bc82b101f49", "value": "T104E412E1B254C803DA750E755E26819A2B6CAD27AE47F207E7907F1F7C7E295D83A00C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874890, "uuid": "0b709788-59bb-4bb5-b482-601e5692e3fc", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874890, "uuid": "5cf7762c-ae05-4b4c-b712-d5d7d83a225f", "value": "12288:ZczXJe2GM15cDjQqTAwrmd6x0WuuHoGDQEC2Batr7yjDlCrTCHR/9yZpnuMUv//f:ZOXMNM3cDRTAwrmY91lo2BnjDArOHxUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874890, "uuid": "f77c941f-88b9-4d9f-b757-cea6b4fc0be5", "value": 703856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874890, "uuid": "b9adb2a4-1a05-4257-99b7-9716025c0021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874890, "uuid": "089e441b-8535-4662-a84a-06eeba823fd8", "value": "Group Deposit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8084cd-dd41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898360, "uuid": "5f9931f2-09a1-4d8f-8c6d-e1d2aabf1378", "comment": "Malware payload (Mirai)", "value": "7c17a60a983b2dabe069a4555d735c48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898360, "uuid": "9af4604b-6f05-40f3-8324-0e0608367bb6", "comment": "Malware payload (Mirai)", "value": "0eb2d49e61e1e29492f37f9da208951b6ca7446efe3b270c1133cfea4ab1a0b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898360, "uuid": "ac3acc7e-e90e-4d50-8924-403921fff0cb", "comment": "Malware payload (Mirai)", "value": "12c8e3c454a28822dfd2c89c142b99bc7a14a59d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898360, "uuid": "33563c58-f2fd-4cc0-82ea-207c49bdb113", "comment": "Malware payload (Mirai)", "value": "c906dbb6915a7db825464aab211c340d1d99d7071f39e3cdefdbe4e0a6e69a91f9261d483c956de0dd54239d072339d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898360, "uuid": "436f0028-fc3e-4476-8f73-b98de1a5186c", "value": "T12753A509BF650EB7ECABDC370AA91B4124CD652B25B87F35B934D428B50B24F19D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898360, "uuid": "f426905a-68b5-4b94-b436-0419bb90a902", "value": "768:a+CR7K3x7pBO6jdv1Wd7IKVej5oLewe4LePq/Jf3R1ZZvo2Xi1/c205c3wi2ZvB:a+C1K3xVdWh9Vg+5VL1/1DZZA22k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898360, "uuid": "a337a776-59cf-4b0c-b451-14d4ef3c05b0", "value": 64396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898360, "uuid": "5aa9cdf8-73b4-4290-b669-9709d3cb5600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898360, "uuid": "e65ce425-0a98-4b83-be77-96ce2c186468", "value": "7c17a60a983b2dabe069a4555d735c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0dffec-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921121, "uuid": "942ba159-1536-4ab3-ac61-bd72f6c11e02", "comment": "Malware payload (Mirai)", "value": "680ff62b8964236098110bc6f9176eb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921121, "uuid": "f88bd964-b373-4a95-9e35-0129e9a513e1", "comment": "Malware payload (Mirai)", "value": "118210a65cef2e9dd457878c5b763317425e15f2c3b94e80570f48c9f9d6a0b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921121, "uuid": "104710f7-ee94-474d-b115-183ba8902783", "comment": "Malware payload (Mirai)", "value": "ebb92b32e388e670afc0a39173c51b8f65d6d759", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921121, "uuid": "f89a23e7-9c4a-4712-9c48-0e1dc20266e2", "comment": "Malware payload (Mirai)", "value": "be82849aa8b148ba45f2acaf4cf8b9ac6f613111953d16b82e3b6e7d70a24a8db34320fa196a06c591b91fe258af76ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921121, "uuid": "b171e265-3bc8-4f36-865e-71c842dadeac", "value": "T1BCC31A05FC404B27C7E227BAF79E438D773666586BD733115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921121, "uuid": "762d2356-6b30-42b7-b028-f821ee367a41", "value": "3072:SJDZ+6lJQTnoo3TKir0unkXoT5hLBwu+KmdAb3qojwQQRh6RYAvZR:F0uaoT5hLBwuMojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921121, "uuid": "1f621117-3e41-40a5-ac3c-6dec12d44d72", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921121, "uuid": "6235e0b8-835a-413a-a5bc-8e87ad533211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921121, "uuid": "41f777cf-5a2b-4927-b578-ed8518ed3ce0", "value": "assailant.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aad576-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921107, "uuid": "d2a26762-d673-4b1c-afe1-38c31ef07448", "comment": "Malware payload (Mirai)", "value": "f14227df353410901f67ab5dac3f93f6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921107, "uuid": "d1d8ae79-5144-49a5-b3b4-682b3bc46ffb", "comment": "Malware payload (Mirai)", "value": "14e0cbc4151098824f91f9a0e5fe1f71f65fd2917f411d3a93af3792415bc8b8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921107, "uuid": "b4b8b810-bf62-4cff-8834-92a69ac98584", "comment": "Malware payload (Mirai)", "value": "3bf9af420591544bcc5a0fe13b3d84f27c789dcf", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921107, "uuid": "6b3b41b8-6436-4105-80d0-39cd6a87a2c6", "comment": "Malware payload (Mirai)", "value": "d5d0c2f15cb28cb6786f3e7aa27a3cc8d8779c00b3222e56b3bdddecaf76cbad5833cd0387a26cd6f1591ed5a1e78bf1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921107, "uuid": "92051dbc-689b-44cb-9c38-eb53d2b10cb8", "value": "T1FDA35C82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921107, "uuid": "35e94e4a-1b6f-41ca-b493-426fe39c069e", "value": "3072:WzmqjPQP39VjGWX98732V7kGyNV+5hDTA7FXnf0OzTyoQQub:WpQP39VjGWXW9NV+5h/yFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921107, "uuid": "67ba6a31-fd1b-4e91-859c-8f4bb3d43720", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921107, "uuid": "63bf4844-61f1-4d2c-b102-937ce8a1a981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921107, "uuid": "e64dc38a-a5c7-4acf-b0c5-79f0a842de24", "value": "assailant.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b17652-dd27-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709887182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887182, "uuid": "73c7fac3-7c71-40a1-a8ae-dcd27fc496fa", "comment": "Malware payload (Stealc)", "value": "8708fb302d86f255e1bdd52db82d7470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887182, "uuid": "1229f0f5-bec5-4c9b-8ea0-12406e7a66d2", "comment": "Malware payload (Stealc)", "value": "159dc9de2d297a560eda6f1a1b861d4fe52a285aa475137fc32688ccde8de7e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887182, "uuid": "fa17dab3-2bcc-48a2-aa6f-194c138d971f", "comment": "Malware payload (Stealc)", "value": "b393fb6bd99b85dfd8153f7dbc522a752d079e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887182, "uuid": "739333f5-4245-4194-aa50-de88898c5143", "comment": "Malware payload (Stealc)", "value": "d8cfc84a4c0904ed4d363975d1f47d472f13b56948b8440a5bd28b328405b83f31683d04f69a7084ce1f4a4e6a095856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887182, "uuid": "2ae850e5-897e-4577-9729-97938ed8d736", "value": "T15B952206E96B38B5C8EB1C758716D33A49B54E80026DCB21EBDA3C73FDB9695C9C0711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887182, "uuid": "e7fa3531-649f-4579-8ba2-d48abe46bc4a", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887182, "uuid": "f4ec362a-b64a-4960-85cf-5dcfdcd8084b", "value": "49152:tIiiK2SeUsVNLFns91sPv+cMFw4HCmCv45tZoTIUT5VcLd:qiiK2pUaNhzOcMFw8Cmu457oTI06Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709887182, "uuid": "0cba2b2c-2174-40c8-95e7-f060b2cfa201", "value": 1907678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709887182, "uuid": "10591e98-8d6a-4d19-a330-fcbdbfee6ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887182, "uuid": "69dcb077-24a9-49bd-b5b4-1e09f7e8a748", "value": "8708fb302d86f255e1bdd52db82d7470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2aaa27-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932634, "uuid": "871d658f-6e38-400e-bee2-f6e33cb7c604", "comment": "Malware payload (Mirai)", "value": "3ce3fed4c4d5e2b629c6620461835c86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932634, "uuid": "c0eefbe8-316b-4e93-b7e4-2beca7b8687e", "comment": "Malware payload (Mirai)", "value": "15a92e1ba001e89115abef3f54e3ec66b36904aef79e6e7b13ecb11d79c49703", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932634, "uuid": "426d418a-860d-48a1-8339-99f51f4cd3c8", "comment": "Malware payload (Mirai)", "value": "741dd8cf86c8530d026393b8682551e4fedf77e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932634, "uuid": "e38c0ef5-3a96-4704-ae78-c8231b7d98f0", "comment": "Malware payload (Mirai)", "value": "fbe1efaf60e6be9f849d1f3efe8c7b145c6f7f652335919e58c505c05864dbee5d4e40c4952f1341417b55854b9a2e7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932634, "uuid": "d7a1aba6-526b-4e07-9985-4234f030ee6b", "value": "T120F32A05FB508B37C1D2277AFA5B838933228BA4A7973342D92C6BF42FC27995D32554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932634, "uuid": "30e70436-dc74-4ce9-8817-7bf1e840d470", "value": "3072:RE0gbgFLuc9G0/YeNXahSLsydvIBPBvyO8UINLTufmWEYwMk+iZxOh0BdhQzvWct:XA8T6mLYfk+QohEdEvWs7i82DqtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932634, "uuid": "453a2d51-955d-462a-aa19-fe463c3350ff", "value": 162840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932634, "uuid": "7da348be-cca8-4c81-8493-2ce3ff4719f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932634, "uuid": "2d368618-6675-454e-92d9-52441bf83f9e", "value": "3ce3fed4c4d5e2b629c6620461835c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2222a160-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935597, "uuid": "f01bba3f-0ec7-43b8-b39d-2b39cb57bd02", "comment": "Malware payload (Mirai)", "value": "d803af620ecf81903a7dc1b2dd9da0b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935597, "uuid": "bc142c27-f912-4776-8ec4-e1669de15a98", "comment": "Malware payload (Mirai)", "value": "1719318a4bfc813aea13c088ec5e42dec788fbdc8568e18d02839dfd9035b0f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935597, "uuid": "67e7c988-0e2e-4c25-b7e5-263ff15390a0", "comment": "Malware payload (Mirai)", "value": "13787adf7327263ec1ac38834ed3c73003eeae73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935597, "uuid": "615b6013-11bd-41d9-b9ad-ac927fef91fb", "comment": "Malware payload (Mirai)", "value": "a70f380509e3b378cc4f28dab72ec747f291d02498dd221cfa238b05adc4dd05aa31585326dedfdd2a3633414497f922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935597, "uuid": "7d76d15f-07fd-442f-82b2-13277a1f8642", "value": "T1AFB2C0CC61543084CA8D7C7C578D4A664F6CA1C0BAED9B25E364CD98B3BEA4F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935597, "uuid": "5f969528-ff39-4551-8b69-95d672eded91", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp8cZqSWvb:4QlS07FUXqIYSXQKquDqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935597, "uuid": "db6754a1-8da7-4053-a72e-aebbe1b09c2d", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935597, "uuid": "b4fe32a0-e95f-40a6-9b31-2c02dc7a5203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935597, "uuid": "5c72c496-b655-444b-94d7-ab1c8cae118c", "value": "d803af620ecf81903a7dc1b2dd9da0b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3538748e-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898692, "uuid": "53e3b82b-3410-4d36-b465-95b243e932f2", "comment": "Malware payload (Mirai)", "value": "2d66bdb115890e48344cac40c7ee7d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898692, "uuid": "0d1905a5-55e1-4d7b-a233-046a4f03b499", "comment": "Malware payload (Mirai)", "value": "19772730e0f7a3c1ef9d452700eb19e3997666b43ba36586e85fa31bf040a457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898692, "uuid": "7754b767-1989-4803-8ca1-ed251589b769", "comment": "Malware payload (Mirai)", "value": "662b33a3925ee97dea97157a018f9a43ba0441f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898692, "uuid": "bedbb8dc-9931-4554-abfa-ea77f0163690", "comment": "Malware payload (Mirai)", "value": "1bb9550cf64b3a67df124dbfa8e8b2615864d56046a6607ae6bd2cfdfdd3bbd7af27f064a145d9a1a71535f1f1a53e94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898692, "uuid": "97b7d76e-78bd-45c6-9219-0ba09dd06cc7", "value": "T194233A42334C0E07C5676975263F17D083FFEA6121F4FA88660F5B9A8635E7B018AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898692, "uuid": "31c3c5e0-66a5-4dfc-a32b-708f2e359adf", "value": "768:mLR25LpRZ6wRh1EBfmNpORYBCVCA7rrCpEhgCREBwYvHuOi2ZvB9+:AiVQO8rusgCRER2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898692, "uuid": "8d0cda5c-eda7-4ef1-a083-d4aed644a647", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898692, "uuid": "773dc8f6-f50f-48e1-9eec-30b662eb84c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898692, "uuid": "7a2b3ad8-a7a7-4039-9fdb-a3d1b29c756d", "value": "2d66bdb115890e48344cac40c7ee7d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04ae52b-dd61-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709912186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912186, "uuid": "2c942e07-e066-4bec-9d2d-cbdd36030dcd", "comment": "Malware payload (RiseProStealer)", "value": "4710fed652fa469f0f01ca6d1d7afdc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912186, "uuid": "47533f32-46e5-4fed-82a9-50d0fa38ef99", "comment": "Malware payload (RiseProStealer)", "value": "1d00ccba3fc6c631b520e31cb8e0d5137fced06bbd8f605f4ef2b7911ccd722f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912186, "uuid": "8573bbfe-aa10-4148-9116-599382648311", "comment": "Malware payload (RiseProStealer)", "value": "033bcc499b45e8cfc0a02cfa938a8c3415cb78fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912186, "uuid": "efe35446-9c2e-4313-9e37-b4a3c974b0c1", "comment": "Malware payload (RiseProStealer)", "value": "3655fc0c6c14a2c63fb2309b63111c157160cf91c6ad5cc0b69819b43d086a71003e4776467b75eea2c2028dd50cc819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912186, "uuid": "fc477cef-2b7d-4bb8-8cf0-6d890415787d", "value": "T1D1663376A9C2149EEC0B513B0A47F6BD75FB3DA012618D01BD885BCDECF2B2CA1B5542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912186, "uuid": "8f9c5288-782c-4583-a683-1d63e78509d6", "value": "5fca035c1d9772fed59e3f04779695b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912186, "uuid": "5d936b21-dcc8-4a38-932f-d7f2e480c63e", "value": "196608:68nX9x4mQNuyAwWzyan3nDmCZfv9qGZgIf6I8FW:3X9ammuyGy8nDTZf5fJUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709912186, "uuid": "8484f8c5-87fd-40b1-bb94-2a7a49930fcb", "value": 6707712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709912186, "uuid": "766514b7-4171-4942-9125-6181805769b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912186, "uuid": "b0b77832-baf5-4dd6-885d-04cfaf247a4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41d69b2-dd49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709901965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901965, "uuid": "cda6ec6d-681a-45c2-a246-a93d7fe23a26", "comment": "Malware payload", "value": "af776eb808ed10f9d187e2d0fcc29a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901965, "uuid": "caa2181e-1273-49d7-be28-42281fa7b22e", "comment": "Malware payload", "value": "214f606ef2069ea16ac2403536dc46fd390fff392e64a6092c1bdda4f79008d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901965, "uuid": "3f471fe3-83c7-429a-99ee-9ea41fafdaa4", "comment": "Malware payload", "value": "95a84d3611c11f24fee08b7926a10b206dc01a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901965, "uuid": "da69fa9b-f26b-4e14-8eb0-519f2f642659", "comment": "Malware payload", "value": "2d7f2df49ea5742c0fe01d38fe7124204715a7a3005f6806ae5cb7faff569acff0c729b509abdd08d27e335c5fd368b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901965, "uuid": "90e91dee-b6f8-4d84-9b99-4660a81c7d0a", "value": "T1D0E4AE65F69600F7E981303055BAD7769839B2792334BFC3B7E42D792A212D2AD3930D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901965, "uuid": "faf248c5-b5e0-4a02-a1b1-21c9eeb2e867", "value": "d45ad06d41e77dfabdd72c5e57235656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901965, "uuid": "98d75b9a-c0f2-4cc3-8361-80e0f57f6e73", "value": "12288:vm8gMRP2RawkN9kO4QiSxa6eolkkENGgbUCUGBd+lRPnrdjbKSXJU2hAVAtJCXTy:vmRMROk774RSaKP2AGXT6i385ddTjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709901965, "uuid": "fea8f915-9021-4e9d-ad09-5d9357e8dab4", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709901965, "uuid": "9df48b02-0178-4f9a-990e-0aeb5b06302b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901965, "uuid": "852e59a9-e759-4204-b1f1-67d4834dce80", "value": "SecuriteInfo.com.W32.PossibleThreat.31778.30882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380c9613-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932627, "uuid": "c8e34bd3-f0ad-4741-ac15-21d769a477d7", "comment": "Malware payload (Mirai)", "value": "ebad33db045307a24b34dc0807e480e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932627, "uuid": "2f69e791-5ca2-466b-9453-6f795c10788c", "comment": "Malware payload (Mirai)", "value": "2251d27615b6a1ae4887bf6d37f4bb8f0668f8ae5834077621c59b8cbe345643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932627, "uuid": "2f3a2ec6-e70b-4a19-b668-8d0e7094f9e6", "comment": "Malware payload (Mirai)", "value": "43aa938ba258c864e2eeaf4c1fcb38b22fe5a4b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932627, "uuid": "c88942db-98d1-4319-ae39-ffe20c626b48", "comment": "Malware payload (Mirai)", "value": "841432ff61712b4dbc89d9ea44fbdfb49edb601370210284e6edd8f2c37bbcec3d121248d84c7e5400645c89d0dd1131", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932627, "uuid": "7860d7cf-9970-4931-8052-0f49405604ae", "value": "T10F833A836650C9F7C5531AF502A76B984B36F83B0E7BEF81F31C6CB04E61588792A794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932627, "uuid": "4d9d540c-30a6-401f-937a-873665c61688", "value": "1536:6GGQd7WHnmeDtkVV0Ly50383jh5F3kdhQzb1Hro9VgbvCPVFL3ApQITA:6GGQd7IiVVD5k8TFkdhQzb1HbbKPVFLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932627, "uuid": "32d23b6c-0ac2-4e36-8813-c57598bb4ab5", "value": 82797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932627, "uuid": "cce85ba0-0909-425f-8387-dbba8d246b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932627, "uuid": "5709db19-947f-46f6-9806-4dcb6bd2b2f1", "value": "ebad33db045307a24b34dc0807e480e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db015538-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917009, "uuid": "dea1809a-3dfe-462a-bbc2-68adf9b603a2", "comment": "Malware payload", "value": "f8312884ba89338fde06ed4dd4dd3a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917009, "uuid": "ee51684a-e3c2-43c0-a5db-784a707d7850", "comment": "Malware payload", "value": "237321b082ebfe70911d016d8b4dc77be6564551f329db862b55c83f86265c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917009, "uuid": "ee747ad5-b7b7-4c2e-b653-fbeead04355a", "comment": "Malware payload", "value": "eb8107cc39ff9ea322afd93db3635e9f5ae34268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917009, "uuid": "6f01c528-660f-45da-97c7-086a0d288b62", "comment": "Malware payload", "value": "dd627dacc76a6eb78db4ce14350d617f2004cda348a6e8b70da52b910b9344345fb77555154806f1360a8d8645fc4c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917009, "uuid": "ef33a8a6-c4ca-4fbf-a3d8-581aa0752ec3", "value": "T1E4E4E127FA04DAF9DD39527A14794AA5833AFD7BA174D713B3D0B2601AB2F61043E123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917009, "uuid": "a92c5879-05e8-4fa7-be71-58ca77677dd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917009, "uuid": "c42b313e-c3da-4913-b2a6-c0ca2c82c04c", "value": "12288:OJLbois3QZTLdgdNaGO1Dk/9/B7nnjNJvP1elf7w+ah8DdumO6RCdO24RU36d:OJLb1+uLdgdNyIF/BjnH2fU36d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917009, "uuid": "fbe6f9c5-fbc8-453e-a1b3-40c023ba4363", "value": 679824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917009, "uuid": "a1f94626-711d-45bd-92e6-18781954d420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917009, "uuid": "258edc5e-46db-4209-a288-ae579ea2b3bc", "value": "Morton Glass Works - PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64026205-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921104, "uuid": "7c49de9e-d70d-4d46-9358-ed37e485ebb1", "comment": "Malware payload (Mirai)", "value": "cd9d42f9f85a803dc3d7d1371089b6e4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921104, "uuid": "06141403-b549-4631-9b56-aba920b1493e", "comment": "Malware payload (Mirai)", "value": "245aa12bbd3bdd446429d54b41af8dff10001d79cfde81632827daf7afa6e2a8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921104, "uuid": "986580cd-f788-45cb-a3da-228c4bff8511", "comment": "Malware payload (Mirai)", "value": "61a5da52419641b07794f44adf23082cafa7c4fa", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921104, "uuid": "14954bb4-fc32-490a-a071-5b571cd06ee2", "comment": "Malware payload (Mirai)", "value": "6c32ea9dc5ed7dccbff143266a4f648f0a830dd2a9f2bfb90730e4ca4d0fd9e01e226250b443fee4157561e7dcda4a42", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921104, "uuid": "d54fe710-150b-4220-b6e4-f096501e1c30", "value": "T186D33B05D8909767C6D227BAF79A428D73236B68A7D733115A28AFF02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921104, "uuid": "aeb7c69e-0ec7-4911-9be4-cc02f0c8cc63", "value": "3072:QVfyQ+d+pceQGfvbHyaJfvhhWOiwztei3y45hL9Q3Z4WBZxfkmydQCYMhEFg:MbHyaJHhhoU3t5hL9Q3DH8mydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921104, "uuid": "409bd47f-6b61-4dc4-bbea-dbd9ff273f1b", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921104, "uuid": "52363bcd-bf53-4351-9179-d0359d57cc3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921104, "uuid": "8d0b372a-1e9b-4422-95b8-7910aa9918de", "value": "assailant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fbc4e9-dd03-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709871665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871665, "uuid": "5a0965b9-6d6d-4742-a081-99da60a97017", "comment": "Malware payload", "value": "b820ca941ae4e895d4e172de1605a1fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871665, "uuid": "b292d7af-7f8d-4c57-97f9-bedd5e13c26a", "comment": "Malware payload", "value": "24c802a366b3780a4d9745a900b69a4bc8d2c8702a03a8c11bf17997c0db7eaf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871665, "uuid": "eb562515-5188-49c0-92b9-3488b590d508", "comment": "Malware payload", "value": "9cc11f8fb0155dcdfe3598d3167825983d4ccdda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871665, "uuid": "491160a8-b8d5-43b1-85a4-f689aa485c42", "comment": "Malware payload", "value": "fbeddcda00d0431bc6bf3f5fc003cc2aad19c957718364b0ef85d9d93d394e9ca41a7c7a6e0397259d20d22b6b9137f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871665, "uuid": "ecd10636-3639-4913-839f-c50f8ddade5b", "value": "T111D48E127681C1B9E9AF02724D28B73D42FEB9A14B744AD3A7CC5E1E5E348C16B36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871665, "uuid": "4577e9f0-76db-473b-b1d5-c8511a493125", "value": "c452ef013ad35a9bd010623596b32cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871665, "uuid": "954141b3-acf5-46c7-8d0e-f2d0211632bf", "value": "12288:imkSnRikoRDegfDybtFDpJHqNMHBz2W5z02XNv3DfyZqp7oZTOQJ:iHm+ybfD7HqmBztz/R3uZfZqQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709871665, "uuid": "2537d91f-0d29-4470-9f44-618480308a00", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709871665, "uuid": "d8713106-7e00-4d7c-b9d9-2f0fffdad85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871665, "uuid": "072a062f-fa01-4e22-8e76-c8f9ff6261a5", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.21597.30061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbf3d93-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908179, "uuid": "c063a174-f2df-4c52-a6d4-8cb7ed91b642", "comment": "Malware payload", "value": "c80cdf656d4f769707bfedca3bfeee94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908179, "uuid": "20a7b553-8e92-42c0-99c2-a07c92fdbf60", "comment": "Malware payload", "value": "25dca32f9d06d876e9acc7f71f6aa871daa8d8f4b178d680561fd2194365ee35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908179, "uuid": "39186ac0-7ac7-4823-b48e-afd6c3f2f8e0", "comment": "Malware payload", "value": "635038eb299fbd516e2869100c2cf13175f5ce9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908179, "uuid": "40878770-abf3-48cd-ad89-a242c0834115", "comment": "Malware payload", "value": "8880d9ac0c9cc647d4b99d56ef7f01e70b7f271e34a5b714e7bb46627b9cd57264d04009ad9e83064eb70b796894aba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908179, "uuid": "2a60b7da-a560-447f-97e9-b739094d30b8", "value": "T15A95270B6B280AA6F0E6D47DD607DE03D1357A5EB32369F709A28A513F272D5493B730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908179, "uuid": "db9664f3-4790-4963-8124-de4580c68bb7", "value": "d9efc19c0bc40d4a3b598d3c381e5a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908179, "uuid": "11fcab1d-ddc7-473b-88b6-04a99c410876", "value": "49152:1Tinf0zlJF8JzGCW1jsO5AUKjnFkTdxBc:TpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908179, "uuid": "402a862a-62de-4996-8ca6-77106331b4fe", "value": 2020864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908179, "uuid": "8d6dca67-6d5a-43ec-8b2e-3d8ec2e111da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908179, "uuid": "153b7f4d-eb65-4049-b7a1-b28d221e146e", "value": "SecuriteInfo.com.Win64.PWSX-gen.6998.29724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df3d384-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935590, "uuid": "8c04b467-3837-4d12-aaa6-eec4ec7e3ead", "comment": "Malware payload (Mirai)", "value": "936351492aaba7cb184d8b6835c89afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935590, "uuid": "09389333-8fe2-4889-9ede-b204163a6728", "comment": "Malware payload (Mirai)", "value": "2690624c88752370a619cd8cb21b5b350be44c790aa0e84d4a665c1a3ccabd8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935590, "uuid": "c6179bde-1afe-4094-9167-a5bbe3f9cc2e", "comment": "Malware payload (Mirai)", "value": "e5d294e04a034a7a4b12b171b11634d2dce1539c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935590, "uuid": "eeadc85b-8acd-4cea-a602-0eac45f9afce", "comment": "Malware payload (Mirai)", "value": "70e33f1efa9793b90a61d786fa2db330cbf72721bd43ff490a4fd1e3ab821088a1c2682a06826589bdd8066cf2bccb68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935590, "uuid": "bf6da28e-34ef-436a-82a0-c11785eff2a7", "value": "T177A2E019BF18818BC832697951E9EAD21393FC62F29CCD4D2540D15BF0A33E96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935590, "uuid": "c3784b92-7fe0-4a55-aafa-f5d5577254e7", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTf:O98o08kxofBE+ZkXaITbp2F2TWul0c5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935590, "uuid": "4566a93e-d8c8-4857-b27b-e2faf5ead3aa", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935590, "uuid": "09b4c3ee-076c-4f83-8559-0ef4473290eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935590, "uuid": "3090d921-170b-445d-9116-99ae2853b7aa", "value": "936351492aaba7cb184d8b6835c89afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc373fd-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921312, "uuid": "ac5170e8-470d-4abe-913a-3f4a1886bf37", "comment": "Malware payload", "value": "e5577062395dba582bb07895eefe0b0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921312, "uuid": "06d84963-b781-4768-ba23-7deba83335a5", "comment": "Malware payload", "value": "2bd430809f9794e2ced9c5921848ec3a74fc55e60ca4c437c7289f88cd37f2be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921312, "uuid": "7f5c5c14-5219-40f2-a6d3-170910f765c0", "comment": "Malware payload", "value": "29ffaed3faac04e743f8146a443e970a18be8adb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921312, "uuid": "2c568ff4-7370-490f-aa73-03bb39d6df29", "comment": "Malware payload", "value": "486797abfe98118b7e8f28a1aea51033bb17eaf58b70e6b7406967389e58d10ec905220b331c80df9ec81ae59bc017ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921312, "uuid": "f9ecfaba-161a-4df6-b6d1-ac465f5ce446", "value": "T1F3333A35BA761E1BC0C1687660FB4B24B6F146CE26A8C55E3DB20E9EFF619406503EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921312, "uuid": "22512b23-2158-4ea8-ab18-30efe9d5a38f", "value": "768:Udov/PGH269ITQVSACSq+51LLpqhzxXTQPZxO+lsr8twvT:UdQ3O94ZSqc1xqhzpTQblsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921312, "uuid": "b8b7f2dd-dc54-4bc4-ae78-8398c3bf949e", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921312, "uuid": "5b52406c-a975-4f7d-b66e-4ceec1597553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921312, "uuid": "23294830-c07d-4bfe-9e9a-a5c9e3d7a29e", "value": "e5577062395dba582bb07895eefe0b0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675f9785-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921110, "uuid": "155e9a5b-2784-4729-88a7-85ac9af97ee7", "comment": "Malware payload (Mirai)", "value": "fbcb7c824c0bee226f860d25f70c7f5e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921110, "uuid": "3095e52d-8f92-4d7b-aff3-cd4cc57c42db", "comment": "Malware payload (Mirai)", "value": "2c7573bb1d1892e41d89069afa4e52b08cb4977f75ed482a636c4093b2f6e9de", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921110, "uuid": "1c8defb7-a7b2-42b7-a839-921eb7833399", "comment": "Malware payload (Mirai)", "value": "77b9b883639abe1ca1491260fb107341be5b8a2f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921110, "uuid": "55bd5b7f-acc4-4be9-b94e-bea4de1609f4", "comment": "Malware payload (Mirai)", "value": "722bb97e96effc4451b7f2bf7c56cc235faff9cae2314cdb001c77b24a9613d846c4d885758821cbd45bbdc810cb52b5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921110, "uuid": "86a49774-2bc6-4df2-a623-5e454bec2c8b", "value": "T1FAE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921110, "uuid": "1629c8ba-6c38-49bc-b5e1-f05a2423372d", "value": "3072:2iIpIUm6Oq+lozP5hdSlzhsURxuZq+1uPNd5R:2iIpIxq++zP5hdS0URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921110, "uuid": "b155ef95-ccb3-4d29-b592-b51969791453", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921110, "uuid": "03f11fca-cdaf-44ff-941b-760e6437c6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921110, "uuid": "2846cd6e-35f3-4ee8-910f-724cef66b19d", "value": "assailant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fa81a3-dd4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709904334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904334, "uuid": "2a57a5b1-0f5a-4983-b5e3-50151a765a6a", "comment": "Malware payload (Stealc)", "value": "c8d1d74759c2d1161aa567948be20cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904334, "uuid": "bbed6f2d-1b02-4431-a836-82c47c4df02a", "comment": "Malware payload (Stealc)", "value": "2ee11e3c589bba20d2fe2213a58703de76048187d82a91c90121e0b663cd7416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904334, "uuid": "1ccf4d95-6e17-45d9-a7a2-27c97b9c9255", "comment": "Malware payload (Stealc)", "value": "c4e7dba572feedcb358b50929d2588943e1500c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904334, "uuid": "f8a1bef9-d6d4-4f5d-94e4-a0fe8bb1a800", "comment": "Malware payload (Stealc)", "value": "0aeaa5d3e48957ad366407ed7419c65c358b3ee7596c7b78e54a6fe5798a19fb0b8edc3d09b9068feac1a26b7f81639b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904334, "uuid": "0bf7a7e2-9010-41ca-b927-12e13ab1dce2", "value": "T1D684E011E290D7B1E2A75A708975DFB006BFBD50E832925B37B7232F1E70390997136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904334, "uuid": "fb92afa4-1e0d-4cf0-ad14-a69376326412", "value": "e4b2b7336d3e0f97560f9bdf06345817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904334, "uuid": "a719667a-4d16-46c7-b4d5-c5fd882f6f14", "value": "6144:P3CXPBAH76po2PXcgokTGPUNKroB7+o2b5Ba9LPg7komKR:PSXKH7i/wPlrC+om5cigc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709904334, "uuid": "34a55a80-ea8e-40b7-af32-a7543d3a6d9e", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709904334, "uuid": "68f15e9e-4a4b-4ddb-a666-8e503b7a6199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904334, "uuid": "3465584a-0ab6-4bc9-87e7-dd7dcd1f1b63", "value": "SecuriteInfo.com.W32.Kryptik.HCOV.tr.23983.16980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62449c9e-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921101, "uuid": "39c06e34-d345-41b5-a667-7da5e1895749", "comment": "Malware payload (Mirai)", "value": "f1852b42216bfe122a6cbf995ec5f600", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921101, "uuid": "12ae83da-18fc-46f8-b5cc-4bc21b02bbba", "comment": "Malware payload (Mirai)", "value": "2eec07cfa7693677249c2c2d7ff1e11659b668389379d39f3e47a71ea2470365", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921101, "uuid": "461d85e6-6693-4903-b786-09f04cb02f64", "comment": "Malware payload (Mirai)", "value": "4acad887916b48b936d4e8c8a7f95f42190f2503", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921101, "uuid": "7ca7dcab-d66c-41fb-bbc8-6536e6d99956", "comment": "Malware payload (Mirai)", "value": "77acf48ad0af1f210c145afaced20566c4db46f8a146c0483566a6a4cb9568cafad75c383117d76de9b13a2352e18aee", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921101, "uuid": "2a64f4e3-6b21-4400-93fe-0c0a81313e7a", "value": "T1FCB36C1B6692C5FAC08342B92BDFA1618823F67D0B36321773D4BDA43F158C96E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921101, "uuid": "aeca6c63-8899-4e8c-a25a-f8daf114eebb", "value": "3072:NF2ndCa9qRBFZm4z1EYfcbJuphaFsfDJv03CKPCNVOXinYuM8R:4MVm4z6Yg0phaFI9cFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921101, "uuid": "ab00b24e-97a2-4037-a66c-8d40b3276e2d", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921101, "uuid": "70b4bafd-919d-4dc1-aa01-5881e2af9d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921101, "uuid": "18a900bb-84d5-40cf-b0ff-aa32c7dd0784", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3707132d-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935632, "uuid": "0509a112-0ae0-496d-9ea1-ce5886a656a8", "comment": "Malware payload (Mirai)", "value": "30d20a5cee5352c97d050139813faec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935632, "uuid": "313f286a-3994-4f5c-8692-3602ff40fb4f", "comment": "Malware payload (Mirai)", "value": "31988f99c8e19b0832d77fccad7765f51b49120cc0412b8e8db907165c579bf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935632, "uuid": "cc29c429-8363-4d39-8fd7-2ce1de58bc9e", "comment": "Malware payload (Mirai)", "value": "a5f4452a888f6737d753b8c2be1cf8955c0cdf62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935632, "uuid": "91e4a9e4-b230-4ae5-963f-490d82002206", "comment": "Malware payload (Mirai)", "value": "5989bb872fa9f90f11066f64d8139931292a26377f74e5b5cfc88ad277ef690e6248a4de8fa1dcdb8c2f44a4c91f5d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935632, "uuid": "f7f7a32c-8785-41c6-927f-5aa28c93176e", "value": "T17982DF3061AB74E4CBF10431FAAECEC2971A0BF8D1FC369216586B7CC94650621F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935632, "uuid": "3a5125b3-f684-49e1-af10-adbe1ac89c15", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMarnhymdGUop5h5lJR:2dV0P6+kom0tVAoNvm+to1Ls3UoznlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935632, "uuid": "bdd07905-5a87-455f-b8b0-a615e50a67e7", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935632, "uuid": "2ee7bb98-912a-43b4-81fd-b48e79575c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935632, "uuid": "e32d3c94-1cc6-4a1c-9994-f548a4cf6b97", "value": "30d20a5cee5352c97d050139813faec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7cd1f2-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709917012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917012, "uuid": "531a5a0d-9641-48de-a8da-f04d35c975eb", "comment": "Malware payload (Formbook)", "value": "38c787824b7fc66a3147a1f92f34305b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917012, "uuid": "d1ae2aa0-5d6b-405d-ab37-0990c791bdcb", "comment": "Malware payload (Formbook)", "value": "31cc2c77fb2cc298df0e60458a1106af57a6df3470306523472bf020fc815cfb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917012, "uuid": "971a4211-e590-462e-bbe9-1454e3feb226", "comment": "Malware payload (Formbook)", "value": "a66ddc02119a53194f3e4e178e33b4f4a1d28128", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917012, "uuid": "c9ed7648-f06b-4036-8f81-c1151b39490c", "comment": "Malware payload (Formbook)", "value": "da2d8edb0f71f6bd74b3b22d4f0799789f49ad306774dbc83e0d20293c7ec9533b5c5991d48f61fde91a831ef71cd4d5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917012, "uuid": "5dcdad20-03b3-4849-bc0a-54030e9140b3", "value": "T16DC423C4346F4D930A3B8359040A3FA786C2D5566A0758A0D77BE62C6C6B617F8F8CB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917012, "uuid": "52313f12-395a-4334-98c3-b81ef64c4b36", "value": "12288:gNkDxGOJsiRWjLjEUGl8UtiO3QDVocu7GjjBv0SCdLkG9CYhaWd2:MdI3mL6lTAO3QDC/ijBv0SILdCYEC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917012, "uuid": "2c85871c-ccad-404b-9255-04ef12e2dc09", "value": 591381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917012, "uuid": "a58a136c-8dd5-43d0-abbc-075cf942f768", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917012, "uuid": "6ed4bf82-351b-4a5f-ba98-d9facba88e14", "value": "PO_98645768970908766589088534657689780.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409b04c6-dd38-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709894416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894416, "uuid": "9bacf87e-41f2-486b-ba57-6a6294c384a7", "comment": "Malware payload", "value": "7e6487e135591c11dfbf8ef831354c99", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894416, "uuid": "8d1dbca1-fd03-4c7e-893a-55afb7b1bd66", "comment": "Malware payload", "value": "337beb9377f7f3fc41c3f7066cdc89d8ce3284be6acce60ca6224b0f547d8a09", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894416, "uuid": "87814afe-0dbf-492b-a7b7-636d50481e42", "comment": "Malware payload", "value": "45df6da90516eb378f48507050fbe951d45701a9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894416, "uuid": "1d9a1896-3e06-4c8b-a9a2-961b83cd615a", "comment": "Malware payload", "value": "5746c8ea417f6d5e1d54a0d9af68837c08cd736e2cdf46ba0f1d5411b8906c8937be4d718f3e0ed8e07a9e151bb45beb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894416, "uuid": "722284e2-d643-4aa0-9295-6d8c1099a477", "value": "T1D2527D5CDB20E91DC1D2507CD24400F6D7086587A958AA1E3888B7FC6EC36D74BAF39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894416, "uuid": "5f11c525-41b2-4535-9b9e-3f3fd0c9dd9a", "value": "192:huQJl23T8rxiNtKtNZ7kmv3nBTbfcDftO6IdSelldXcKx+KGLEALrzR:jyN8TmgBnkOtdJl8KML/Lrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709894416, "uuid": "65c860ed-739b-49a3-a3ca-d9717cdf745f", "value": 13502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709894416, "uuid": "ec2cac56-4acf-4d0f-9cf2-917ed5b0a073", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894416, "uuid": "7b7724cd-fe77-445c-95cd-d0565e0cb0f7", "value": "aaaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d888ebfc-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917005, "uuid": "5bb8b896-52b0-4682-af97-29e0004c7927", "comment": "Malware payload", "value": "4c1031a5cd3cb8169c24f22f9fd9d7d2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917005, "uuid": "e7d1e319-db47-46ae-86bd-14c1eb4c5018", "comment": "Malware payload", "value": "347f2f48608eb60cd92a5b438348bd05508dce9320d107e4463b12f2de3813e6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917005, "uuid": "3f1478b3-9be8-41a4-940b-c899bd51652d", "comment": "Malware payload", "value": "11301ee6b0d7c5b9ef66b69bd38cd4837e9c7ce9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917005, "uuid": "97d03c58-ab87-459b-a543-e02b3e13bb83", "comment": "Malware payload", "value": "286efd960da82b87dec243b90ab5a9b1297a35ca036d7c9aa17eb762fd1b99211973a0c39c275769ccf63f530d34a349", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917005, "uuid": "697d4871-69b7-40e0-9020-71c64f24875c", "value": "T19DA533B585D980F9B63DA95B3BA486C0B24F9257E61419ECC5EA4827F6CEB0C2CD5C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917005, "uuid": "e1b1afa6-eb26-4941-914b-fa99048156d6", "value": "49152:VG84QtV69ZKIv/iW1RyNPT6BYnbg7oE5A7hw/0I:VZGKIpRNYnbi/h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917005, "uuid": "e2844809-cc38-4ab9-9fc8-91a6074eada3", "value": 2111207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917005, "uuid": "bf1871f1-0860-4e80-b811-321683a18e4b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917005, "uuid": "f5a3a352-97f3-48f5-ac23-22b0e595d7f1", "value": "IMG30136711080pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2bf685-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709923292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923292, "uuid": "f5dcbc65-67e7-420f-bb39-b2452fe69308", "comment": "Malware payload", "value": "504356291f6139c3400cdd7842bc1406", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923292, "uuid": "b6bfa2f0-e1a0-4c00-a7e4-05259004b7d9", "comment": "Malware payload", "value": "34a5017f3894d9d403fd2c5baa03d7bb6b9c28afb74e36010310af8f601602fb", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923292, "uuid": "61467988-1d33-43e2-a75a-60d7a1776fac", "comment": "Malware payload", "value": "eaae969b5db3779fbb9a1bba694468b003822c77", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923292, "uuid": "d4f72ac4-28b8-466b-9f09-8302b1f6654b", "comment": "Malware payload", "value": "5d42d8dda0f29b64c1ac1dec78bb37e42f2d437aa17feef532344d467fb73c7276c6d1f3952fca13a52d1e5f1c49f9f2", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923292, "uuid": "d537f9dc-f2fb-4d7f-ad0a-59ae62c8330f", "value": "T19D476D23B684763AC07F1A395427A654993FB76235969DAF57F00C4CCF365802A3FA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923292, "uuid": "6a2fbcc3-5d06-4435-9edc-d822d4301f10", "value": "4c1f56b4c50db99105e4a3eba0452881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923292, "uuid": "31fde0f0-830f-4bc5-b619-ba51ca118f14", "value": "24576:cMVKcnCjOGVNZXkLkswbSZ+UJ2L4yE9Ivvo5nlgzNNqFBsS4ETlX/sTTz7GMLIrN:7Y2UnaJGEF6S40sTbGM0oTAiEwdwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923292, "uuid": "1d9aa0bf-28c0-47b6-a531-92f4fa2b0cf8", "value": 26239902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923292, "uuid": "dd8a11ce-69de-40a7-adca-fd8aa986dee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923292, "uuid": "fbe4e5db-bb90-4930-a8c2-d6d592623a03", "value": "appdata -MpSvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d3f8df-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709935845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935845, "uuid": "095c55e6-0b73-4b31-a895-66074e18dbe5", "comment": "Malware payload", "value": "270c4cda327e6ed2dacf6354e4bdf591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935845, "uuid": "a69201aa-fac5-4acd-95ec-0ab15fe6d672", "comment": "Malware payload", "value": "35cedc7fb8e33a0e921116aec9a3259e4c89bdbf88337cb99892e2a05fdd626d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935845, "uuid": "38515aa4-88b7-40e8-8d63-7dfeafc48f68", "comment": "Malware payload", "value": "65ee0b8bdfec130ff9fba33bff453b4e3af7d842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935845, "uuid": "8af98c66-01de-42e0-b933-12a7cf72dee5", "comment": "Malware payload", "value": "5c0658beb1b16af1141a214efc722ea9cbcfc4359c8743bcf1df5ec57bc5f654e972e70fcad9567e8a286830ab7564f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935845, "uuid": "a84eaddf-e2cb-4b70-aeda-d994dbbb7d33", "value": "T156D502300B638C5CE8CDF27091C1CB5039A1929F7BF6E0F3C65B9E5916D64EA192B785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935845, "uuid": "6b717aa2-b403-497e-b44c-86988e159c61", "value": "b237ac2118704db9e7609540658f5790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935845, "uuid": "729f3bbb-ee7b-4e65-a995-2f35454bb4db", "value": "49152:RVA+SXA94GFzbKhoJQhYVyyiSki66Hps+oY1W5CcB+773DVGjnAr:XA+ubGFHKh+J0ymiRW+N1CW7zVGjnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935845, "uuid": "b103e3ed-c0a3-4b4c-b0e7-16a63bcb3328", "value": 2902016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935845, "uuid": "872ee7ee-e14f-4b43-8c08-ee3d24d6435f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935845, "uuid": "d4ed9d15-2de4-45e9-8735-3f3adcae9d41", "value": "gkvmpyoyjvch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760433a8-dd60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709911686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911686, "uuid": "c23fcc8a-1ebb-4e8b-a860-e89445ed0276", "comment": "Malware payload", "value": "18b97fe7f08162b5b724004ebda9f708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911686, "uuid": "ab1a36ae-feda-42fe-821c-a83bbbbcc7c5", "comment": "Malware payload", "value": "3782a2321982781a0306c3a31340c2f880258ad83e38e74bf92915accb4ce665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911686, "uuid": "3a30a2ce-af4c-444c-80a7-109e18d4e609", "comment": "Malware payload", "value": "2f63dfaec2517ea148c0bf0fb758a5faf46fd58f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911686, "uuid": "313caa70-2ca3-48aa-b2b2-ef5186a517f4", "comment": "Malware payload", "value": "6446d7fa44943c0d5234d298a9a6202907e2cd21b4715b94feb22541c72aae5f23eeee716862f5bb94b1997e5910b6e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911686, "uuid": "01cf9fc7-fbac-48f0-a88d-b151fd38fb0c", "value": "T156F4120737AC1B43EABED7F10A325A609B3FA5236556EA6E1E5500DD0E74F2443A1B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911686, "uuid": "bf3f2589-a9d7-419e-b18a-a84ba5833bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911686, "uuid": "838bcaaf-2d25-48cb-9751-ce6afc37711a", "value": "12288:9xOlycJecZUOEkbagg6cmNF17UC7xPSWSiq/kQ+DI+6w1s5h9zg0PkqhnbwhF6VB:9wkCYFgg6jNLUaxQ/kp6w1OA0RBbwn6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709911686, "uuid": "5605bb60-a3e3-494f-b682-66b76be25459", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709911686, "uuid": "01b20215-0629-4f4d-8602-7203f2d91880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911686, "uuid": "ebec6062-1e98-46db-a7f0-667bc6f142de", "value": "z78IAwHKt4YPAME736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd4dca3-dd14-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709879109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879109, "uuid": "94478d31-47bd-4734-955b-7a98e1f57c5c", "comment": "Malware payload (Formbook)", "value": "2cfe5875e422f8667374368d5ab954d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879109, "uuid": "fc8beaab-970b-4a97-941a-e9948a5e1948", "comment": "Malware payload (Formbook)", "value": "378ab1d8e8937363a7717b38ac57bda61515878afa6e59b1557da455a094bdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879109, "uuid": "f29f21c3-e1d0-47c1-ad43-d3e1eb52e18c", "comment": "Malware payload (Formbook)", "value": "1fefc3ddaaa997426f5fed1432e302f6641a38ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879109, "uuid": "56af973a-f039-43b6-b8aa-4f0ea44c0d55", "comment": "Malware payload (Formbook)", "value": "441997bb9108538b49a102b432996dbe5a50601001a18ab7cc22940ffb9f01fcc763ab7a7af1d064f42e3ba9a953e09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879109, "uuid": "bfc5ea6d-3e33-459d-9b66-a028b7f07054", "value": "T18005234231E857A2E27D8BF04976DB40C37F961B6691C51E1EA920DE07B9F584BC3723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879109, "uuid": "d7752750-3f91-4e7e-86dd-d89fcf82cb7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879109, "uuid": "f5ac959a-311f-4fb7-8d82-ce5ac42ef9ec", "value": "12288:u4Olj3cw4C8m7Qu1syUNHUWPw4LEzxY+4C4QV6Vyy1gjoB:u9d5d8WQu9C4NVd4CD6Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709879109, "uuid": "ab5ae27f-808e-420f-a8b8-d535a4071f3a", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709879109, "uuid": "9f4babea-4a1f-4cad-860d-e4b140f5c100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879109, "uuid": "d6f69ebb-3177-4668-bf38-6f81ddd0bfb7", "value": "BL7247596940.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ac842c-dd77-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709921404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921404, "uuid": "82a713bb-e436-4823-af59-60a85e928518", "comment": "Malware payload (Formbook)", "value": "f4294fb37c53c0c356aff31b2dbe85be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921404, "uuid": "06ba3c95-f99a-4b43-8970-75d785c5346d", "comment": "Malware payload (Formbook)", "value": "39a8de9c02381c6b24ecc842826b1fa66ac585075d5419df30220fec264cf95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921404, "uuid": "7d15ff4a-6483-49f3-8431-56e1aeca8442", "comment": "Malware payload (Formbook)", "value": "aaf609ad87d0a9e5e7209a047abebac7d33345e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921404, "uuid": "fe48509e-b175-4e0f-90e1-6e29a9752f99", "comment": "Malware payload (Formbook)", "value": "f21de977e13b16d0ab389ce0a4077fe1251772edbb013d04778391257ea4db5a8251ad4d771593308b7d8a50bfc386a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921404, "uuid": "65e88f7b-ddae-4ad1-89a8-39fdf5d6095a", "value": "T1914512027AC6D4B2C57629315A259B21A87D7D201FA5CEDFB3D43F2EDA312C1C632396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921404, "uuid": "d3b8359c-286a-472c-a096-4684b9c99e10", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921404, "uuid": "a063ed48-510f-4b51-a1c0-6a9ccbe7ff03", "value": "24576:zTbBv5rUNvFMN8yqPBFbilTlMLkMwyASu+rfQifbAZP+vPT:tBIq2XkMLnFASPr4CAZPOPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921404, "uuid": "47f5ec50-d8b4-40de-81cb-f749ea88565b", "value": 1279542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921404, "uuid": "9371a6c3-a5e1-4658-a14a-250c72be8ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921404, "uuid": "9ca4897e-1d0d-47c4-97fe-125d1b028b91", "value": "RFQ_0103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd952a79-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874976, "uuid": "05ce3b6d-b50b-4406-aab9-0668cd177008", "comment": "Malware payload", "value": "20a91c5cdc5f1ef263435158c2ebd62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874976, "uuid": "bba0b524-ca31-4ada-b999-af75da1eb20f", "comment": "Malware payload", "value": "3a2a110107ccc86b6a9ed9b752895397e1f56f0598b05657727f6bd0e6975d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874976, "uuid": "ac9eec2e-dd74-469d-9c76-c1ffc084728b", "comment": "Malware payload", "value": "008b7a82dc76b0fb383bdd30fd3471c77195ec12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874976, "uuid": "2292f697-25a6-4e4b-9fd6-ed80235647fa", "comment": "Malware payload", "value": "ce3f00f0ddf9c8b387491e26510143eea157218152a7e35da5408bc6204a74680b9aab918ae6a573ccc9733bb0da7af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874976, "uuid": "f170e48c-2e80-4b74-9514-a71f58c95194", "value": "T11A263353F3C74636F8621639A83A9C486D13393D05E5043A3DB5EE0EA1F17AB4D7EA81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874976, "uuid": "80c2ffc2-c4ad-4c18-8eb8-0fe253fb97d4", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874976, "uuid": "3a2fb497-ed8f-4b61-b92a-f9a765c58843", "value": "49152:g43vORBsHkZ3/7zn+ylqwoW68Vwd7TqtLH5ZcXEqQ6A6SWj5NUcJT8wol4xNelpn:TvORBso3r7pk7TqlZe0JZWjvslEQwn+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874976, "uuid": "c4145296-e069-43cf-8e8a-9db06afbbdd8", "value": 4622768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874976, "uuid": "4e3bc48e-ddb6-454c-a6bb-4d5fdfab20e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874976, "uuid": "5a78777d-14e3-45c0-85fa-42eb0a0b9e23", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.Rugmi.10154.32363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496ff1ca-dd03-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709871668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871668, "uuid": "7359dcd8-1a97-4be9-8480-dbde09a43f9c", "comment": "Malware payload", "value": "74b007fd4a2492751c879ec7ecd61d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871668, "uuid": "f0fd692d-a570-4a3d-abe0-fb8f262aae1b", "comment": "Malware payload", "value": "3ac103a1d42dbccedd1586bfc6c63977ef1d807be7b3e481d608552290468c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871668, "uuid": "e97b01b7-5c09-4687-9def-b7c0840747c8", "comment": "Malware payload", "value": "ca5fa7b67308a16e58866f5d49b33c066fc33db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871668, "uuid": "c65a6104-69a0-4381-8fd0-84adfc3579a3", "comment": "Malware payload", "value": "092852b0048713fd98d422227f8b41215be50124de3e5eab9d2203759043096f1c86e109d03469dc90ec3e453e243a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871668, "uuid": "89106bcc-fdee-48d9-bddd-750bbc88e4c6", "value": "T10AE5F1BC2E287C7ECEA60E30D42B7A0D287AAB7DE5DCC550C446BC4A1E74745E736522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871668, "uuid": "6cb4e868-6b78-463a-959b-00642e2ecf15", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871668, "uuid": "129eb6dd-2d2e-4e82-bf88-a96ed1ef53e3", "value": "49152:Ru3x/I+85xuh/9wpkZTkNO4GUM2IxxKiDl+1UNsTrkhZTxsTE:Ruh/xyulCEkNOtU0xKiDlSUiTIhZTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709871668, "uuid": "ad18d426-a3ad-4aa8-ad01-9eabd950bf55", "value": 3057152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709871668, "uuid": "6e83b5bb-cb4b-459c-9cec-fba6a251c637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871668, "uuid": "1379f9ec-c422-441d-bcfe-d87f577f40a2", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28481.13583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679f452a-dd66-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709914238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914238, "uuid": "4d591785-ee4a-40e8-81bc-8a2deb8c3584", "comment": "Malware payload", "value": "da7a3de2b213efd0216e43ea45dbe577", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914238, "uuid": "05045eb3-5868-4713-9e71-cbcfb221869e", "comment": "Malware payload", "value": "3ce5794c05e7686e8ce6fa8c5ea23038864da36e8b3ed17851f5c6d7fe9558a2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914238, "uuid": "b3c855ec-f188-4a74-b2f6-712e99b5fdc3", "comment": "Malware payload", "value": "24c4c55f7ab381e1b1d64c35035dcc704e1ced5c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914238, "uuid": "ea23e6c0-8d10-4da2-ae05-37596db7b532", "comment": "Malware payload", "value": "68e7afaa72422debaf5752b44f395d45318e4f1e5793cef2a2cd2ff457a92b92811fa398aadcb86f09c60b684dc31835", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914238, "uuid": "1180acaf-bbd6-4171-9e0d-2c7384807171", "value": "T17D4111111BE60731F7F38D760876A7109E72F809ED22AF0E81A4428C18A2501E475FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914238, "uuid": "dff0d80d-d7e0-4cad-b448-635e0b7ad78b", "value": "24:8WYaNBmYhZHcvm4pyAcPkr+/4Ap+nQ6E3Kdd79dshavt3r3KrlcKOdm:8WYazmSZHomuU1j3KdJ9FvpbolMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709914238, "uuid": "d91b55c8-7e13-4989-bad3-a2fa115fc61b", "value": 1970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709914238, "uuid": "33da3ca8-1437-4c4e-8ad4-5cdd12a26454", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914238, "uuid": "e305a3b6-0219-478f-a797-08b99036788d", "value": "whitelist.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934b0b92-dd51-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709905292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905292, "uuid": "17973365-d9d2-4521-8f93-c5d6fc145946", "comment": "Malware payload", "value": "e3cb6facc34751ef31fbc8e217fbb778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905292, "uuid": "315b969b-2b5b-47c4-ba71-eaa12d6f7b7b", "comment": "Malware payload", "value": "3fe406d5fb96318792c6845e824413bd709c776d74b73893af33f277b9350591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905292, "uuid": "a6171b14-a742-49c0-b6db-44c0b4b5c666", "comment": "Malware payload", "value": "e51dffd12bc7ff067f55342ece97f67532a681ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905292, "uuid": "491d7e07-8192-4fb5-8128-ce0501ab2e68", "comment": "Malware payload", "value": "da11748edfe6fa2910b3d92decbbb0966b414a7c7cb90c9179219ea160a00a6849b8234fe2f9052d701d997ba7b1d3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905292, "uuid": "d3ccfbb9-87cb-4c0a-80b2-e9521c0db3f1", "value": "T1B895484133FDA718F1FB1B70AE7D48644A72FEA6AD32CB9E1614A51D08B1A05C874B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905292, "uuid": "6167a564-a284-4417-aff1-34037a2f13b2", "value": "24576:iR5QvG4V6SzMpZsVafX4OSwqgVls6eKWPyEa4r5nDtIq3DlhXGgO+56VsFEPQIoG:iR5/4lzMpZRX47gVlkPR/Cq3D3GgOMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709905292, "uuid": "42660cb4-7066-46f8-99bb-0a0ae2134da7", "value": 1886720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709905292, "uuid": "d8824eb2-ce6f-424a-b58b-e4483c2b8eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905292, "uuid": "643213d4-6912-4d1a-b77b-31b357fd2fe4", "value": "3fe406d5fb96318792c6845e824413bd709c776d74b73893af33f277b9350591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72234fe6-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921128, "uuid": "a8cd5acd-4a55-490d-9ec5-9229b35c85db", "comment": "Malware payload (Mirai)", "value": "d3962893d3bee158420a10a9ab0172ba", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921128, "uuid": "60262c20-20eb-4dcb-9d64-7d00c8f2ed8c", "comment": "Malware payload (Mirai)", "value": "40b2bc7a14fa861459b46d28baa07864d3ef5180a65a5d2920d57b76fc74d33c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921128, "uuid": "f6894cd2-ad40-4ef3-8b81-87e853332f0e", "comment": "Malware payload (Mirai)", "value": "4713487ef4055387eb8f6101755a1c131b714e0c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921128, "uuid": "bc377562-8e91-4277-bbb7-1a10fe8760ba", "comment": "Malware payload (Mirai)", "value": "8e52f021464f9dda7dff22f3fb084f69ba2b4409a7fb995f0015700b94b34b458451b912651cef0b4c0933863ec1330e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921128, "uuid": "3a3dc49b-85d9-48f7-a529-b0fb9c570175", "value": "T145C30805FC404B27C7E227BAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921128, "uuid": "ec20c35e-6051-4aac-be53-d7336c6b7860", "value": "3072:MJDZ+6lJQTnoo3bKB/VaQxnWg5hL8IuXBi74eoC9DQlD6ObAF5R:QVaEWg5hL8IukVoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921128, "uuid": "e2684ab2-3a6f-401e-b72a-fb7a2897fff6", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921128, "uuid": "49ba89f4-2580-4748-850c-f594b98cbd3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921128, "uuid": "575c5754-cca0-4a15-b564-5b5f56251610", "value": "assailant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d38430e-dd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709892773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892773, "uuid": "23b17c95-57eb-4dd5-8a2c-66fd1028dd92", "comment": "Malware payload (RiseProStealer)", "value": "c3672802acb4d7217ea230d091dfd486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892773, "uuid": "9d007d7b-44a7-4b03-a67e-c3e9dde05d1f", "comment": "Malware payload (RiseProStealer)", "value": "41026d76a76c6df1dd3730fbd066e2cf15d6cc79ccf198070d6ec6b39facde94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892773, "uuid": "ad795e2a-7c6a-4ceb-a7ce-aec4ffa5cff4", "comment": "Malware payload (RiseProStealer)", "value": "8680e0856a0299367b678265689f59d7f8faa36d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892773, "uuid": "c3db994a-582c-4cef-8a3a-0f395db115bf", "comment": "Malware payload (RiseProStealer)", "value": "3dd353589ae248ca28149e561d032549616e2068584af607b230faa18e2b8225fa9fb85c8ad0e863a9e47e49e777529b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892773, "uuid": "eecc01d1-50e2-40d9-a245-7c863098f2f4", "value": "T1A5D53336F2E2E3C5F526EEB0AA6F464FF673F2550CDDB4CD046D3A8424A25039A165C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892773, "uuid": "1b7c8712-6ff9-4e52-9afd-dad2d7af43fb", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892773, "uuid": "a9115e05-e29f-4e18-9130-01b6b2bfa2be", "value": "49152:2vDjPYxcpRmPEqtQumGgMZIH27BXeyvqnmVABMLpzi44EsW+f8Q6qf7TGO1Ypq4u:2vDjjpdaQukiFZvqmSBMLRYfz6q1ep6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709892773, "uuid": "af0a67a3-f859-48c4-a0fe-9c1167231f4f", "value": 3004928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709892773, "uuid": "1d6e9af7-d52f-45d7-80c6-c7db06a0b1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892773, "uuid": "250b6397-0efe-4933-9c47-3e57d62ece6a", "value": "c3672802acb4d7217ea230d091dfd486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba7de9e-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932660, "uuid": "1dd84633-0e59-416e-adf5-72b06bbf1f44", "comment": "Malware payload (Mirai)", "value": "167356edd76f798ee10cf4d672d006a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932660, "uuid": "7e485dd4-658e-4cdb-8fbf-0ea2ea807f8e", "comment": "Malware payload (Mirai)", "value": "41299f7c7aeb52a6c9ac48f5eed6573da24adf3f3361d743aaa6de18e891f3d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932660, "uuid": "26e6cda9-67c2-45ed-b606-938f877e692c", "comment": "Malware payload (Mirai)", "value": "243067c87fe2a0f0d62b353310cc3ac4355ae6ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932660, "uuid": "20cc9082-4cf9-44b1-aa48-07aba4bb7197", "comment": "Malware payload (Mirai)", "value": "37689b82db6edc1e4d2a53f2d4f01322f108eff77da47b81365cab06539a40400f571beed3e187dc3f1cf0e79bf09e70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932660, "uuid": "06ac6c24-e1dc-4979-b431-37ae0729f75a", "value": "T103A33C4BB71C0B6BC19B5EF029B723F18B65F56202A221C1E51EEEC017B2A742477F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932660, "uuid": "622c0b62-4296-43a9-b17c-4531f6ca24e7", "value": "3072:OXjFhJ3P8kqJqoWaSdhQzffINw7YTkUUVBCkdQXpW:OXDJ3PteqoWtdEffICkTkUUVBCkdQXpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932660, "uuid": "59f2bf1d-31e1-4640-afed-aafca1697536", "value": 99160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932660, "uuid": "10c4cab3-07dc-4db5-8f39-6ed1ca53ee7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932660, "uuid": "b4e8d69a-96b1-468a-8f5d-499c2a17ba97", "value": "167356edd76f798ee10cf4d672d006a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99aa1e2-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921302, "uuid": "c39508cf-a657-44ee-b4be-167d7dcbc1f1", "comment": "Malware payload (Mirai)", "value": "122d35ab5bef6d591be44ebf8d0fa18d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921302, "uuid": "d47086f6-9785-4c8a-b99f-964543f287ae", "comment": "Malware payload (Mirai)", "value": "4318ce2e9d615f8bac9d35b9a38abfb7119108fd164fb6dca988ec0aeefd61b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921302, "uuid": "bb7315ec-5630-459a-a85c-132f3fbf5fd1", "comment": "Malware payload (Mirai)", "value": "aa06ab717af10ee3e3921c47d1d76038a2f27b66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921302, "uuid": "1278de4f-a5da-41c1-b9e2-8f7ba1deb291", "comment": "Malware payload (Mirai)", "value": "bbf9923f924ee860e9836f867e7e95b4d4611ba226cbb1488e156a163cefbfc31cbc154ea482278f908f2675e8d09d33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921302, "uuid": "bae4b8e0-2ff5-46d4-ae1a-eb95fad78665", "value": "T18B431B55B8814B22C5D5027AF92E118E332357F8E3DFB2139E212F603B8696B0E77D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921302, "uuid": "954c1e0a-8cb6-413e-b49d-2b109a70fba3", "value": "1536:frneeOvUtxyrCPTrxQcsMrCQcMniifKUvK+Wq:ihVW/KUvK+Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921302, "uuid": "d78e9e20-e16c-4f87-9485-207d88261b49", "value": 60000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921302, "uuid": "65153bb6-55a0-44bb-a264-d6d725de7098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921302, "uuid": "3c9af0e5-7550-4c24-9393-a99056f0ed1d", "value": "122d35ab5bef6d591be44ebf8d0fa18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452d31da-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932649, "uuid": "fa4e9f73-4c6d-424f-9b5c-b5bd38374b85", "comment": "Malware payload (Mirai)", "value": "179192fe4efb4678b1db8e21c7909829", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932649, "uuid": "274f1034-ba32-4b67-a290-0e63fe720ab2", "comment": "Malware payload (Mirai)", "value": "43c8c89f229ed06a02c516c97956e43923d325a15e8c1eae442751643354f9ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932649, "uuid": "7c19ff8d-66aa-4176-bbea-d5ac1a187180", "comment": "Malware payload (Mirai)", "value": "61738aa4c76c29d298f5cc45832b84c281b52d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932649, "uuid": "7975f9dd-9e65-4dca-abc0-602863e47e0d", "comment": "Malware payload (Mirai)", "value": "a1633904c81cbf82fba750342b3939201c0116abd5bccc0c6ece058f3e3c9c73e67264508b23fd39f1edda748d3a7315", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932649, "uuid": "31e763f5-5142-4263-87a6-81436731628d", "value": "T1E0834C46AA52CAF3C4530FB50297669D0B25F93A4E7A9F91F31C7CF09B521C8392B790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932649, "uuid": "a2ea7238-b698-4398-9fbe-81a56e8b1c57", "value": "1536:hePPACW5mccjJxQV8HlXujodhQzd1H+cMQnpAvCPVFL3ApQITA:6455cjJxiMlIodhQzd1HVMwAKPVFLQpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932649, "uuid": "dd98c54f-a11e-486f-b121-93913a068c65", "value": 83853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932649, "uuid": "2d402bde-4da4-413e-8643-92845c066fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932649, "uuid": "6482675f-45f1-4d50-a923-2608693f178a", "value": "179192fe4efb4678b1db8e21c7909829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbac155c-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917010, "uuid": "e2ae5693-0da4-4f0d-8b03-980b06ed1337", "comment": "Malware payload", "value": "42011a2aee917db04e0326b148f67994", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917010, "uuid": "aabf8a87-6cdd-4055-be10-659cfbea2f83", "comment": "Malware payload", "value": "446e1e44a3135435552d3702f7438f78fe4004d933ccdf7a45f34b61c91c0266", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917010, "uuid": "1217ee13-d026-469d-8fbf-c4fae22491d1", "comment": "Malware payload", "value": "52ad049477acff589d3608b5ed9f2cf5db829c47", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917010, "uuid": "b8d6204e-8d24-40d4-8f3d-40a830bdfe98", "comment": "Malware payload", "value": "ba2d0aaf61f42cb1c34f1dceced906a088a013e99b8178f91295f9769e3216230608365166dee0a33e324541ad6f0e5c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917010, "uuid": "2ec758b5-5bf2-42b6-8f56-33438fac56e4", "value": "T1EC23AF1A7354D515C48ADE3A8EC9D1EB5222BC96EE87970F31C4BB6F24391C2C213B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917010, "uuid": "fc830b87-0e65-4e93-99cd-5dfeae28d430", "value": "768:2yBP0uqwz1zqtPoY842/iSoyYvwHih0CxJ6+/:268uqA169842/i+RHqxJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917010, "uuid": "a2fb422c-bac8-4a69-ba8a-c49c4b0e1c36", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917010, "uuid": "b1cc5f4d-9125-4488-86a6-f490ae86c62f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917010, "uuid": "abafadfc-5ca7-4f7f-b33c-296db663b3e2", "value": "Offer For Almira Shipyard 00766534576890899798.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264160a1-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935604, "uuid": "cff6b7f7-d948-4937-86e4-a48b999c8ccf", "comment": "Malware payload (Mirai)", "value": "4bb9d5c551fd1a94e7c6ec91fa5fe5bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935604, "uuid": "722b94e2-d55a-4865-a0b4-f410808da9b5", "comment": "Malware payload (Mirai)", "value": "44dca46eeaf253edb9079688702f9a17ff906f1c5a72c3997c2a5090de96715b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935604, "uuid": "d1cf4d58-fc65-4b4c-a029-b444641eef4d", "comment": "Malware payload (Mirai)", "value": "488324b9dae4638efb50f4901f6a7dde5eef81ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935604, "uuid": "6bd18600-0b4f-4dae-8e81-41f41e6cd203", "comment": "Malware payload (Mirai)", "value": "39fb1824fb6fd770ef4e151eb0c999dce61f28560f814140ffeffd902557e764d1ac9c715dfac5261beb6455eae16673", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935604, "uuid": "217483ba-4d6c-4868-a2bd-cb9d2d4241b6", "value": "T1B7432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935604, "uuid": "9a9d521c-31d0-40de-a6c1-18cfff556f8e", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwb:RqtmZPuutfbltZFBSJsBcfDSTFI+BEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935604, "uuid": "f504afc0-06d7-493b-9946-e3f90fbf13ff", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935604, "uuid": "b10a2ba9-c324-430c-8c0f-35ab8a4cf56c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935604, "uuid": "bb71b394-c9d8-4574-8879-8ed972bb8688", "value": "4bb9d5c551fd1a94e7c6ec91fa5fe5bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9b58a1-dd9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936613, "uuid": "0729ca37-70e9-4fa7-a398-d71860492517", "comment": "Malware payload", "value": "d5cc6f0ba6d42848797ba05e7858d1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936613, "uuid": "033fd271-6656-49fc-830f-47ef610efb1e", "comment": "Malware payload", "value": "45337f5390f089946ad29f9aa231ba8d6fb6bccc38e8672baff0f1a4ff01f73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936613, "uuid": "f93cd696-c46b-4365-9215-0122d4f774e0", "comment": "Malware payload", "value": "4c9af83d37f120a3aef4a6515f82a2653c261adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936613, "uuid": "75d8a05a-2322-40e1-bdca-ebb56147fcc9", "comment": "Malware payload", "value": "0aff0e43fe951b642396c3684adf625285741777bf592c082e0d716cd9be94bd97b499708656f4be7eaf1f51d854d808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936613, "uuid": "bf8b876f-2424-4c25-8050-5120c3a4936c", "value": "T1CCC62380620708E4EDF7B136D7B4C82E9D6F7D21C3B459921FA4785625BB383BE39606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936613, "uuid": "96d10c4f-7c37-444f-963b-4febd1e9e56a", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936613, "uuid": "8f457b50-f09e-4570-97ab-d8f92fb74298", "value": "196608:VXpiq61W903eV4QREMToEuGxgh858F0ibfU9au5p0W8/LQhoANNngABnbkw1tlnw:3FwW+eGQREMTozGxu8C0ibfEau5qW80E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936613, "uuid": "190765eb-c809-4516-8296-5c3bac32fb49", "value": 12092105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936613, "uuid": "4621c896-b5b7-4b0e-a10f-e246e02b358e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936613, "uuid": "d82dcb17-ea44-4d7a-b1e1-143907bc5dfd", "value": "SecuriteInfo.com.W64.S-6cb95355.Eldorado.4235.12750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb132a9-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935666, "uuid": "86c5408c-9b35-43dc-9c0d-1a8d10ae7551", "comment": "Malware payload (Mirai)", "value": "64c75e4e097854bc69b5ce2c5a5021f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935666, "uuid": "6a847997-d0f3-4e29-b28b-fd62e70d0529", "comment": "Malware payload (Mirai)", "value": "45e7225e6cd20ea098ca57782036241d5ef3fc31ef877c2eb73abb164803108e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935666, "uuid": "5ea77a39-99d0-4d90-9a06-74460e1dd95a", "comment": "Malware payload (Mirai)", "value": "ce3d47d4d8345c3a8a3a4b2db4a964aa678817bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935666, "uuid": "24da90fc-6f88-4d99-a157-71b62b926245", "comment": "Malware payload (Mirai)", "value": "8093320fc3050fe8b8b0d8ca0d3ac21a9a2a01718fd7c08564cbb3f054b65c5129d41b6329d15d04e367e5257faaadd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935666, "uuid": "e80c19cb-bf85-4d52-90b6-726cd9ab73ff", "value": "T1B2B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935666, "uuid": "f77aa43b-b336-4715-b397-8cf8d414b0ab", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1C/LWy:c9sSyzz36YaWWgg1Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935666, "uuid": "740aab0e-450e-4bdc-a7cf-e8e808cec7c6", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935666, "uuid": "595c371b-da77-47a0-a89c-1c6eb7faa809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935666, "uuid": "675c59d0-e07e-4f09-be01-4027e426c5a5", "value": "64c75e4e097854bc69b5ce2c5a5021f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554241e4-dd4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709904329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904329, "uuid": "5f27cb6d-0e78-433a-977b-6ab1c01f6225", "comment": "Malware payload", "value": "827000f733cb4e8cad224fb3d9bdfda3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904329, "uuid": "ea58b345-5cc9-40f7-9d79-f0895861f653", "comment": "Malware payload", "value": "4746382ad810bae505c68e9f3297c8f0d41477f2e4c7c8e77a3fcc792ef964a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904329, "uuid": "70ee4bc9-f5d0-4e60-a05a-2d3e46cbe277", "comment": "Malware payload", "value": "d29a519e2c18375879d296c9e6695ad6ededc55b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904329, "uuid": "91cbf1b8-2e1f-4037-9639-33a58958ce62", "comment": "Malware payload", "value": "2e5beaad0923c48d77bfc073b8155483f3e6f3115d051727f0907d87a1ae7e9dc57bc440c4ed886f7ea29b116bb70d4a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904329, "uuid": "afcae3f5-fbb1-47bd-9782-5ace3388e713", "value": "T15A148A2DD34B02698F524376AB1B1E5042BDBB7EF39552B1302C537933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904329, "uuid": "f0d27e11-8d81-4b6b-8a2c-d921c76dfa27", "value": "1536:owAlRkwAlRkwAlRGWjgPpAD2aeE4Tr/v1KSI:owAlawAlawAlYlPpAD1eE4Tr/NNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709904329, "uuid": "b75a10a5-b793-4f77-ac91-76a0aa519cb1", "value": 207788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709904329, "uuid": "808e2c9e-1589-4928-bac3-ea0f90520e9e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904329, "uuid": "a6f2b57f-8990-463b-8966-810f28f308f7", "value": "PROFORMA INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4892b6-dd79-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709922356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922356, "uuid": "814cfa16-0703-4449-874e-1cf0640fc977", "comment": "Malware payload", "value": "0f4471b3f8b3485268dfa7e825a217b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922356, "uuid": "283dd937-a812-4c7b-9060-87fc3c6360cf", "comment": "Malware payload", "value": "483622fb3a2b1287dbd15c3c73a91025ffacc8a485134054bcdfb9592e7e9718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922356, "uuid": "6c8f252d-6c9f-40e2-adda-f53cbc7e16c7", "comment": "Malware payload", "value": "1fbc3f8cf90dcffefb8f42436f9db2ec6f9ae12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922356, "uuid": "6ee9d420-1cb1-406e-98db-ebdb75194e9a", "comment": "Malware payload", "value": "1d44d219737c751c9e0a940927486f7396ca7e2b419d104b8a899bfaff96a00bd10cd957707a4b2c53e78ddc9dd1d156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922356, "uuid": "ca88d5c6-ca6a-42f3-a7e7-130f20f65b5f", "value": "T141763356E4A896FAD43749318EC5513782EB207A13AA89FB071C37835CF33C9277A49D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922356, "uuid": "fc04a741-0880-4ae5-a95a-422596b09e68", "value": "86d86dd7e5bc25527ee539ccf75661cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922356, "uuid": "21310e19-d23f-4d79-9ff6-ad039438c256", "value": "196608:NvPGP3TjBcWivlGV0Es2OkbtFELnZMEvEQWARzAF:NvOHBvm2Ns2OkpeZMXAOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709922356, "uuid": "b6b7757a-49ff-4f85-a60e-6c4ca12f9c32", "value": 7484886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709922356, "uuid": "1046be75-36a2-4ef3-adb2-712fbce8487d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922356, "uuid": "5d8fc98a-0a50-4e13-9dff-b8c93d38aa75", "value": "SecuriteInfo.com.Trojan.WindowsPrivescCheck.A.1552.11505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51180961-dd67-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709914630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914630, "uuid": "0e3a86ba-f875-41ac-88dc-58779fb7c28e", "comment": "Malware payload", "value": "a6b1300cc5f581621e59443c81855d29", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914630, "uuid": "e6194bd2-affd-4561-aae0-23808da8864b", "comment": "Malware payload", "value": "4afe24ad94252a4acf06178a4faddcb1bd08f0fe773bca5e36d7c49e71a74eb2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914630, "uuid": "2adb384b-bf0e-456e-8f1d-55dc4ea7d148", "comment": "Malware payload", "value": "c108462a67308d2a73e56263611ea9a194449ef0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914630, "uuid": "6245fc3b-bd81-4b07-aa0f-1d7505dadbbd", "comment": "Malware payload", "value": "318d451dbee8d996cebcf56a2185b5bf8788a668f90ce2870fcd125bceacdf0b951471f22b00b5b9a31616eca64a8b2a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914630, "uuid": "2274f831-c39e-4ec5-a666-c50bb105f6d7", "value": "T15DC572A33CBD45951705376B9F4BE9340A2FBE36C7AE9DC400D604C8644A3DFAD90A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914630, "uuid": "1041330f-462d-4e88-b227-d85224e4bd09", "value": "49152:80/+Q5HTg4yf20utPoLCPTL8Y2EfYxYMAIMEuTliKHbK743fBGeiatCip768oXs4:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709914630, "uuid": "db15bbd0-a448-4953-8a31-b07cb0600362", "value": 2498858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709914630, "uuid": "e8e2bbb2-be57-4eb9-9bbd-db5e33df17c3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914630, "uuid": "e117cd69-d512-4eb0-86cd-6cc7ff218003", "value": "rXcroevrhxqltar.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de394795-dd8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709932047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932047, "uuid": "e8f3e89d-378e-4532-a4e4-74be0dd78d19", "comment": "Malware payload (AsyncRAT)", "value": "6ef584544428a4abebc255be57e65b82", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932047, "uuid": "432a6a0d-2874-4db7-aa71-606b01aa5b78", "comment": "Malware payload (AsyncRAT)", "value": "4cf8aecd3c9028fa90f3d9090c77825e74d764f883eb3d240abf50e59ac28697", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932047, "uuid": "6e3ea167-07f6-41e1-b277-cba236c4f1bb", "comment": "Malware payload (AsyncRAT)", "value": "d5153b3ee6e8ba605472ae2dd8905f2462f55d81", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932047, "uuid": "21889acf-bf75-4e2d-96b3-711e99bda26b", "comment": "Malware payload (AsyncRAT)", "value": "ab3dfe314f811bdd6687e379e0b8ef6a89a3d7ed9ca0ae3b451db29a79d55af4939ca65955668424a38b4fc7cb22c3ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932047, "uuid": "962ca17b-1f48-412c-95c9-fe7c222e84f6", "value": "T1CB235B4037D88136F6BD47B8ADF3A14186B6D2672903CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932047, "uuid": "574d7c73-5797-4355-a0c7-2774b40c16c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932047, "uuid": "e76bfa2b-0b94-47bb-9d24-0cb0fd0d910b", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygeTBsUwv8vEgK/J9lZVc6KN:dOtmBtKDs4zb1IsUwknkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932047, "uuid": "71a09781-a9ee-45ff-9de4-7e4372e0fc6c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932047, "uuid": "e858f606-1fdc-4d27-b46f-525bd8c5960b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932047, "uuid": "0ac61d63-c13d-43d0-8d70-7cddaa7953dc", "value": "bTZN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71636042-dd68-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709915114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915114, "uuid": "a8c1312f-8c84-437a-9810-72fb7ba02ac6", "comment": "Malware payload", "value": "2968778419336ab3db3e51f6cf2835e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915114, "uuid": "0a22b4d2-3660-4ea5-af38-b3af0c73b1f7", "comment": "Malware payload", "value": "4e5bd19c6b7be379e5cee17c23a141a9903e53524f38198fa190346b610b83da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915114, "uuid": "d928f0b6-4cb5-44f0-975a-60a88d6905fa", "comment": "Malware payload", "value": "b2b4259d56dad68d38436c572ca6eca55a5415d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915114, "uuid": "a71967cf-7788-4e03-8a28-bfa9b15689c7", "comment": "Malware payload", "value": "632d6997a59b7a8bf67357a66c32808c0a6540f9adfd1c3718c39971184528c08ef04f469e3004d1984c815eb38149d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915114, "uuid": "8d45662d-389f-49e5-b175-93188f48be08", "value": "T140A4C0AA13B39167E7AC02B8E0415B0BA3F985CA9761F34D585815E45C273C0FBA737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915114, "uuid": "a0b2eab9-2b99-413a-b021-0456804af452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915114, "uuid": "4e798fc8-243c-49db-977d-ba70cbbe16ca", "value": "6144:8ZD0Ng4raVj5wYZ4OZZ//r/E7Qq/hzMED1TdE4Fbxx29D/D3iPKNT7MP:PuVj5coZ//osq/1BTJv29iyhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709915114, "uuid": "a8838cd0-9a13-488f-954f-ba06f115d860", "value": 482440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709915114, "uuid": "ac815fca-254c-4147-be4e-5c64b4400a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915114, "uuid": "5e83b9e6-9ab0-4039-8cbf-2e1fd52a6d85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f411c456-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921346, "uuid": "9a26e0f9-bec4-4724-9352-fd44188e2d29", "comment": "Malware payload (Mirai)", "value": "5e4afe6ec9d381fa76ae69dc18684959", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921346, "uuid": "b430b05d-a06f-470c-aba9-fc944aed8ddf", "comment": "Malware payload (Mirai)", "value": "4faec909e1c7eee8b846ce1543203a84374c8612e1039995f0353fe03c13e7e2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921346, "uuid": "f70c4c93-2d58-4005-a9ad-c5fa2663ab48", "comment": "Malware payload (Mirai)", "value": "d6694d7dc1421959b0b3753e8499d3f34fca2ddc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921346, "uuid": "8a743f4b-2b71-4445-a3ea-940f01854ea4", "comment": "Malware payload (Mirai)", "value": "8152c7ff4ce4c92144b1c14be3b41b284ddec3258b753cc3effb16a6872a8409410651e3d923bd513cc6141ca11c006c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921346, "uuid": "75e796d0-20c7-44dc-985f-4d7a7f6c6976", "value": "T1D633F613F58285FDC549C17017ABBA3EDC26B1FD1228F1E27BE4A7227895E225E1DC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921346, "uuid": "8696c890-b63f-4fbe-81ef-6cd160f39ae7", "value": "1536:QP8qlgMVnlPFtzmT2kOwXeEdwg5a2jlXK4m+AFDo+2NYPL:kzlbVlN+2kOwXe8wg5a2jdmWjNYPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921346, "uuid": "e2b660b8-4aa3-41fb-951c-b71026baf8f2", "value": 50560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921346, "uuid": "7790790f-a60c-4949-afe1-57d85838f43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921346, "uuid": "1d1bb81a-54ae-48ab-9fb3-6c6f595ce2ec", "value": "5e4afe6ec9d381fa76ae69dc18684959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c03555-dd59-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908888, "uuid": "19b6b4d5-3969-43d4-8b04-bfdf1cf268db", "comment": "Malware payload", "value": "80660dd1ab6a91514c1562e7e10abfa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908888, "uuid": "5c6c2f64-612e-46e1-8845-0c4b836f182b", "comment": "Malware payload", "value": "5238f604ab1916bdcf6e10422ce36b10edf864182949193d8c9555d086310e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908888, "uuid": "92a6bb2b-d0ba-4603-b651-5183d6aaa1c4", "comment": "Malware payload", "value": "100caee8a4c5805f32af8494833f14ecdbe300ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908888, "uuid": "420b8ce9-d9cd-4d19-9a44-b3e4ce3e65c9", "comment": "Malware payload", "value": "306a899cc9bfed96cc77b14f8c62a7fc932c6b571bbf694deab19a188dd018994dd9b9e07234e04a36886ea2aae4a529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908888, "uuid": "5a619018-3375-4b46-9430-7784ffd6f5fe", "value": "T1CCE4239633CCD942CAAC05B5C0597702F3B2E51B49D2E3E9ADCE05E933C37A0299D56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908888, "uuid": "e8f607a8-ca25-4bc5-8a77-22d2526a70d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908888, "uuid": "e8f32a7d-35a8-48a5-93c6-ab8cc98ffef1", "value": "12288:QUFtImAFeXg5ux/t6nTrVlMrRtBJwIaTqUB1oJ1mqxLay1d/v5zH37ykR:j61FeXgWlGNWrRtBJQBCJ0MX1dJzH39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908888, "uuid": "9ae11501-0968-4c8c-8327-830c327c0c4c", "value": 681480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908888, "uuid": "e6d86f93-4517-4054-91be-c35f247afc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908888, "uuid": "bf9a80c1-fdf3-4e4a-a26a-d6fa079f1f7d", "value": "DBS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066d221a-dd64-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709913216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913216, "uuid": "df091ec8-4622-4b6b-a391-74ba3ec3319b", "comment": "Malware payload", "value": "ab80300c74cda92e86e89073a4942162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913216, "uuid": "7abc2598-d7c3-4a36-81c3-e082d1d85f58", "comment": "Malware payload", "value": "54ef3ec0fd299659fbbd2f7b86f98229774abab5a1131e3067b92c7eaa599615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913216, "uuid": "bc888949-71be-4684-be6a-3b487699a311", "comment": "Malware payload", "value": "cf23fc30452a51ccf16fae046dcd54fb6632d5e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913216, "uuid": "c555f93b-49aa-4d7a-9c7a-114c9348f0cd", "comment": "Malware payload", "value": "48f978e28ccd231732a3e0695392ae6ccd4410215815e97fc1f3afe1a6d8c12ac0af9b61e414ff47a0aff0310b7764fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913216, "uuid": "2d6695f6-af23-491a-9261-c45383b42ceb", "value": "T14E347C72798040F3DE90653111AA277BFB3AE64906328AD3D36CDDB55C26361E92E3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913216, "uuid": "492fe4e8-611e-464e-83ea-d979bd3eb9f0", "value": "6144:NhbZ5hMTNFf8LAurlEzAX7o3wfSZ4sXPzQI:/tXMzqrllX7owMEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709913216, "uuid": "25ded3c3-4498-4a65-8cb1-b1a7d65095cc", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709913216, "uuid": "e05807c0-a004-466c-bc45-da07e2a4f3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913216, "uuid": "24b3644c-9de7-418d-b957-bad845ecfb78", "value": "ilaem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9798ad91-dd6a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709916037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709916037, "uuid": "f95736ef-8714-4068-8feb-757cba77b9de", "comment": "Malware payload (RiseProStealer)", "value": "5335749c2421d1ef74b6816aeb8ada26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709916037, "uuid": "c048f1d5-19b7-49f5-809e-e3041af96341", "comment": "Malware payload (RiseProStealer)", "value": "5529b04e3a0a471cd4f891e035b5bd68473f9206944807dfaf6eb4a0f2ac8289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709916037, "uuid": "2fa921f4-0b3e-4548-9783-a946520c98f9", "comment": "Malware payload (RiseProStealer)", "value": "af5ca05b22e0335334ceb56b2e97b2830172725c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709916037, "uuid": "f630cc60-99e0-4fc0-96b8-0300c4ea4749", "comment": "Malware payload (RiseProStealer)", "value": "1974bc48917ebeec40cfb323bedc24d09a98be6f9fdd759a5247f16141a48ec649f99a3aa3221bb5b38ca8251b8b265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709916037, "uuid": "df0fd5c3-04be-4dfc-afef-08fb2edb8955", "value": "T1C5663319DBC52488E81E517087DBBEBDB435DEE08CF68F4E159C28D99CF32E1663124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709916037, "uuid": "907cd80e-6191-471b-b1f1-b02734420d8b", "value": "5fca035c1d9772fed59e3f04779695b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709916037, "uuid": "fd85df22-27ee-41e8-8b97-3076730bac37", "value": "196608:TomPn3CuvWijd8TR8mioUGIKSjePsJvkRAUlsxg:UmPtv1d8fUfBePslknlgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709916037, "uuid": "bb461464-0bbf-41f5-8864-eedbebaff098", "value": 6805592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709916037, "uuid": "bce78a2c-753d-4abe-b1c8-ce6e6c36b551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709916037, "uuid": "90945300-92bd-45ce-94fe-5cd23bc82d28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8275b0-dd35-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709893361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893361, "uuid": "326655bd-b92c-46b1-b7cb-eeccee51f1e9", "comment": "Malware payload", "value": "9b99f9fe7fa43f391eda1dfef1a0c3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893361, "uuid": "ffcaa1b0-5bf6-4050-8c58-58d1a81c421b", "comment": "Malware payload", "value": "59a9d10eba81d62337f38d8f72a15f283e1f4bc9daa99fe0c08f780f3e4da839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893361, "uuid": "4da44564-a254-4bdf-a097-53797a2b8d78", "comment": "Malware payload", "value": "474d3238f78fcdb4f41a429786961938586a132c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893361, "uuid": "e2681c4d-0cd4-4929-8066-7b80e88b9db3", "comment": "Malware payload", "value": "3f11de60c9f05173fd5189870d8997713b89c7380af05f84795b58dfc0fca3f4aab44252ba77b4a0c51f671ec63b8c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893361, "uuid": "90e5244a-0dae-40c2-a889-7dd30818ea79", "value": "T1A0169E5ABEFC40D9D49A9176C957899AD7B3BD552931831F01E1339BEF733220E0E222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893361, "uuid": "08aabe15-8de0-4c83-b76c-aa9ee356d79e", "value": "d30e6e143342788d47a2d17b464052b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893361, "uuid": "242dc649-458e-4120-a87b-0b3a8f08083d", "value": "98304:/G/a81cB033sr4JFvMTFLOAkGkzdnEVomFHKnP:i33uTFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709893361, "uuid": "aebdbe48-ba74-4bb3-8292-0ebedb252195", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709893361, "uuid": "b626294c-01d1-47cc-8c6c-271572e031db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893361, "uuid": "b963b0c2-5bdf-48cc-ac39-4dc1a753af18", "value": "9b99f9fe7fa43f391eda1dfef1a0c3a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72662040-dd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709892782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892782, "uuid": "76101cba-5441-46ba-92b6-5516987e7fcd", "comment": "Malware payload (AsyncRAT)", "value": "b8968700eecf87dc6bd5cbd713b12584", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892782, "uuid": "dfe6ca15-9674-4471-890b-cc1a75bb6593", "comment": "Malware payload (AsyncRAT)", "value": "5a672cce436a5f9bcda2cdf71ec4255998828fb2ad72909ad2fab03f31715a1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892782, "uuid": "211f694b-cefa-4bc8-ae0c-955330efafc6", "comment": "Malware payload (AsyncRAT)", "value": "fe6756c5c6e54c20d455a91492b69fe66dc6cda7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892782, "uuid": "de6459cb-24b5-45af-be67-c76d347c94b0", "comment": "Malware payload (AsyncRAT)", "value": "fc5d575eb060f19b661430eaef059075d1c2d2c7d0507184856cb320eddf2f613a21b79b467e58febf0f51831c072ccf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892782, "uuid": "56df3886-9336-48a5-be4a-b1ffb7d57c21", "value": "T1B863023350E1BB57D50576329AE8161EDBBA92ABC871575A8313BCC0CB6C73CE99C088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892782, "uuid": "d0698d1d-c7cd-444f-a789-02148beac6c5", "value": "1536:LPg+MBG7fiIIOcD1+gyWaG7FhZL9BLqifBr99V4unqR:LPgJEGIIO+1xPJhN9dqipl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709892782, "uuid": "0e18a97a-bc04-42f9-bdb8-971b4c031af6", "value": 72059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709892782, "uuid": "3cc1696a-2929-4df4-9f25-3576561796ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892782, "uuid": "34895f9a-f1fc-4eaf-9663-556fa63b2ade", "value": "b8968700eecf87dc6bd5cbd713b12584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed27327-dd4a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Urelas)", "timestamp": 1709902305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709902305, "uuid": "4ac35663-29fc-4795-b601-261f2447fd01", "comment": "Malware payload (Urelas)", "value": "69b1d3eb6bee78b21a1b0ccae90bd42d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709902305, "uuid": "41c70477-d40b-436d-bfb3-4fd4fea85713", "comment": "Malware payload (Urelas)", "value": "5b4acbdd60cf4f80b0d353a4f1d3e2da6999d1ca4998ebd2b9b3a354c1b75de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709902305, "uuid": "9394c3ad-cd10-4f21-b975-bf37fd9a7aea", "comment": "Malware payload (Urelas)", "value": "f54069bb3a595145cf110aaea85e2c42c8945145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709902305, "uuid": "6898a2a8-f872-47e6-94d0-bfe28abe5553", "comment": "Malware payload (Urelas)", "value": "22824d0a0ea6bab27fc87ab916bbf9f8a4ecabf867019763b60441c1f3a0bdd54bf5cb0df78519c085a19a94ea3024de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709902305, "uuid": "2d82edcf-6ef9-450d-be2f-c1f29edba19e", "value": "T1C4A4BE213640C436E36A173548C6F6B429A9BC355AA5D60FF7A47F396E301938B3B24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709902305, "uuid": "19d58c2a-dd8a-42f9-b081-73c1fdceb0b3", "value": "56070a768a13c1e389e8414fe16ea7da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709902305, "uuid": "26145962-96c8-4d1c-a893-cf43bac2965d", "value": "12288:xpbfVlu0agWfZlnxgmEpZGsrUs99uDEq5EGDFhU:xpbGRZxSfGCUs99hq5Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709902305, "uuid": "46982537-deac-44cf-8b2e-aa2372f5d8bc", "value": 490876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709902305, "uuid": "08128004-b4f0-482f-9e47-017df07ab363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709902305, "uuid": "46b1341b-0d87-4038-93dd-025075edfd74", "value": "5b4acbdd60cf4f80b0d353a4f1d3e2da6999d1ca4998ebd2b9b3a354c1b75de7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406c9d70-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932641, "uuid": "f5bfc9e6-9ee3-4236-b7ce-4cba6952f775", "comment": "Malware payload (Mirai)", "value": "d15d2e64185e1024b5b6860e10da19ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932641, "uuid": "bfa35a57-7e46-447f-ba97-9cc539ba118a", "comment": "Malware payload (Mirai)", "value": "60812c864666078a423402ff686124fdea684ac88835d04303ded2e653d79486", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932641, "uuid": "86b83e19-506f-46a9-8237-06e460bedb54", "comment": "Malware payload (Mirai)", "value": "88b6f8cd55e28be6ec6d34e5790eda5ca04fff8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932641, "uuid": "3d131eba-8bde-4870-9f08-6439f91b3e47", "comment": "Malware payload (Mirai)", "value": "4ec98ac6fc01b2ceba9b4dda13e8fbc57649615aa98b42b6a33dc17ec2487f1e0852c9986b26f274de6756b218997efd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932641, "uuid": "fd36d879-504b-4184-807a-45613cb16a11", "value": "T180934B0758624FB3D04A7EB52D775560075BFA620F4F0A8BA26CA9F4074B8CFB50E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932641, "uuid": "a4d97fb4-7886-4b20-913f-6523382cf704", "value": "1536:RKNXzbK9dItVEputmhT/CqdhQzvjJBu46C2UVBnH/XQXwW:RKBa9UEpz/zdhQzvj76dUVBnfXQXwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932641, "uuid": "6d40d82b-74e2-4cdf-80d3-158312acda08", "value": 90828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932641, "uuid": "466eeb6c-1d3a-4515-a111-aec27084d75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932641, "uuid": "007e6aeb-8a34-43de-aead-2764f0b84dc8", "value": "d15d2e64185e1024b5b6860e10da19ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5c4108-dd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709934705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934705, "uuid": "181baed6-5ee3-458e-8e24-8f8dc633f751", "comment": "Malware payload", "value": "25821577dc3c4fb26ad9459e6ea11c30", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934705, "uuid": "85f15abb-b6eb-4ecb-9bba-08370a1b6c30", "comment": "Malware payload", "value": "60d1e55a7d30437b3763f34ec2fad55fc02d92a93d54c64a9972dfe0dd019826", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934705, "uuid": "822a56f0-95de-4d65-9924-adcd4aeaece3", "comment": "Malware payload", "value": "c0ee3c0991cfddc2a1f0c7b339da2c23624783fe", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934705, "uuid": "c7624b95-5544-4adf-a62d-fed75cb5c019", "comment": "Malware payload", "value": "36ed168db5b00d19c6d3c0bc29d42a36dd81c9c5612e3de15ec020968cc417132d99544d41160b1d0d1cc660219bf5a3", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934705, "uuid": "d4eb4908-d105-4456-bf37-e5a6dfb06215", "value": "T18453E0DA3DC4A8B15FFED45734FEEE6CE23A19AB45C61B2940F14A0712BE3479882447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934705, "uuid": "53f1e3ce-eaad-4ab3-b89e-ea63bfa775f6", "value": "1536:0RmcRy63BbIxxrQSAQz9mu45kjqrNM3zLX20SiJUmstIDsc9a8K7Jm:0RjVBQ5A49QrrNuzLXMiJU5tIDpgj7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709934705, "uuid": "62407cb1-6b58-4dcf-aeb4-51df8156eaf7", "value": 61790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709934705, "uuid": "faf67e9b-90a0-4426-9506-98818b67f86e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934705, "uuid": "ef6882b8-7751-46bd-9d21-e498ec9a28c0", "value": "update.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfa9f0d-dcf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709864800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709864800, "uuid": "9859e85a-e194-4ad5-9b2a-cef9794e9f65", "comment": "Malware payload", "value": "92eaa2c4ed748e199065628b704a93a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709864800, "uuid": "8f9ab7ab-0e11-4b71-b0c2-62548940715d", "comment": "Malware payload", "value": "61a0ba630479946f811a17478115fd4cb4d56a3fb5a26e69473a8ea4fb4e029c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709864800, "uuid": "7910dcd2-8688-4a3e-812a-2ec1faaceb84", "comment": "Malware payload", "value": "e2eb95b0b8f408a8022ab1ed872e3fc5e73b5f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709864800, "uuid": "6840d52d-ac97-4659-9a4f-e08ddde96a42", "comment": "Malware payload", "value": "676f76daf49257e291b096cf7f78c922ee6dfe7c1d46c1bec9f9434f9b0c04d7d0456ea2ab4dd5c62ec61932bd8df786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709864800, "uuid": "2e6fd4bc-01fd-452a-be5f-e3988fc71b37", "value": "T18F154A286ABC119AD07281388AA74113F3F67819AFF1E7CB5156531F1E3B9EC4A37712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709864800, "uuid": "b717f321-3971-4f43-bd94-a0dd1eca6a9e", "value": "ee96d1f3f930bf5bb6a3ae3bbd5c4367", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709864800, "uuid": "46ca6a48-8b83-4fdb-a707-130656915876", "value": "12288:vArN8RB62nEO/1mkPHll1JO91gaMD65X08aaSKuhudtK8ccwaCRJ/qQNBu:YrN8RB7/F/lmgaMGx0Z5kDe5ZNBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709864800, "uuid": "792db3fa-5c43-4e68-a3b0-8a7ac52acd8d", "value": 935840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709864800, "uuid": "d70e2440-e1df-439d-b5d6-aa5297c9dd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709864800, "uuid": "67009fc6-17e6-4e4e-b8b4-7388e310fb86", "value": "SecuriteInfo.com.not-a-virus.Downloader.Win32.Zona.bjn.13141.12243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af85a9c3-dd0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709875704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875704, "uuid": "7da71009-7a60-4dbe-80ab-1738060886a3", "comment": "Malware payload", "value": "4f0f6cd3d79ef0d367bdba2aa80554c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875704, "uuid": "e508bc91-c135-4afa-9d63-6d78a43bf74e", "comment": "Malware payload", "value": "63056ca0409d5e15d038ec044aa4fccf4ddddbeb17ee697274feae60fb520f0b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875704, "uuid": "d974fd77-a868-4dca-9e89-ace45cea7b19", "comment": "Malware payload", "value": "cd023c49119fb7a6edf2cd4eae824f5ac0a0f6c6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875704, "uuid": "27135bd8-02a0-4d88-8ea6-d4bab4c645fd", "comment": "Malware payload", "value": "741855c71766c70ea2d7f3612ab3b71546073d6b9d9997e3c215d9cc68ae1d4db92f3782d12dd02b9182cdb59fe78a50", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875704, "uuid": "35152657-31f6-4cf1-ba0f-e3ffdbddc494", "value": "T17263396EE34F0955DF55E6BB034A4B4A05FCB33E728140A139BC977437AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875704, "uuid": "d1a64bcd-31b8-474f-968b-7781081655f0", "value": "768:rOjlSvVct6+MKIoF1Ysjwf8Hm2dWY3RDNCMGITy5cgQrhEt76ZytyumDh03:2Sc1lIojY+wf8HpBDNco9E16Jphc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709875704, "uuid": "bdc7e8be-3a05-4c8e-8991-ff48b43b196a", "value": 72449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709875704, "uuid": "57d56b84-c8e9-45dc-bc94-a5214f00f29a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875704, "uuid": "b906f5ae-44a4-4430-a9d1-39e3e733d30a", "value": "4f0f6cd3d79ef0d367bdba2aa80554c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60891f2f-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921099, "uuid": "12ec0337-767b-477f-abf9-f8bb5635f8f0", "comment": "Malware payload (Mirai)", "value": "eb010c29174f38fdbacc568d7ad893c6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921099, "uuid": "577fbbee-6669-4421-8650-025e69b1565c", "comment": "Malware payload (Mirai)", "value": "64a2813a83a91963f66087b2dc665d03a2e90dae0ea73666f54001f12dfd5469", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921099, "uuid": "d03bdac3-f406-4e81-b9e4-ae9d03d84684", "comment": "Malware payload (Mirai)", "value": "626a4cc509b6dbc2360897ddd94864fbe82aa4b3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921099, "uuid": "66c86123-60d2-4efd-9ea5-13ef7340c7e0", "comment": "Malware payload (Mirai)", "value": "e8d6cca973c2301bd1c73a78126ab49bffbe36af1c5dc05460465763f30ed03d04f2e3af765d11fe43f57dcab79ceea2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921099, "uuid": "6ad1f4fe-9f01-4bc5-8f91-3d337e3ef801", "value": "T1AA044A05DA809B17C6E237BAF79B428E33239B5467D733058928ABF43FC27994E36115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921099, "uuid": "e7df649a-e100-4f66-a759-f3d50415b625", "value": "3072:MV/Yb/dnp+eQPGY+PaTvaOZbTnJ62ZDsM7vhbV45hLqM3zVbYM/9MjQmmw3Bq/1A:k+mvaOZbTJ62Z7vhC5hLqM3z+M/9MjQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921099, "uuid": "4f845db7-3f83-4989-9e99-3cb21529236f", "value": 180208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921099, "uuid": "2cbc539a-ff6f-4659-84a8-3ce1ee06aa13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921099, "uuid": "6d419628-0d3a-49b7-9a56-dad0b938dfc6", "value": "assailant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6446abf-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921323, "uuid": "3f14e86a-deab-4c5f-b288-c54cc3d47c17", "comment": "Malware payload (Mirai)", "value": "f709108ced39463d00e7788fab2922a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921323, "uuid": "6f46d90f-c94b-4aeb-b3f4-b3070985e03c", "comment": "Malware payload (Mirai)", "value": "657b644d9660f85f876889fc43fe1836aed9fcc5583d779db0b37de127a77bc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921323, "uuid": "42dfcb7c-57ec-408c-854c-743b127a4e01", "comment": "Malware payload (Mirai)", "value": "3b81dfdf8a213f5158c464c7cecfc08e8095f73f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921323, "uuid": "df28bc62-eeb6-4148-b6d2-7f9ec047dc66", "comment": "Malware payload (Mirai)", "value": "2b296df46d10d156bebd983d0e496f0f7c480b3d345c634c9f06898d7e07370955ea96d06e11fafc074e0bbb2eb78391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921323, "uuid": "c051dc25-2657-4d46-aee4-823cade93d7e", "value": "T148331951B8814A23C6D0137BF66E42CD3B2563E8E2DFB2179E225F50379682F0D67E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921323, "uuid": "05eba1f9-a6ba-4e0f-a68f-6c18a7bf6415", "value": "768:w9BEGwbbtHKR6u7OZu+foYEQpRIzuon4y0OevELbbedGADAtotdprWzJcw:aEGAYwuP+j3Euon4yjsUbb8IGQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921323, "uuid": "e82641c6-491d-47f5-8b59-a9bfa055d3cb", "value": 50272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921323, "uuid": "dc947ed5-efe4-4607-9e27-62ff58afa044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921323, "uuid": "576e81f9-f73d-428f-9f8b-b541d9b2b69a", "value": "f709108ced39463d00e7788fab2922a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d079566-dd3b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709895752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709895752, "uuid": "080ac22e-acc4-4857-9c9e-10150b74672e", "comment": "Malware payload (Mirai)", "value": "81f1d926997c0ca58d85173e02bb07c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709895752, "uuid": "fa3d3668-3b2a-442e-9ac9-ce33188852fb", "comment": "Malware payload (Mirai)", "value": "659b51a3f24d0aa9172eb654e1720b5e078e9af2b5701d22057cc7bb447de3ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709895752, "uuid": "618facda-702a-4214-89b0-ecbb0e8ff4c7", "comment": "Malware payload (Mirai)", "value": "4aabc20d1fccfd1868048c722e861dddfc105257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709895752, "uuid": "7de28868-a7bd-4e1a-a3e8-d32e06af3c55", "comment": "Malware payload (Mirai)", "value": "ef49ec856b03d15a0c3dfbd68469f716c6daf43554d714922cf4c873655bb9b9de8db945dbaabf61eef5b815a8b53b87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709895752, "uuid": "2d9066cf-7c38-47b7-a215-2fa73b5799ba", "value": "T1A3E2E0CFEAB8067AC5C843B549A10C9D21244C8685C9F3375B2A76974A730E5F3E8ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709895752, "uuid": "6dbe78e9-3bf8-4e5c-8ed4-783f4400533f", "value": "768:0Gvb+A02/mHlebzp2F7Ti2r/rucYVsx+pGVKQ8:0qoHQbIhJLrucYVayw58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709895752, "uuid": "2b605a0e-1c73-4421-b01c-0c8ea342d0f6", "value": 31784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709895752, "uuid": "cccb5ec3-698f-4f71-9bbb-be01e7c0d7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709895752, "uuid": "4a3c0233-f84e-4a87-8c76-4ded2c8e981e", "value": "81f1d926997c0ca58d85173e02bb07c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aed92fe-dd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709934806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934806, "uuid": "bf5dee71-e97c-4849-9945-bef87ffc9708", "comment": "Malware payload", "value": "3fe2fb1e371d879f826b53ff9f2e21ce", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934806, "uuid": "0238211a-d8dc-409a-83a1-3596172ff0b1", "comment": "Malware payload", "value": "65a0f2d03690ac43dfb2c3a758d4e021b1832478f443a8be03e8538a38c05352", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934806, "uuid": "a396765c-49ca-42fc-9268-f85fcd184232", "comment": "Malware payload", "value": "d7646c760d45b8df26a4d2fee4cfb5dde21d861d", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934806, "uuid": "f3859756-8c49-4680-8227-af1ccfb1e133", "comment": "Malware payload", "value": "69f3a0da4bf85a8eed32c354034fd80f8e10e861f3450c40d1631908f4b867149def773a82ce7016366d61da242890b1", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934806, "uuid": "e47ef7d9-f43a-4069-8350-9b1830f75346", "value": "T169D6AE60BF945AF9EF8D1E3E905AAB1CC7F042172D32706BFA415F05B9DA146810B26F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934806, "uuid": "6c661523-d0c4-48a4-aac7-f00a461ee7f2", "value": "49152:Z4Whi6ikPpLUuqA96t73Qn0KxCmUlPCflJztD:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709934806, "uuid": "114410b4-1100-42c9-9242-ed36acf874b9", "value": 13631488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709934806, "uuid": "59bccb28-a2ec-4213-880a-0203158b26b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934806, "uuid": "8f009cc0-1878-42ca-9873-6360aa6574d3", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd4d7bc-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935647, "uuid": "aec37fa0-4f0f-48d2-a9cf-8d5d93721374", "comment": "Malware payload (Mirai)", "value": "991d009ddb370b4c68dc6359e2514253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935647, "uuid": "923a7de7-b36d-4749-a6db-8db2633282c5", "comment": "Malware payload (Mirai)", "value": "6761c406da3caba20c44b2f678666e51e9aa2dceefa953eda77f07a372cd4613", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935647, "uuid": "e083bec9-44bd-49f8-8cba-ad2f9c24bd20", "comment": "Malware payload (Mirai)", "value": "d7f527ab1206ab3372a907d8439658a24b999200", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935647, "uuid": "a42e824a-0c1d-49ba-bc56-d5287a0ad973", "comment": "Malware payload (Mirai)", "value": "f3f1f6882f835c6712a55b9cefb8395d2c0dfbb3b01e26ca725d225bf4c7d8bee8e04164b6eeb4d5c5675e69ba8b9aa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935647, "uuid": "77731fc6-fca9-4a2d-964c-a44d1fbb6bed", "value": "T15C336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935647, "uuid": "0e1fe768-3b4d-4491-9092-5fd96601d49c", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935647, "uuid": "e2397497-4b02-4a7e-9758-55008d74b749", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935647, "uuid": "709aff80-78db-4abb-a8ee-29b9cf0eff21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935647, "uuid": "47bc0002-6b64-49de-9ecf-e630b715bef4", "value": "991d009ddb370b4c68dc6359e2514253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c3e2c5-dd2d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709889625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889625, "uuid": "2550062b-b2ee-4208-800d-1c67ab18df0c", "comment": "Malware payload (AgentTesla)", "value": "1f055711a5f61041fc70c771ef852754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889625, "uuid": "91d1a8e0-0788-44b6-b74d-d03900b42a56", "comment": "Malware payload (AgentTesla)", "value": "68864134a67842ac2f863dfd92ec6ad6567571a436663b0bceda9e2ef0222de2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889625, "uuid": "26c3fb65-5bdd-4afd-ac35-2f6707b04373", "comment": "Malware payload (AgentTesla)", "value": "0db16ed37a3f2bcb694d39e3e7e3247dea466ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889625, "uuid": "d7656672-eeed-4ce7-b7dd-ae872382b36b", "comment": "Malware payload (AgentTesla)", "value": "a388f065850f1c5e160e04c1bcfa89bc465584bfdfa45ec57922822d4f321242a7bf288720f073e7022ea86f73a25896", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889625, "uuid": "dffe71aa-8882-4cc0-bc2f-0cfd815507f0", "value": "T16515CFAC325079EFC46BCD769AA82C64FA6134BB530BD243A01705EC9A1DA97CF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889625, "uuid": "4c282fb0-6fb9-4c0d-846f-4c217639327c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889625, "uuid": "2fd87e50-bf84-42e0-b7c6-a5ffb3b7ac8d", "value": "24576:89dF61Falig8mrEByYvZBBGT6KrLx1Y+:8hPX8mrQjvJGuKXx1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709889625, "uuid": "1be53118-f1c2-4257-bb44-2b3e987549c3", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709889625, "uuid": "d9929d14-7f12-4e3b-b098-2916b8951f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889625, "uuid": "240fe8f4-5aea-400c-a21e-5b65808506d5", "value": "SecuriteInfo.com.Win32.CrypterX-gen.15427.15535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b20f5c2-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898702, "uuid": "bde57e4d-f74f-4f27-94d2-a8c225b9b209", "comment": "Malware payload (Mirai)", "value": "1dad61b7679cf8c033b9198caef53266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898702, "uuid": "9abde272-3067-4c77-9d12-c9ba6e9e7c98", "comment": "Malware payload (Mirai)", "value": "69ad14da359592a14a80fa5706e6eb73e99f7b1012656bea562f12aef5d48d01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898702, "uuid": "7ac4cd1d-9d4c-4f38-9a2d-be668c26be46", "comment": "Malware payload (Mirai)", "value": "18922dc4aef6b0b378a4e4a4e2c2803fa8e99a9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898702, "uuid": "5bc6dab0-030e-4f0c-b374-a71353212525", "comment": "Malware payload (Mirai)", "value": "d477cdb0c8509d098da4a80e2b930356938cb196666de7675b135e1473d03928777b350600c2fbac43f9c3662c119646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898702, "uuid": "d687b8f8-7687-4c80-9929-e5a5c4f2c7a8", "value": "T190431A86F9C18E15C5D8137AFA2E018D33236768E3DFB3129E106F60378696B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898702, "uuid": "bb4f8727-1a4e-4ecc-a5ac-2a6f98b44ea9", "value": "1536:TJnk3+qjTiXO0gHQWD6a6t36BYgJqyzdIcifIIakv4id:V0Tr/Q7tRfBakv4id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898702, "uuid": "08f1a3c5-eb49-4128-9146-fc56c769bdea", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898702, "uuid": "73fe84e4-273f-44c0-ba6c-24949c41f374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898702, "uuid": "e9fa3f06-ba4a-471c-82db-8a90d382843a", "value": "1dad61b7679cf8c033b9198caef53266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9d57aa-dd7e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709924531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924531, "uuid": "462941a6-6d02-4d87-bc25-6f395620369d", "comment": "Malware payload", "value": "9f8eee2c2096fd9c78488d71af45e59a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924531, "uuid": "b3c85ed8-000a-410c-9fc9-dcd70959d700", "comment": "Malware payload", "value": "69c3a92757f79a0020cf1711cda4a724633d535f75bbef2bd74e07a902831d59", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924531, "uuid": "91306a2c-83e1-499a-b112-7cede508ea62", "comment": "Malware payload", "value": "8a9798dc659ffb0c010a33cfcdb59d588741ed5c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924531, "uuid": "0a4bde6f-a975-4f03-8c3a-49a49a67e7ca", "comment": "Malware payload", "value": "9d22ce8df872f750bb000f8f064186d6eb44e052e523cc75bbe15b04f8df7361ead95cd7a693a918dbe036722c7ac126", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924531, "uuid": "cb04cedb-596b-40c0-b4df-dcfd6b29cfff", "value": "T198272A03E8E601D8D4B9D67489624232BA31784C0B7963DB1BA1F7642F777F05EBAB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924531, "uuid": "01d9771d-2ba6-4248-a640-29497c679af1", "value": "196608:F6U0oQCpWD0gCLm+CaLmPtL/8DDy/C25mjrhUXGyby:F6U0oQCpWD0gCLHmPtLEH2CWmXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709924531, "uuid": "527de0f8-d13d-4c21-825c-ab62fdffc075", "value": 20807680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709924531, "uuid": "0db84e0f-83e8-4c09-9c27-14d43646e707", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924531, "uuid": "4f6bb235-0d45-4532-824b-993fc599766f", "value": "invite.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3cd7eb-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874977, "uuid": "18900311-696d-4d81-88da-5fd0b98636eb", "comment": "Malware payload", "value": "96be70f49cecf63d58f3e7550d6b8937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874977, "uuid": "62c24f91-5fa2-44a1-ae87-0c547da408b5", "comment": "Malware payload", "value": "6a5ac2d3cf3962f131389ac97e7d6f14661a2ead5f30870d7c6ba8bcc639e064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874977, "uuid": "1d252dd3-a967-4dce-96a4-e4fd125c7033", "comment": "Malware payload", "value": "6e72106507d29044c6d7ab4d167aac4f2f0f5e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874977, "uuid": "589a9a5a-bad1-4e5e-9275-fa84580f4a47", "comment": "Malware payload", "value": "7da7b6c87425765d44043200432ca66fd809ab01ce63c84481b140d780d9508bb71478d956ea98537433535fdacbcd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874977, "uuid": "e566d707-cb56-47be-b275-2eea682e6439", "value": "T11BE371076784CCA4E26246B9891A47C185667C0077B0FE9B52D8B6ED0BB3FF1D96B343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874977, "uuid": "2cb2ad8d-227b-4f0f-9b9b-d61760ad3e41", "value": "a61c6a7c70d96521c2bff14915509046", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874977, "uuid": "ea7a68c1-593b-425a-9dda-552f85a9efd1", "value": "768:IfS1awdxV7QsvUWvePJRlNhSP002z62hCRKncffMo1XgjCCpFpYlvVXavy:IK1xmscPJ7NhSP0046DR2QdwjNqBaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874977, "uuid": "976dfba6-fe7d-40cf-bd8f-7d0940465f76", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874977, "uuid": "8789646b-23e4-4eea-afd1-8fdc2c540181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874977, "uuid": "0c2efb18-7bd5-413b-932f-72bb3650f777", "value": "SecuriteInfo.com.Win64.SpywareX-gen.14130.30332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cf290b-dd48-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709901384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901384, "uuid": "dcfd855e-034c-4a19-9033-1ce64466adef", "comment": "Malware payload (Mirai)", "value": "0fe62f916f961c69d62222fb628adba9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901384, "uuid": "f100bef9-ff54-4250-b4cb-d8c771c85344", "comment": "Malware payload (Mirai)", "value": "6ad2a04d452ea27227829ae8ba4addd73ed2e88221869d4c99e2a4581f88c4b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901384, "uuid": "41b428cb-4d20-4424-bcd1-7a0a5230eff8", "comment": "Malware payload (Mirai)", "value": "488cdc206cc1fe2b9aad91a31f67d3356750f073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901384, "uuid": "bdc937b3-6ca5-4df3-b0fb-3ee97ff1b365", "comment": "Malware payload (Mirai)", "value": "e426d0849fdbb3871974dfbf75f246b9f7bb314bdc59fef6707772c89b99a9bd37dc8fd62920f1c01127176b81b10178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901384, "uuid": "02639f49-8bcc-4148-8ba2-22ea43801455", "value": "T175434AC8E5439CB6EC170930617BAF379E72F1BA1294ED43D7A89972E961701F501E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901384, "uuid": "e20a200d-9e85-4e2c-a179-25214a44e05a", "value": "1536:UC6rteLpLWz2Dj0bg3q8N4dxcSQZftD332SXn:+rteLpLWzG332dxbQFZ3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709901384, "uuid": "7bda89fc-6651-4b33-8f76-2d81e45d1f62", "value": 58576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709901384, "uuid": "9cdef32e-1641-4ae5-a22d-7b95d788bae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901384, "uuid": "045732ec-5232-41c8-8517-d72230c8a1d8", "value": "0fe62f916f961c69d62222fb628adba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b03ff6-dd68-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709915089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915089, "uuid": "08cf3624-6322-4e05-9915-525a78371fdc", "comment": "Malware payload", "value": "05af13d309d2ed5f964377919962061d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915089, "uuid": "641533c5-ad67-42db-8e4f-c61b1f5828de", "comment": "Malware payload", "value": "6b6c3c21922ab9ef325a9f8b9c0d528fd516a85e8c26978ffe7d1744c9063488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915089, "uuid": "025c967a-4bcd-4cf9-ace4-ade7349c872f", "comment": "Malware payload", "value": "7dc440bcb1e8f17229f109d3603912e69824c7b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915089, "uuid": "eb365f33-44df-4a85-8afb-95a45c1183c8", "comment": "Malware payload", "value": "a96b69988991153ca89b09673c325e5d14f9280619c1bb03aae8656dc4a7c02cf6517a3c9195f51d8dfe6b2b885d3f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915089, "uuid": "d18f567a-6de3-40e5-9dad-40f3d289884e", "value": "T1FFF4125133A83FB5F13A47FA5072645567B2B51A1822E6CC4CD3A2EA2672F408F31F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915089, "uuid": "2fe2ab36-b45c-4abd-bc4f-a43e26a6bdd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915089, "uuid": "2e58588e-6f35-4f54-bfca-628575070cf0", "value": "24576:SF61FaliIeV41uI/JSney56A57PY/btFn7:IPtXJmV56AhWZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709915089, "uuid": "6ca58fbe-93de-4518-853b-12e9a0ddc509", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709915089, "uuid": "69473704-b161-4b08-8919-d55148432e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915089, "uuid": "64afe861-abbe-43f3-9cd4-2108426aba32", "value": "SecuriteInfo.com.Win32.PWSX-gen.10639.26376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61f3ad8-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917001, "uuid": "823a5245-cd07-4ad7-8e2f-d35abda2053b", "comment": "Malware payload", "value": "618e0dfb4076b3e2dd666531eee5855a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917001, "uuid": "91195162-2f57-47aa-a9dc-4c5832833b2f", "comment": "Malware payload", "value": "6ca582014335bdff01256c314e8141c2ae1bf17a8b6f9b2924f2ae92a390078a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917001, "uuid": "0815d837-75cf-47d5-9e22-6d04287694c8", "comment": "Malware payload", "value": "4b1aad7648aa4d398f84d7522f2aa83cfe4a01c6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917001, "uuid": "1f64324e-affe-4cdf-a403-4e173e66d962", "comment": "Malware payload", "value": "d4043c48c6c1644631cc52ba393cc8026b84b3115d111109b3a8ec14420aba04749197672248095c95c36160bb9b68dd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917001, "uuid": "4d56d3aa-6a92-43a2-881e-ec3c6903cfa2", "value": "T1DEF31280535E46F5D38A6238918DB0FB8794B6A7CBC696326929BE7CDD18D1F4310E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917001, "uuid": "09b54440-2925-4ba9-9208-437a8e55eb63", "value": "3072:4iHllSjYBLiRzXnsYXzelHfzofoJ9j2Ffh0z/IRHKOtKu:vUsYXzQHcfWFMf8/IRHKOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917001, "uuid": "63a051b2-b4de-48d9-9791-b761a0a2fa52", "value": 167101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917001, "uuid": "3c7df552-ca50-47c9-b244-215779e91be1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917001, "uuid": "5f95c8a7-21d6-40da-bfa9-053934959825", "value": "DF-ST-1362-05410_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eab7f6-dd92-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709933046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933046, "uuid": "78fb469a-6431-4f63-93b4-c5c04d663bdc", "comment": "Malware payload", "value": "5a87656665cf39a51554aeb01dc63d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933046, "uuid": "3f658ef4-c269-456d-8d7c-c8d1190b6565", "comment": "Malware payload", "value": "6dd44aa0c0bac83628bec02c0e6c0880b9f2645f33f404f8f8236e1042ca0c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933046, "uuid": "8946e9d3-82cb-438e-9f49-8183dd438344", "comment": "Malware payload", "value": "ea1de0fc4f6a5c75ebe1ef837eadaf93d25692ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933046, "uuid": "e80c370e-7abe-4a3f-9386-6f26f76342d6", "comment": "Malware payload", "value": "13d3b920983911b703a94e7168db9a1917e3c8f018fbe312f0b379888fd4beb702020fa28c145b4a75c32ffed7bb57a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933046, "uuid": "a2238ac1-755d-435c-9bf1-e7c628579a9d", "value": "T1A816BF13F8804561F4B3007696395BB55EBEAD3833B9A0C36FA478A94E714D1B63E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933046, "uuid": "63c089f0-aad7-4512-b3d7-821055fdf43a", "value": "ca490746841e4f07eca31efa3509f348", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933046, "uuid": "f8da452f-f969-4e6e-97e5-0e9dc2a6c030", "value": "98304:dw2CYJJBGb5A9dGpQkiSNEVA0qss9duaakQrBd:Kw0ASCcIm9duaMrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709933046, "uuid": "a1f2e757-d6fb-4b32-b743-a1d4e87ef1a0", "value": 4275384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709933046, "uuid": "4ca8f593-124a-471d-83aa-531091da62e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933046, "uuid": "4ac1a602-c662-478d-b51a-0dd5baf8cd7c", "value": "SecuriteInfo.com.BScope.Adware.Softcnapp.31344.28361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376ec567-dd60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709911581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911581, "uuid": "8c4308c4-7b46-445e-9c0d-a7f306bd0d46", "comment": "Malware payload", "value": "05c4ef254f27409fe5e1fa39d008d51d", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911581, "uuid": "5bdafef7-35e9-4293-8935-b3c4d883e4d0", "comment": "Malware payload", "value": "6e2f9d2929d46eadfe201373beee2afa4bef0b10c6e0a0926c734870e91d7c94", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911581, "uuid": "ec092ada-288d-41f2-855e-7922d8c2b3b3", "comment": "Malware payload", "value": "65f6344a83750c77956475d7cb180b7c16e3ab77", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911581, "uuid": "62ddbf95-07ab-4840-9734-90cfcca81461", "comment": "Malware payload", "value": "5ba27398f461484754c05448d2c41b86991005542a3b03e703b80f6788d155990d4ff8272d8f67c91e66956cc77179ce", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911581, "uuid": "69ca6472-dc59-4f0d-8bd9-6d672e3bdee6", "value": "T130C4E0EA15369DB9FC290CB11C6645FF6E22AC326F3B8506239E7192A43DD3D790D630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911581, "uuid": "48d0011e-e0c3-475a-978c-6ae5769a2f8a", "value": "12288:zNO3fk41oX/6YXSByfnk2ES/Ls2MttJFXg:zNqfk4qXNXwy/kWsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709911581, "uuid": "a48e642a-94a8-4e0b-bfec-af2f1c7fd606", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709911581, "uuid": "26e7322d-e6a8-4e78-8ddc-427c7b1b8981", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911581, "uuid": "da48eb59-1211-4446-9068-7bc5eaf33ab2", "value": "nPAGO-0003.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4013bf-dd12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709878358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878358, "uuid": "cba1cb56-c495-4089-a0f6-546734c12683", "comment": "Malware payload (Stealc)", "value": "526bd234e4ab74f672370f499f2f84df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878358, "uuid": "efe30ef8-7688-4e50-b0cb-132bf30666eb", "comment": "Malware payload (Stealc)", "value": "6e49a43dbc2c183684bd70e83d09486e41653c439bd0cc85e3c91f1392c7edd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878358, "uuid": "385544f2-0337-41ae-a0df-409ca0399406", "comment": "Malware payload (Stealc)", "value": "f389c08a33a868cfa9be7e8d3ed66aceabec4bf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878358, "uuid": "78fcdae8-4fcf-41a1-938b-437cb9c95cbc", "comment": "Malware payload (Stealc)", "value": "a3b76fd5e6e8af5d52d78857429a3373365193cedc6594763a325703411c3c1f7e20d77a2e35e7babd9308f7c788ba96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878358, "uuid": "266c96ba-4105-4427-9745-cca49dcfd709", "value": "T12C952309CA5A78B9C1E61C7A4327E33908764E40055EDA71EAEA3D33FD7A7D089D2353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878358, "uuid": "589f9bee-7ea7-4bf4-9e35-a95268a0d679", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878358, "uuid": "956a120b-040f-4f1f-b375-010bef1fb894", "value": "49152:tIiiK2SN9Gp+55TtJNPNMz4aHO5D9nbsrkovV0xqCuAASB:qiiK2VA5TtRMpSFovV0xlutW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709878358, "uuid": "68cafc3d-fdf0-4594-986a-0366a162cee4", "value": 1907422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709878358, "uuid": "334cba8d-b47b-44b5-a693-f606327955ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878358, "uuid": "75cc0e0d-13ee-41c2-a0f3-bc78b8f1a89e", "value": "526bd234e4ab74f672370f499f2f84df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce36a914-dd26-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709886923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886923, "uuid": "edbbfea8-f4f6-4fa9-b290-e1f66ac0ec92", "comment": "Malware payload", "value": "da8d4e4d894edf19446ce9f76f045708", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886923, "uuid": "9aaf431f-6b15-4546-b727-c7fcec099ed8", "comment": "Malware payload", "value": "7072297b018300c0f1d432ac4a7e98ebca34c9377215a55b1fd186551fd6b2e9", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886923, "uuid": "2f673f5d-0a11-4ce6-b31d-fd58499442c9", "comment": "Malware payload", "value": "b1fb024d8ea0164ebb3aa1a4e559daaa0de2aae1", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886923, "uuid": "7ff62a8e-01c3-4e7d-bc9b-7e0d17c7e7b0", "comment": "Malware payload", "value": "9ba0013f5f7e30f71e17c9123f8eb006b81d0f7b44229d7d6d3ffb711f6800d9fd3a4c341eba646fca2d9c01139e958f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886923, "uuid": "82b06179-2f42-40ec-9453-59644add9f15", "value": "T15F61CF932151B8EA015283BB3D4D6AFA807FC224964A6045FB8C5F9DF9DCE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886923, "uuid": "b1167517-c803-40a1-8e68-e92fa93d3bb8", "value": "96:1Gt3ehFqfuSgkWFNgQfh5L0HZmAiBrVM1v07:8gFLpFwHZmAiBrVl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709886923, "uuid": "d00c6162-8ba0-4484-bbd2-cf218698c0e1", "value": 3227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709886923, "uuid": "e43cda21-7607-4f6f-9f11-8be45b9bb6a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886923, "uuid": "67978d73-c67e-4eca-b6f1-e7051ecfe2b0", "value": "VmAvKHpu.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51faf91-dd49-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1709901967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901967, "uuid": "2b014ef0-5900-45e7-bdb5-d5240f19ad22", "comment": "Malware payload (Amadey)", "value": "0c5a6ac5a684ce67c4078cbcccda8f0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901967, "uuid": "d2d65fd1-1044-4f83-9f1c-44bfa8c932bf", "comment": "Malware payload (Amadey)", "value": "7169c5e538e3665b5f819b43c07463ba1530be749e0c7ff119f7f25ad334c2d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901967, "uuid": "9a1e7304-327a-4dd9-a14d-0494972256e5", "comment": "Malware payload (Amadey)", "value": "fc71e6de341acad8bf063c882768de1bf93c82a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901967, "uuid": "88c584ec-7dcf-4e11-84e9-100a1ea85948", "comment": "Malware payload (Amadey)", "value": "a75ca106ee0659f1e31f717578939479bcbb99b56c57a40648030abaa2bbc30dffbd31133ff2dddff03c71904d419b42", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901967, "uuid": "fd07a9b4-2ba3-44fd-ba13-dbe5598ebb8c", "value": "T1388533B99C1B9476EA8CC73BC58E44FD6379B02B0994CC74995C00751D83AA93E3B6EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901967, "uuid": "9a881136-e62b-408b-a80d-be910172747d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901967, "uuid": "6e6e5980-562c-4994-9272-739c4c3bbc6a", "value": "49152:dy+mq3WXmKT8Z/W9+HWVVIxJL7E0rS7rwUhW493fNrZnclYlb:0hKWYZG+HWVe91SXhWi3fNlclUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709901967, "uuid": "01d46c2d-1c24-43af-83ee-fc427a161e70", "value": 1860608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709901967, "uuid": "58a6b0d5-c4a9-4842-a736-e403de13dffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901967, "uuid": "bc44f8fd-49c1-476b-a187-92bcef655243", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24969.13070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cd8e3e-dd63-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1709913126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913126, "uuid": "90239bd1-b98c-4280-a808-a17f9e6a1e24", "comment": "Malware payload (Glupteba)", "value": "14d9bc0b9f3dee44f0227d2507bafd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913126, "uuid": "2462f622-e608-4a9d-ab76-3029404ea956", "comment": "Malware payload (Glupteba)", "value": "72a837998880c69dd67cc7a3fadeb410994b521021e31c832c4196c2487a95bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913126, "uuid": "15ce8b51-5a25-4b83-b4d7-92c16a9217f3", "comment": "Malware payload (Glupteba)", "value": "b5f60260fd65ad2805e4838a7c8886cc2b00fc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913126, "uuid": "654af9ba-5e65-4b85-9c2a-edd68bab80b6", "comment": "Malware payload (Glupteba)", "value": "282a900aad6da9eaea0f3b250e218578d767c29d926157691fcf35dfc20801f58e98b462fced57ca244f396647365649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913126, "uuid": "88766e6a-3df1-4e20-aa7c-bcff3780fa34", "value": "T1E6163387755D5436DE5EDCB20630DF801373F9AAAE3CA90C12505387DEA298A3C7A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913126, "uuid": "b319e678-2344-4754-837f-a9ad8cdd34a9", "value": "0f784335ad313f6e2411326700555ccb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913126, "uuid": "4852d7e5-48fb-4eee-a75a-b906633f1a93", "value": "98304:9OWaeAJOPT9S+4HFgiiv/wTmbb4m0WW4J2fOdRWgUmkvjQgCJQAXCY:ch6PT4l+QTmz0h4J22dktmyjvWXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709913126, "uuid": "252ea3dc-2023-4bdf-8ecf-e216b4e710e9", "value": 4279168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709913126, "uuid": "d7725f37-1c88-4451-8950-61a2e3f18a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913126, "uuid": "b873dfc0-cc37-432a-ae3d-f6d3c6a070c3", "value": "7bazx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b58168-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917004, "uuid": "269b9d8d-fe3e-49b6-9bc5-4ce39acb4e45", "comment": "Malware payload", "value": "bb9e0da605aaf0baabe20a76101dee44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917004, "uuid": "101c910b-48d8-485c-8814-609443892d15", "comment": "Malware payload", "value": "7302e2d9a97c96e177f6bd35a6d60acca1071583c10d2b839b574e7f5d616456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917004, "uuid": "e687fa47-f35e-41c9-a1a1-4dcfd1434982", "comment": "Malware payload", "value": "12384689d14cdab14672b08d7172b0eace5776d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917004, "uuid": "754f8d65-f584-44db-bd8b-2ce019219c17", "comment": "Malware payload", "value": "5490aa7b2d7ec0bab8f1d31ea3bee7ef123567323a60ae9984ac3a1fdb77d49c45fa02d7ccc8c913bae8250ed586c9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917004, "uuid": "be10be0b-d9df-46ec-baa1-0a242aafd44f", "value": "T121740423715EE892C44647305F3BA527EA096D287D70F6CD2247FA6A5BF1DC3B012B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917004, "uuid": "fe9f3d0d-4eb6-4926-a19b-c135ecf6fb41", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917004, "uuid": "d31b6efc-d032-41f0-9d41-162a21e2f06e", "value": "6144:NfL+oqGsfJvHAnYXzQHcfWAGf8/aRxKOc:NfLzsfuemc+AGf8yR4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917004, "uuid": "de09f8dd-2077-41a3-ac89-7ea1165ac0f4", "value": 339754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917004, "uuid": "c5738913-ef29-4c24-bf05-46f928747b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917004, "uuid": "466d9aa3-6c43-4de4-a350-74de6bc8ef89", "value": "DF-ST-1362-05410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d964f7a0-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917006, "uuid": "306318da-6119-4d71-b231-902f4ee6e7db", "comment": "Malware payload", "value": "d1742bdd21b1a5c52fd9e0aad78eeb5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917006, "uuid": "4deba022-ab84-4db4-92bf-c5377b0ae0c5", "comment": "Malware payload", "value": "73886f125cd7e739c91b6f61891b5da00a96b95de609df48a4097f5fec6ea4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917006, "uuid": "61f69172-946d-40d1-8f8c-7caeec77e2d5", "comment": "Malware payload", "value": "9397716cc8139596d5ffd32a594499fc3f6deccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917006, "uuid": "0126b1dd-2751-48f0-beec-97c03e57132e", "comment": "Malware payload", "value": "60a1e459d6674f50288bbc3f46ee1c6baee1871e882d0c512ec19cc1ff6e0be26d0a1d6b4f3dd2549ba61d6fd27b3334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917006, "uuid": "c79eb188-2f60-4e3e-8e99-1e57597cb146", "value": "T199B5F188A3450D32F1BE1AF748EC2134A36ADDD2A7C5DA09E48C7895277136F89FE507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917006, "uuid": "e3600773-bfc6-4e96-b691-0d479e891f02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917006, "uuid": "a869b92e-70f1-4c1a-be0e-eaec5cc2fb3c", "value": "49152:AieQsDEoDDtI71pHmvYiWcRXzU+f0jefUYfETczAN/R7S3MB:wRqjHmvRCjefxiJxS3MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917006, "uuid": "78926c1b-18d2-4c5f-9352-6f3568cb6ce5", "value": 2432000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917006, "uuid": "093de818-b657-4d23-b9ef-d16edb141b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917006, "uuid": "97664e3e-2f16-453b-a2f9-a61404cad635", "value": "IMG30136711080pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c79a2d-dd7c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709923906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923906, "uuid": "639c4ccb-8eca-4e9d-9203-de871f46d66d", "comment": "Malware payload (Stealc)", "value": "eda757c6ae24693068781c06550cb3a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923906, "uuid": "e16ac35f-db7f-40e5-b55f-eebfff2d60b9", "comment": "Malware payload (Stealc)", "value": "748733ef6b3518ec18acbf68a3fa7f43e403738a29a275d6cb2df8e87851c277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923906, "uuid": "caa02077-563c-441f-a352-e29e8c75b8e0", "comment": "Malware payload (Stealc)", "value": "026eff85b267da853dac6cc00866bd1cb1c02c4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923906, "uuid": "210bdd3f-c6ce-4e26-b058-240fffeb0973", "comment": "Malware payload (Stealc)", "value": "c8f8e5b7a622814d787013e758a1361aecf2c614698628641d4502479f52fab0196f9f9d28e995bb9249251032084291", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923906, "uuid": "76673321-32e0-48e7-8196-2665b25cbb78", "value": "T1E934BF1922B6ACF1F9663D7049B2C6E01AEEFD425734069B1254293F5EB07D04A7E33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923906, "uuid": "c17f717e-2903-45da-b064-f0f8ba4b9b4c", "value": "59c8dd4ac2c97748fa2f414e5bacf8da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923906, "uuid": "9fcd559d-094a-4c88-8c81-a406f1543df2", "value": "6144:/4qdvcItHrBhjlf6R05be5BlXE0tvi7DDu:BRcItHNCR05Sji0UPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923906, "uuid": "afd18e81-e77e-4493-aa58-ff5356227056", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923906, "uuid": "f98fd358-9856-4c07-874f-58502aeb6374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923906, "uuid": "2b417b0e-95f9-48bc-bad9-7ab657a8e9ca", "value": "eda757c6ae24693068781c06550cb3a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68839470-dd25-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709886323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886323, "uuid": "bb677ece-0d28-4f4f-ab6b-28877f3d479e", "comment": "Malware payload", "value": "06774cc5d55b3d64c392510d163c524e", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886323, "uuid": "3de176e3-5a83-4d03-84ca-f22f8ac5a34d", "comment": "Malware payload", "value": "74aee342201d218a640fcc57974cb713e23ca05e6e74111c35bb797de7390028", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886323, "uuid": "95a38674-a06b-4e7a-909c-db83287296e0", "comment": "Malware payload", "value": "b9d2327c087fc15464ebda1aa685b7a6a4ccbf01", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886323, "uuid": "fa66cc32-2bff-4050-8085-5d85dce34eed", "comment": "Malware payload", "value": "26651be3290cf84d0a203dc9413f90a87c8225d14032e600e245a0b82afcbf15f0c213f0ad7563a2240294758698f62f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886323, "uuid": "33f0dbc5-0680-49e1-a5fd-49f8f232ea38", "value": "T10F617E932151B8EA414283BB3D496BFA807FC264954A7044F78C4F5DF9DDE633A8E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886323, "uuid": "e0235141-c23c-44f8-9934-7e4cc1d8fd99", "value": "96:dGtv73/HuSnW1jCQfLhL0HimAiBrVM69j:Ez38xmHimAiBrVVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709886323, "uuid": "bad38935-030b-4bc9-874e-39dd463e984b", "value": 3223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709886323, "uuid": "32de52b8-196c-4ed3-9237-977ab1c80cd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886323, "uuid": "fb5fa137-10c2-4226-afef-4e8c09e5dc1a", "value": "jG8hDcx8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d884cd7-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709923322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923322, "uuid": "32545d52-c5db-4d48-8c89-3cfe46d1a3c9", "comment": "Malware payload", "value": "89f2dbf53f31b015d8cbc89a9c5de572", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923322, "uuid": "f568e2cf-6bbe-429c-b058-fc4d83769a74", "comment": "Malware payload", "value": "75444ac90b43406484a3e2d4e28c94baef639b99cfac69b29d0915eeb5fa33d6", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923322, "uuid": "8577c6a1-dff4-4648-8296-a031715496fd", "comment": "Malware payload", "value": "881abbdba6a81d49c68f86939eac29bc0aba8d0c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923322, "uuid": "cf751579-451a-4ebf-8d61-4971667f57f8", "comment": "Malware payload", "value": "d7e03cbb28442fb7ca405dfcfef6e89a09600af1e70b800e3cae03d43c7739507879623a57087319ebc9e3141ed33e79", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923322, "uuid": "193610b1-cbdd-470e-87b8-88e985281284", "value": "T19E647C1A76A804B8E877C53DCD575902FBF678164365C6EF0395832A2E273D1AA3FB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923322, "uuid": "c1dadb9d-1cca-4e3f-94d1-3b788c9b6b28", "value": "dff34869bcf58e230758f2b7b4f22420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923322, "uuid": "460544e9-c9d0-486e-aeaf-7b47fe54b118", "value": "6144:PjNDFUvHGJbeyNF203FDpUaXCWohXUekJl4:PjNXJbflDpro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923322, "uuid": "de115b3f-1718-41a5-b6c2-fe2c5a880ad0", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923322, "uuid": "f85ab12a-c09f-4bae-942f-d7efde555071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923322, "uuid": "6c18c1ad-805d-4be3-a5dd-282e1166cec5", "value": "x86 -MpClient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e32333-dd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709934716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934716, "uuid": "c4e30e10-07bd-4e9b-acee-4f1568309403", "comment": "Malware payload", "value": "6f9a4373cca599a6b4d83408b2355da0", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934716, "uuid": "b6860796-bec9-490f-8992-e1b74145189b", "comment": "Malware payload", "value": "760347b1f227e8f8daffe612f026b63dd77abeee26b1787b8feea9a66707e2ef", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934716, "uuid": "78f6bb40-64df-4a75-8afb-4f5c458f44d0", "comment": "Malware payload", "value": "5b39bc5ed6417f0d2bce187c1a647ae2b1edaac1", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709934716, "uuid": "f7f5940d-6495-4c76-9912-f5c0eb4cd406", "comment": "Malware payload", "value": "f7767c61772b2f7141572b16866322224388819efe47de92658d77a1b2210093747959a2542355c73dae3a2d44efcfb7", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934716, "uuid": "09e9aee9-a0c8-4855-aa10-07087b7d39b8", "value": "T12323C02BEE33D7001A5011B63BF900A5A74EF5DCCDAE4DA7410FA264505D17ED8EA9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934716, "uuid": "9986d52b-e1a5-4d0a-8581-967309e2b28b", "value": "768:9ZHrKSM35/66nOW/+EGHDisP/6MwIpCA3JqCVH1McuBSqFZUjIsi0RL3h3hrvuAF:9ZHrZMx64NGHDLBvCIJb1McuwqFZUjuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709934716, "uuid": "87e9fe94-d34a-44d6-beff-7c9de6c4738f", "value": 46243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709934716, "uuid": "f923002f-b9f2-4b98-93f2-e2ed0e89bbae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709934716, "uuid": "67f7c5d5-0938-4077-88ef-0cf8575b20e7", "value": "windows.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511ca87e-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709908188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908188, "uuid": "3096b2b6-2e1a-46ee-a065-f82e851dca05", "comment": "Malware payload (Adware.Generic)", "value": "a3a38db6f62269ed7cee99fabb676135", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908188, "uuid": "5b482703-6911-4d0f-8204-18bdd09f0f83", "comment": "Malware payload (Adware.Generic)", "value": "7640282150d51c407ffdfe2fab35f2c60b93b0dc56ac93ad2459b16789aec61b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908188, "uuid": "93938233-2e3a-4a3f-a58e-09f4980d48f2", "comment": "Malware payload (Adware.Generic)", "value": "39f4958ae7481b2a3e7452c2dffb648ea5e200be", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908188, "uuid": "0bf56be2-1eb3-44a1-b79e-0a223655e06e", "comment": "Malware payload (Adware.Generic)", "value": "e54d6c6288faa73d7b0d5c664ec569f16259ebf52e127325a6ca98360df071d277c6e141532a21ad1c80db9e21cba07b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908188, "uuid": "fc09585f-aebe-4cd0-a254-e50c0c7aaa50", "value": "T19BD7333BF298513ED8BA237205B347609E737A2125194D0F57FC3A4DCB7AA411E3E626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908188, "uuid": "ca4d0158-0e98-4a53-9d97-beaa97a9151a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908188, "uuid": "917725b7-045f-4757-a0af-f8ea7047f263", "value": "1572864:lCRAP2DnTG0r6OFxObdjUW8Odiw1NF3Zh4aNfv/VG:lDknTdGO2ZjUezFjv9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908188, "uuid": "18eec7ba-1154-45ee-b116-a60904f2c347", "value": 59530215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908188, "uuid": "af08c7e4-7c5b-45c6-ae1a-86171ffb81d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908188, "uuid": "b89330a0-5aa0-46f0-8c74-b9133fb49432", "value": "SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fe2e46-dd52-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709905543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905543, "uuid": "c2967a56-2fd5-4885-bc24-4f5ab70a6dd8", "comment": "Malware payload", "value": "dbdcdd2c51d923aa30293e14be7a829e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905543, "uuid": "abbf4ff4-769a-4ee8-906f-c6eb7e26a7b7", "comment": "Malware payload", "value": "773c087317d4fd8dc2f92144f6dda8929a829edcf7a7e80847d38fec09c88d93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905543, "uuid": "4dcbfe39-0d74-4b87-8ef9-9849ff493e22", "comment": "Malware payload", "value": "9466254f55f04134118f1f6b616007bb86d95f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905543, "uuid": "6c33349d-ae70-4391-8fc7-3f6ea24fbc78", "comment": "Malware payload", "value": "dbc0f9a08d34b2e9011fb7788a9bec1f44650d2af61372080e72bb95ccc20a1d955d13a088cd26c0b72e41d6413f9b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905543, "uuid": "41798a57-ef42-4665-9969-4298179b5ae2", "value": "T10545F7E27F69BB80E83B33706556290427F24CBA4DC4E50E64A27C53B7732922D5A5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905543, "uuid": "7b66912d-b4bb-40ea-9170-33c6edf88a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905543, "uuid": "e5c1c8cf-58c0-4a61-8342-1505a1d96e2e", "value": "12288:uiL+7/wHM6gCqCcT3ylTBkmLWSQsQqghyGEoofi+0UkoMGh5cfa1ZR2w:5L+d6gCqiPhxQsdg4GEpfi+soMcQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709905543, "uuid": "7966cc65-33da-4771-a0f2-ce6b0ecce124", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709905543, "uuid": "ccda5ef7-bff6-4367-b05c-d91897c32349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905543, "uuid": "10b7c412-59b8-406e-8fb4-926d2b4507e3", "value": "773c087317d4fd8dc2f92144f6dda8929a829edcf7a7e80847d38fec09c88d93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570289f6-dd4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709904332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904332, "uuid": "2562431d-1e51-4f0c-ac9e-b70f6325b9e9", "comment": "Malware payload (Mirai)", "value": "25bf0c3667f3d997be178361afaf8901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904332, "uuid": "1d6e97c1-83d8-463a-977f-7465723127c1", "comment": "Malware payload (Mirai)", "value": "77e23c6b719915ed2716a609e2e18f9855371b2f085d313ea09cb58ae5472a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904332, "uuid": "33bc2236-9f82-47a9-a00d-9430909586b2", "comment": "Malware payload (Mirai)", "value": "a92d2c39be6e7d702752ea99647370913054e8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709904332, "uuid": "4d30a188-a752-4d78-9f61-16c9cb2bd393", "comment": "Malware payload (Mirai)", "value": "5737c275151172ece2a007d105b56d7befaaad6e2a4bcf1375c2fb8582114376285a7b951819d71f0c8cb8ae48d9a676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904332, "uuid": "d5c1832f-f5e1-4156-98a4-faf8f19325e7", "value": "T156F2D17D1242AED9D4B255FEDBF453921E320FA59082EC032D5099C38CA787BF8579CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904332, "uuid": "361394b1-b3e7-4ffb-995e-f72cc0905098", "value": "768:ChaSTWR1YHntU+nX1fEYGP+2xoYTEeKJUC3JgGlzDpUYsf:Uruith1fEIelC1VqYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709904332, "uuid": "8667dbe9-d65e-49e3-91a8-a5a3157c9a46", "value": 34892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709904332, "uuid": "2bc6c6d0-b8a4-4cd5-8c30-b328a902e6f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709904332, "uuid": "6d9ef131-0ded-400b-afa4-3445cf71cd65", "value": "SecuriteInfo.com.Linux.Siggen.9999.23345.18758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab46c34-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932605, "uuid": "f41fbd65-d9c3-4f1e-9736-bbffc6bc418b", "comment": "Malware payload (Mirai)", "value": "42956c3d69c457cf5cb3832b802c7d2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932605, "uuid": "1b078b5b-ce42-46f3-ae8d-468172b95a5d", "comment": "Malware payload (Mirai)", "value": "785cd622e5a2c574cd7194846f60cce7cc572370d9abee208ccb1bf5d15b93d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932605, "uuid": "100b6138-49c1-4e70-a046-d5f83d83437e", "comment": "Malware payload (Mirai)", "value": "38abdb0c073df3b5f76ed1e7952e398451ed663d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932605, "uuid": "19428352-61d2-4730-859e-65e7ee2eb133", "comment": "Malware payload (Mirai)", "value": "06f721bc8616a8dfd828e9e772a8b93320bec44879a7c9da7fd4e9c7ea3ac829d42c4332439f0e8b82e5e7e8fe1b8d9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932605, "uuid": "caab9276-e2b1-41be-b4c8-72ea1a2c012c", "value": "T1D4F32A05FB508B37C1D127BAFA5B838933328BA4A7973342992C6BF42FC27995D32554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932605, "uuid": "11dbe06e-fc16-42d1-bff0-c43f511ae825", "value": "3072:RE0gbgFLuc9G0/YeNXahSLsydvIBPBvyO8UINLTufmWEYwMk+iZxOh0BdhQzvWck:XA8T6mLYfk+QohEdEvWq4sC2DqtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932605, "uuid": "c74f1bd4-134e-47d4-8fe4-9138b7cf4d19", "value": 162840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932605, "uuid": "9bbc232c-f47d-4d79-9e4f-2a8510294844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932605, "uuid": "409f3f73-ae2f-42f6-8b9d-b26229f6a89f", "value": "42956c3d69c457cf5cb3832b802c7d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbec7c4-dd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709892777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892777, "uuid": "e7a94c5a-74ea-46da-abb1-d04b400a5bd6", "comment": "Malware payload (AsyncRAT)", "value": "cf1523496e89d01c68284070a2b5fc90", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892777, "uuid": "00a30907-9633-499b-b961-a840d225c955", "comment": "Malware payload (AsyncRAT)", "value": "79791fee075bd96ba5b23c31c0c135287fb9b0de970cc06b2bc5b32681452a7b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892777, "uuid": "c648da39-9e97-4f87-89c8-a2f0d32931dc", "comment": "Malware payload (AsyncRAT)", "value": "bf27da5261427d972dd97475d53aef95ca391ecd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892777, "uuid": "1f1e924c-8a7d-43d1-9cc9-ba5ddeb48968", "comment": "Malware payload (AsyncRAT)", "value": "3ee4950721bd5b3f0f2c329b781bcebd06cc26cf114933463dca7b839964fa1603a5e6403a30396287c3c22a1ddc78fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892777, "uuid": "500217ac-710a-4be0-8fe8-485e3e34fe17", "value": "T18F63023651F88B0FE076B93685DC174FEBA716E5CC70E2664D358CC08A60FA9F9AC449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892777, "uuid": "0b480ce6-9b1d-4599-9440-3868b4c16a8b", "value": "1536:9Pg+MBG7fiIIOcD1+gyWaG7FhZL9BqwO73Z/nqvs0QaOYL:9PgJEGIIO+1xPJhN9QB73Z/nis0Qar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709892777, "uuid": "88a15d3f-fe25-4497-98ff-defd1b275ad6", "value": 72093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709892777, "uuid": "a3179311-1a50-4fc6-8f4e-6fdf6f6d4326", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892777, "uuid": "2f550a0f-a9e8-4e3d-8a0c-f752c7feff22", "value": "cf1523496e89d01c68284070a2b5fc90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b250d17-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935639, "uuid": "de554a20-3c65-4084-9d9f-8182cde0c7ef", "comment": "Malware payload (Mirai)", "value": "6b22bcfa6506a08f711148d27c4eb3fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935639, "uuid": "1c0a3331-30ae-4b32-9c59-749ba5bcbb4c", "comment": "Malware payload (Mirai)", "value": "7b538cf77e4013f2bd06cd223da47bd1c4d48a1a8970a14f7c02447e60684f52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935639, "uuid": "f426b200-c4f5-467a-8722-102095042cde", "comment": "Malware payload (Mirai)", "value": "7e5359906145fcc853f0ddca2aafb21f205890b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935639, "uuid": "349340b5-cd44-4408-a48f-c0e616687027", "comment": "Malware payload (Mirai)", "value": "14c09e44c39263448973186f525e6fb58f7c86e2aa4c49111165f88a548feba1cba9e9448afea7199ea45d3a6baf4169", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935639, "uuid": "d6a1cecd-d0e7-4f62-b7e3-58592b20de5d", "value": "T1E8A2E11572632D66F3ED1C3DC96E8317B9A71BFC80F5327669402524C90D24B2E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935639, "uuid": "1336758d-9869-4ffe-a784-9755cf21d568", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjEOhymdGUop5hR:vvQn4j+ZO5fKAlxxs3UozH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935639, "uuid": "ebf579fe-e9ea-4c84-b3bf-121fb38e9feb", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935639, "uuid": "2f0aeeae-32eb-484c-b7fc-40a58de9ae7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935639, "uuid": "4f6d3979-bf95-427c-9b7e-601da6eeed61", "value": "6b22bcfa6506a08f711148d27c4eb3fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a83d140-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935611, "uuid": "4e4b6d1e-9463-4a51-a05a-4cff44e90680", "comment": "Malware payload (Mirai)", "value": "87cdd60fb742f7e53ecad78e44beb091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935611, "uuid": "5972844e-f44b-4616-b6f9-a92e9b498c5b", "comment": "Malware payload (Mirai)", "value": "7c45e4309f93be1cc69b9d41dd3b9b2dde574d55dc89d47650f296bcf54ba2cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935611, "uuid": "a8f0e62d-85d4-499d-a1d4-ac15a907af6d", "comment": "Malware payload (Mirai)", "value": "03c13936cfe96b5ffc81b27bda018681d4c346bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935611, "uuid": "35571f14-f80f-4481-9a3c-db4cead603ef", "comment": "Malware payload (Mirai)", "value": "63e02aac9e6859a862dff912d600b3329c40661c0b7840aaf79e1e3d4c21231525678293d1f8fbac4a2f4e4ebff2dfb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935611, "uuid": "fe410b45-737d-470a-bf1b-63370ae2f09a", "value": "T1AF330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935611, "uuid": "14852ee3-9534-4291-978e-ca3a94d394e9", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGX:r/hqaJMDg9eqK806MHdkfQX6HuCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935611, "uuid": "73c3f62e-0ffc-4190-ac4d-1535c251acdf", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935611, "uuid": "05076339-5898-4241-a699-285634b5fab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935611, "uuid": "1e3fda9c-d00d-46b1-8a0b-b946a2a5044d", "value": "87cdd60fb742f7e53ecad78e44beb091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7ea323-dd06-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709873047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709873047, "uuid": "1e8bbbb0-46db-4b4b-9e03-f35d7be9fb5d", "comment": "Malware payload (Socks5Systemz)", "value": "8f054a8b456dfbada75b7a2ef3ad7d73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709873047, "uuid": "4f69ea2a-30fc-4457-bf25-48ea27136fdd", "comment": "Malware payload (Socks5Systemz)", "value": "7f410bf8eac1204c6bc44c368358a01bd968d0e012f53be68ce4200f16ad7ecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709873047, "uuid": "b875aaf8-d1f1-4ee6-b1c3-1bd475bed776", "comment": "Malware payload (Socks5Systemz)", "value": "d4496ee10ebcc4e2fb2f96d6a52ada228ba53530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709873047, "uuid": "b25d1138-eb26-4ef7-8663-8445840c20b3", "comment": "Malware payload (Socks5Systemz)", "value": "5bd674d5936c43e54f36bb1cfb16e9e9d9b460dfb8fcbfb43547851d2b38c73e7d737b4244fca08eb9a452fdae1f2183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709873047, "uuid": "df1d541d-da02-42fb-86ae-64a0d9cfab4e", "value": "T1C185332BE8885931E11148759DB5F1906D17BFA4B938CAA971FC1AFE6F378C5480C7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709873047, "uuid": "074fab7a-41ba-4f10-bb43-dcd40022acd0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709873047, "uuid": "895cd464-6478-482b-b75c-1a92aa96661a", "value": "49152:C9mKJlfHPcJxlNkiWvE7m/7Y5ErBggstoOsN:MmYH0JzNDMEyEyBgNoXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709873047, "uuid": "9f9ea155-283f-43e5-a0ef-ce269bcbc8ed", "value": 1861991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709873047, "uuid": "09e72722-a3e8-479d-a85c-4bbd6fd3c58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709873047, "uuid": "228868c6-f065-43b2-a82e-b1e92333e072", "value": "8f054a8b456dfbada75b7a2ef3ad7d73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae06d64-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874972, "uuid": "b941c471-c4bb-4a0a-af65-a6c5e64ac4f6", "comment": "Malware payload", "value": "79b2e3dcd0bb03e0a2596df0a520ffc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874972, "uuid": "d55ae4f1-6c98-4123-bc76-e69538ca3831", "comment": "Malware payload", "value": "813871186ba15e1646a4ced68a70ca8e8da517ec55ec20ffd136eb64aa4d4260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874972, "uuid": "1562bf2a-c204-4e6f-9c9b-42dede2209ef", "comment": "Malware payload", "value": "ff262b32bd5bf45fd515f4b7661740b4d5426980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874972, "uuid": "c04622e5-174c-4789-b558-3d162a394bf0", "comment": "Malware payload", "value": "eb39000f118202cd45aaf040df763a45c0837688829ac5f8ad47b25fdee961b651c56dcd7634d13bac823de4f74e8937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874972, "uuid": "d08ef395-1bb1-4c26-b466-23e792f8e83d", "value": "T152E360072784CCA5E26156B9891A47C182677C0077B0FE9B52D8B6ED0BB3BF1D96B343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874972, "uuid": "f6298880-cc5f-42cd-9c82-5710455aeef0", "value": "a61c6a7c70d96521c2bff14915509046", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874972, "uuid": "797bf20f-0438-4d4a-bb69-5d1fb8f05657", "value": "1536:d12DBwc+PJ7NhSP00dOBPfdwj7w9qBaK:bzNPJ7NhSP0+5jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874972, "uuid": "d5a64ae8-28e4-4676-a7f8-a11d2bdf8289", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874972, "uuid": "49a9c0ae-1729-4cd8-8a4e-26289931563a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874972, "uuid": "978dea26-0e3f-4303-a0eb-fbac821255e5", "value": "SecuriteInfo.com.Win64.SpywareX-gen.19211.2384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44639f49-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709923199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923199, "uuid": "b5ea0df6-9e37-4435-bea4-05d5a751f5a6", "comment": "Malware payload", "value": "2b14efd970284a09f29406ce07ab8ace", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923199, "uuid": "65b05948-2ba3-4c2d-bacd-7d30a4be285b", "comment": "Malware payload", "value": "8153393a65becaacac2a5955a73f3d0b577aaaa2cab47c12de157bc2eddd611b", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923199, "uuid": "7dc63c63-26c2-4b04-80ea-27225c260d9d", "comment": "Malware payload", "value": "388f8a2f942a0ca20347b34af9066f192eb18f76", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923199, "uuid": "208a29e3-d5c5-4742-96b6-cf01dc98958e", "comment": "Malware payload", "value": "8a7f089a5ff89130a2dd8c114372f661b882d520c9b9eb23411cf802d14b4ccbcb9921cc372040e1b1283441b34dca66", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923199, "uuid": "483e85f6-cb5a-471a-823e-eaf2e7b89d45", "value": "T118E6332FF968E8F9FEB5FCD0F5E254DD2EA45424B0E6C09B31D5529450C8EC9A2E8138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923199, "uuid": "137b8fd7-101d-44a4-a594-d46fc83f19e1", "value": "393216:47suYKL0y1Oq5m7PQHJL/haYfGGr2hnceMHd/:4z4BD7eL8orotC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923199, "uuid": "eb3c98d3-1778-4768-8567-bd99bde32fc2", "value": 14141074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923199, "uuid": "e9c015cf-e7b4-4894-a041-2ea4cb54379c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923199, "uuid": "024b05cc-f955-4ff6-8d1f-2d0fe5e330f4", "value": "Mauqes.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356de313-dd0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709875500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875500, "uuid": "f78fb8a3-20ee-4e31-add4-68dad41d6b09", "comment": "Malware payload", "value": "f73ec470a05913c255383ba99e68dbff", "object_relation": "md5", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875500, "uuid": "65bfd21c-e134-41b4-b885-e1625ed489fd", "comment": "Malware payload", "value": "817613ad7b868e48120f79e6d971698ee7dcbb6bdca2e8958566e4895b634abf", "object_relation": "sha256", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875500, "uuid": "b1f4e85a-1dc5-4a81-878a-7ef815d47847", "comment": "Malware payload", "value": "14d0a9ef8663ab11fb5933cd1d0f2af5f12a3ea0", "object_relation": "sha1", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875500, "uuid": "57a17c49-2171-42d2-9778-2785e1301ece", "comment": "Malware payload", "value": "808daef83c9268f57a82072d43d800527d4395276faad9937ef2d3bad67ece083b7f309beb52f794b470fe9ac1d7460a", "object_relation": "sha3-384", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875500, "uuid": "bbf5b678-9373-417b-b298-79c4b3ff53c0", "value": "T17592D0F0452A5C1AEA421E33CCDF2B4A64C49A931D97CA7BECC7992221DCD58BC361F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875500, "uuid": "40547380-479c-4e32-bb9f-0edfa2ecb6aa", "value": "384:PV3L0WaqPJY+2PTHoAHeov7zclvG0yH+01fZBm0FyWutA2NK:PV345+MTHo+jDAlvnyH+01BU0FyWuOsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709875500, "uuid": "b6b0ec8a-6b67-4794-a8c7-05c3c856f667", "value": 20157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709875500, "uuid": "9146ae87-389f-4bd4-b3c0-041bacc21179", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875500, "uuid": "27cc2661-25bc-43ef-b428-fa3ef9987bf5", "value": "Invoice_2930_from_Sidley Austin LLP.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee1be0e-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874979, "uuid": "eff1d5c6-5a83-450f-bdcd-f067c582ae5d", "comment": "Malware payload", "value": "557e176f55ebef2a07745065bb8429db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874979, "uuid": "8766eea5-c72e-43ea-b10d-02030a0a4386", "comment": "Malware payload", "value": "81ea5e0ffd1905e775255d57d6a3661516506c1433132292958da3b0916bbf4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874979, "uuid": "af3d1e4f-0bec-4ce8-b9d0-f68ca210a90d", "comment": "Malware payload", "value": "f150ebc7f1d366d3527cb5fed663d8394a75d005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874979, "uuid": "dde98f90-3ff4-455b-a9b6-840921d55e2f", "comment": "Malware payload", "value": "8f9eed9aa2da11477febe4249daba2258ab6770659a383731e39df3ca3b2e416f03478c84a517851fb2f1d946d759666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874979, "uuid": "607d0b00-1e24-4167-b523-f58305ea939d", "value": "T16DE422676BDC1C07CCA7E5F968BA194A4BF1C8379351E3E61CC238CCB751B018912B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874979, "uuid": "8d5ff48b-5750-4b63-b5b1-758f51eae06c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874979, "uuid": "2f494cbe-c425-4314-8d34-69270e08b02b", "value": "12288:O8FtImAFfzNqlHp/ng9dK9g8/En3eHtCBk9reulMGHxR7:t61FfCHp/ng4gl3eHZrZlMoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874979, "uuid": "d58d0dd0-216e-4b32-9f7a-601db81fdcdc", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874979, "uuid": "77abd51c-ebe6-4e0f-aec1-b1ffc50712e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874979, "uuid": "8374f155-961a-40fa-87ec-5289035d77b4", "value": "SecuriteInfo.com.Heur.29412.30078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32069191-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932617, "uuid": "491f3ba2-5537-4792-92ef-e771777e4d90", "comment": "Malware payload (Mirai)", "value": "dcd97e13a38910808450d09dba18425d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932617, "uuid": "cd610178-699b-4476-a304-1e37c8eed15f", "comment": "Malware payload (Mirai)", "value": "833e7d2c6867ce2293510ebd3c7e62a40777d7fbf07ef5af5ee7cac71f6cdd1a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932617, "uuid": "b3f20531-0081-4c3b-a844-f52d15b9c99f", "comment": "Malware payload (Mirai)", "value": "bca474432a2108538565f6ad899db13134774c45", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932617, "uuid": "3d15b60d-db53-4b7b-9a70-6136d4f500b7", "comment": "Malware payload (Mirai)", "value": "72e4e1bda197091685b975aea4ff21d0bdbc92ca431543a9d023bc82b22f5879745425aa63d1c89e896a8cdc6cc5afab", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932617, "uuid": "843e0e6f-20b6-4789-9377-0bb83a823682", "value": "T194A35A2B6652C3FEC09B46B527DB6511AC23B83B0F2762013395FDA83F4ADC84D69794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932617, "uuid": "8b609cff-708a-4fcd-a74e-0d215397da6e", "value": "3072:i6eQ33M4oGXej7CV/YE7zPF8KQTvD3ToTJFiv5uGbW:ZgCVASPF8fvD3ToTJFiv5uGbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932617, "uuid": "76d0d061-4e09-4a98-bd88-d589ecf897bc", "value": 98683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932617, "uuid": "178dd358-2ec6-4b6b-a53d-fa11d800348b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932617, "uuid": "4e4b0b29-cc61-4396-8bd6-c3eaa24a4eaf", "value": "dcd97e13a38910808450d09dba18425d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b357237-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921116, "uuid": "76e3e820-574e-447d-b48c-751b969bc090", "comment": "Malware payload (Mirai)", "value": "b170035a495d2f265b22a14850784281", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921116, "uuid": "78c2eb43-5901-4c2a-a242-6eadcdfa0b97", "comment": "Malware payload (Mirai)", "value": "835ed82b181e0d0249eb03c7ba7a339fee2c5c636709211e015a4bbfa8d73041", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921116, "uuid": "728f8c3d-7517-4c89-ad7a-9c09fce45cbb", "comment": "Malware payload (Mirai)", "value": "08148eea9df67963913a27d40a37d278d974b8cf", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921116, "uuid": "534cfaac-4e6c-47e8-b29e-6cf7e17334f6", "comment": "Malware payload (Mirai)", "value": "2afe2fd5c4507c739539e44691bb8a52f89db5ab3432a5e18272bb617bca3c5ce85827bde9bfbda3c0d5e4d5ed9b2692", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921116, "uuid": "b8c3b93d-4729-4d00-b48d-b2a9ec3cfe20", "value": "T18AE3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921116, "uuid": "f4bb4c00-57ba-4194-8121-f16d6aedef98", "value": "3072:kLZM9xtGPyaT/B5hKmEDaWURxuZq+1uPNd5R:kGORB5hKmsURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921116, "uuid": "4dbe0dd2-722b-488d-93ab-8c3ff202ff20", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921116, "uuid": "e3d43716-ddb0-410b-9faa-69c4b8e72aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921116, "uuid": "7f6b52ac-d589-49d3-afe4-acbd0749e094", "value": "assailant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d98ac6-dd8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709932066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932066, "uuid": "51751246-a31c-4ca7-9475-562953f76899", "comment": "Malware payload (njrat)", "value": "cfc14dd5705688471afd1c2ab410aaae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932066, "uuid": "fab4a74d-2948-4e62-915a-3b99a20ff72a", "comment": "Malware payload (njrat)", "value": "83c291860ac161eb4b4aa3c121bd579be835bcc565f6328149ab6de19a7cf668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932066, "uuid": "1afc7f71-08de-49aa-a1cb-cbd956142209", "comment": "Malware payload (njrat)", "value": "718ac7f4742f0af12532fb07f461135b655fa69d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932066, "uuid": "07da2adf-cdb2-4600-94b5-3ce181fdc767", "comment": "Malware payload (njrat)", "value": "1c467b5d5c317304c433994f0de112df7be13966df46b162933e02f527803262967dac191567aa8824f2b6a2edb5f750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932066, "uuid": "3f17d54a-a90d-4ffa-a146-0c7952255b5d", "value": "T191E2E74A7BB94129C2BC1AFC9CB313110772E3478532EB6F5CDC88CA4F676D44251AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932066, "uuid": "b2e477a5-8b72-4b53-a8a4-8ed9054dd6e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932066, "uuid": "0abf7712-6902-4ead-b52e-fbc8ff5a03e4", "value": "384:G0bUe5XB4e0XmOdTixBr/QsWTjtTUFQqzFxObb7:HT9Bu1difrYVXb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932066, "uuid": "28fc7ff0-fa63-487e-872e-813df8d34964", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932066, "uuid": "95e699f4-12ba-4da7-af17-7ec901c54b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932066, "uuid": "263fae64-b0b1-4720-a6b3-0b6a9398e1fd", "value": "bTZO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e85085-dd41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898349, "uuid": "e5ba3617-42f9-401e-95c4-5dcf7e8ede8d", "comment": "Malware payload (Mirai)", "value": "67d56a36816896e1aa67feac872e8ce6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898349, "uuid": "3495368b-4a7b-4624-b8e0-33b2005de083", "comment": "Malware payload (Mirai)", "value": "84bd05208f07bd764cb2a246f6cc56ba43bca5a44670f5bb98681b6a5a1635f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898349, "uuid": "0df51950-640d-4189-bcbb-26c2cc73d8be", "comment": "Malware payload (Mirai)", "value": "6e8e9f910e8817fba61f0239e1366b58e028933c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898349, "uuid": "4b6a760e-eb32-4196-834a-baa59f3ed117", "comment": "Malware payload (Mirai)", "value": "f71da4cbfda06e55a48b4b139cf172cebe7ff8bc77fa8c3f8a2e552bc4da380b5e759fcbd932056a5b6f9505d8ab6312", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898349, "uuid": "e3e969a0-1a51-437e-aa78-b21821b34c86", "value": "T158231980BCD19A17CAD41777FA0E43CD372A6398E2DD3217DD226F65378A92F0A6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898349, "uuid": "e450fc06-2dc1-4626-b579-91d22f97e178", "value": "768:l/AQ8G4V8n1Au+OfJ1cVW72J8jHB1xlU3XG2PoT0xNO9IlTpsOScNkoum6b:pt1km2U2CjhBNj9IIOSwKm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898349, "uuid": "33e52dd5-de49-4c1e-9236-7c7b39bcfc1c", "value": 47964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898349, "uuid": "d74c553c-b74c-4a7f-a54a-718dd943fba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898349, "uuid": "a3a54b4f-62c8-455d-b370-16669b01dc80", "value": "67d56a36816896e1aa67feac872e8ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db20794e-dcff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709870194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870194, "uuid": "cd7dafba-83bf-4539-a14e-3356d448176b", "comment": "Malware payload (Stealc)", "value": "138d8c7ded299ee0290a6653ecdde4ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870194, "uuid": "28ce5e54-d3d0-4306-9115-27588be73991", "comment": "Malware payload (Stealc)", "value": "84f50778519725bcf76adb7ce2814b94f94e89c67359d3989bdac7dafeebeb82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870194, "uuid": "6793a235-8938-473d-a428-8c6afeaa733a", "comment": "Malware payload (Stealc)", "value": "e01e5ec6cacbfa12762fd49ca1e7706497340cfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870194, "uuid": "4e2687af-bb26-4bbc-be3e-8f5d952d5d5e", "comment": "Malware payload (Stealc)", "value": "a4542039841f0c61abcecf1c769b920580d184f5b71d63d1d5690c9083aa85c04752007366e6f206f19e6bed9f721352", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870194, "uuid": "947adabe-a5c4-4a23-8ce4-c4c348cec2d0", "value": "T1D694E0037AE2C0B9EAE386371971C945CA7FBC62BDB08A5B3784151D5D302C19F65BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870194, "uuid": "1f9823c7-e9e7-4ccc-b122-cb32c3329572", "value": "3cbfc411430259d5f03c8f8dc253bc00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870194, "uuid": "c3e8dae2-d6f8-4101-ad60-93e77e5a8837", "value": "6144:j6rBn2YEv3yl+OuQSLvrJCTM6gGgm07Si/RR2xeZ+NbuoX:jy2Yi3yMTLvrJIMrGpQr2m4buS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709870194, "uuid": "05c45b99-1a12-4d67-b56b-1d5a198cdb9d", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709870194, "uuid": "622c91d1-8c18-4608-bf14-9062aa8b5934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870194, "uuid": "b1c147f9-ca9d-42c6-9c7c-18cca60e5aa2", "value": "138d8c7ded299ee0290a6653ecdde4ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b9b584-dd5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709909234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709909234, "uuid": "c981175c-a33e-41b1-9396-aae654135624", "comment": "Malware payload", "value": "beb75d678dead227ec7a733a6dc5e705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709909234, "uuid": "76c759fe-272d-4cae-bc5e-2db2a2b4abf0", "comment": "Malware payload", "value": "855d0048eb544614d057f025c49145f599a41219e57dc4c415a854b4dbd633a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709909234, "uuid": "6d4f5bf6-5a39-4018-9460-be3e869e62b3", "comment": "Malware payload", "value": "9ec898e0effd6edb10b3063a600bd3c412ad3d49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709909234, "uuid": "552f4608-65b7-45d5-96fe-7d404fd0cdc5", "comment": "Malware payload", "value": "298c92c40666cd98f5a36060e7b18ea690eeda1141eab58b60b30916b45112286c35175ba07e4f43649bade8784288ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709909234, "uuid": "f44ffe2d-f914-4255-8abe-778f89554cc2", "value": "T170051265B29C6BA9E17B97F722369010AF72B88A0431E79D4DC391DE59A1F404F31E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709909234, "uuid": "8164ea34-977d-4947-9e7e-7cc00dc7294c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709909234, "uuid": "0d5baf44-57b8-4ed2-863f-bd45f3c59e29", "value": "12288:DvnFtImAFNyr+uxiCrBuoEyKzDLZuD8dithT80PEa+C47gEXdM+YrN/R0V8kR:zF61FaliGBHmRuD+axLPEa/mgskrXKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709909234, "uuid": "11202d09-eb7d-4c95-bead-8331e771a069", "value": 804360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709909234, "uuid": "418695ce-1a4a-43c1-926b-da5347be149f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709909234, "uuid": "a784524f-6f3e-4cd3-ac7b-5aa24f3a5390", "value": "Re Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4701c5dc-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935659, "uuid": "8739bd46-1af0-46b9-a7a5-86e45a06c0c6", "comment": "Malware payload (Mirai)", "value": "fdd7c3ef65c33e6c50562645121acf75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935659, "uuid": "c57480b3-1831-4af4-be96-71cea53237a0", "comment": "Malware payload (Mirai)", "value": "8631b42491fe0dc74fad9700b51a8a23b9843c20b1b11d1a50c9b6f094bb9d25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935659, "uuid": "a158e753-8d4b-4fc4-b60e-fac47d7d7421", "comment": "Malware payload (Mirai)", "value": "1f2b02f0315650eaada89b06e3d8a08219e918d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935659, "uuid": "45b833f9-ed99-4a29-bb83-324791774f99", "comment": "Malware payload (Mirai)", "value": "20136b05dddab505aaeb221df541e36959f4dfd63979781be526d6557aed86c8e88c1afd6dbf904f5e5bd5f748bc649f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935659, "uuid": "367d4f4c-3d33-4d3a-88cb-dc8decc17855", "value": "T1FE230271480E9EF125303C76EB95D78376F026B1C6673123D6290A3C6FA57131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935659, "uuid": "5b4522c5-f13e-4d63-a3cd-6e331fcd91fc", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3wur9q3UELbUXfi6nVMQHI4vcGpvE:DECFd+A6YHAx/KLRQZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935659, "uuid": "22c92177-cd17-4752-a1c7-0614c3500670", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935659, "uuid": "fb7972e7-10ed-4f5c-9dd5-794c417592b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935659, "uuid": "b74340db-0aef-4c78-b450-4fe9a260c099", "value": "fdd7c3ef65c33e6c50562645121acf75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6a465d-dd7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709924286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924286, "uuid": "10f60a52-57dd-418e-bdea-517a3b6e3c15", "comment": "Malware payload", "value": "86f4b0dc73d8e5b5a5cfc83cd04a4243", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924286, "uuid": "bf80acd5-49ec-4614-bc2d-96aba324f931", "comment": "Malware payload", "value": "896d53cc4311c63e985558dc4466c5c205b6556a14ecce4f4e45a120696293b0", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924286, "uuid": "b415fbc2-7b1e-401a-a3c0-28ce0474417b", "comment": "Malware payload", "value": "0d0e8c9d66dc782798b350da137264a14e6511d4", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709924286, "uuid": "fb95ecd0-63b7-41da-9fee-465c748bf0d1", "comment": "Malware payload", "value": "6d2c7e27b9c7bea8296111f7a8d15bcbccba7ff077e67512274582222300f052c4651268058832813711011369e5da9d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924286, "uuid": "c35b34a7-aba2-431c-bcea-b658d086394d", "value": "T165F50150E94A18FAD26303F1061FFF7AB63CB121E5D5DAA3F79DCB026A32B66151110B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924286, "uuid": "b294bdb9-bedc-4e89-8445-8220d53918f9", "value": "49152:D6PA106IT7KKeHQVeTi+cgTGxHRdITo5vZIUmifC+fP/:D6o1j+d1eT1jGFITuhId+C+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709924286, "uuid": "9d8cf21a-86b3-4353-88e6-eaf55adb048c", "value": 3407872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709924286, "uuid": "4e06ca48-d13a-4020-913f-348230db803c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709924286, "uuid": "9b399d92-69dd-4fe5-a22f-0cb2dd3eb22f", "value": "FAQ.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361f1920-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1709923175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923175, "uuid": "2f88c0df-78cf-47f1-9e7f-0b5cf0323d24", "comment": "Malware payload (Smoke Loader)", "value": "894baeb7be85c01940e2043eacd82c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923175, "uuid": "e46785da-96f3-48c3-b205-0cc91bdc353f", "comment": "Malware payload (Smoke Loader)", "value": "898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923175, "uuid": "3c2f9c02-f514-473f-8e7c-8de1716bbbee", "comment": "Malware payload (Smoke Loader)", "value": "aff64515061e22951ac3a917dfd4c7a66443d9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923175, "uuid": "70b68d42-1f47-4c8d-8e31-1b84dbb5f594", "comment": "Malware payload (Smoke Loader)", "value": "d95cdfa13d1d9999e6e990b40b26e25be89088edf769c1908ae4ffc0d05052643c5ee70351067792c891f34d776e5e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923175, "uuid": "33d133b2-617d-4d7c-9e4a-d8f0ce5bd9f6", "value": "T17704CF117690C072E0B76935193096A12A37BCB2AB7580CF27A43F7E6E707D09B76B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923175, "uuid": "bbadfb47-c876-496f-9d4c-eb6448929c1c", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923175, "uuid": "fa7f5fe1-8990-4448-adeb-e2edd10f3de8", "value": "3072:y/yBN6fEr6ADs9r7xOsj139boI2WIkP4eXUkyKc0AFOAL6uQX:yuJ+ADIr7Asjl9b1f4eVyKUFOAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923175, "uuid": "3ec02000-c3d7-48f5-90fd-1f23a53d1501", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923175, "uuid": "bfddab5c-ecb8-40a0-953a-5af8962dded9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923175, "uuid": "67458380-0492-4db8-9630-342e3958bd74", "value": "898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6902a06f-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921113, "uuid": "e5de7cb6-d9f8-4fe7-9abf-214b06329113", "comment": "Malware payload (Mirai)", "value": "fd60041890d5960749df426cf6874aaa", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921113, "uuid": "541d7b39-e383-4bb5-a0f9-d60f7c077fd2", "comment": "Malware payload (Mirai)", "value": "8ad36b0ae69809e85c601b061ca76abd8150bf8806e6e6d91c50ea63a1bd280a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921113, "uuid": "d89ccfac-9574-42dc-920a-f004604136f7", "comment": "Malware payload (Mirai)", "value": "52fdbb154b2feb20c93e044cf6af0bb9e386be2c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921113, "uuid": "cfd02b8d-6fa3-4c72-bc99-953c94c12598", "comment": "Malware payload (Mirai)", "value": "25af7907962d5e69725e1bb56e06a1a74ca613be00c2ca590af08d3303b8eb3d743aba6d5e184c7914059f784d750427", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921113, "uuid": "290375aa-ed38-47ed-bc90-19c204c9ae6a", "value": "T1CAA34A82A740D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C17261B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921113, "uuid": "e1bbd009-0fe2-49fb-879b-f51401fcfd75", "value": "3072:1MoaodUWUh917j8mc2deiPUDAZURyPfD5hFTOvxinf0OzTyoQQub:1dRu917j8mc2H5Z5Pr5hFQxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921113, "uuid": "c8261ed7-4e93-423b-ac74-ece837f4c297", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921113, "uuid": "2f4b808b-0056-4ceb-86a1-799cab2e8b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921113, "uuid": "e930e349-7780-4881-9f52-aa87993360a4", "value": "assailant.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c7bb89-dd0d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709876005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709876005, "uuid": "3fa2fc51-5748-466e-992b-925cfb182ea0", "comment": "Malware payload (Socks5Systemz)", "value": "b8fd144dff18a4997dc10c60120019ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709876005, "uuid": "97f41aef-b827-42d8-b708-47b3ebda4a19", "comment": "Malware payload (Socks5Systemz)", "value": "8ae0c0a1382afdd68a2952d27fc170741a81ef90be9ba9280c65322e80f9c74c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709876005, "uuid": "70df798d-60cb-4901-9d88-00121265a078", "comment": "Malware payload (Socks5Systemz)", "value": "d86f71e18b1487e019aa7c5dcee37b3cde3e1983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709876005, "uuid": "ff41b810-6463-4475-9e1f-4fbbf73f46dd", "comment": "Malware payload (Socks5Systemz)", "value": "bf03898c018857653a7049713d6d954e40464a8e0a5692cb650ae66bb268315297048897301a132f808d3c1fb4cd5c62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709876005, "uuid": "2b319524-d008-4b61-a0af-a4883c84a15a", "value": "T12B85336BB5C9C535E4548A30651487604A3B32787D38455B3BFC8E6AAF3778BD82A3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709876005, "uuid": "0c223505-dcc9-4ce6-8f4c-540570392833", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709876005, "uuid": "96804852-b1fb-493f-9c57-191a591d1bb4", "value": "49152:C98G5x2sIo3c4F3oOGUqczOaGj+PAjTRjMIm1HJHFStpVp1:M8Mx2OR41UbCaGjo+jDK4tR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709876005, "uuid": "627b3d32-f356-4b03-965e-96e21d19c2a4", "value": 1864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709876005, "uuid": "055c2bb8-b67e-43d8-9a31-6fc1a90564ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709876005, "uuid": "02e8cf37-fabe-4118-98f8-b03e34e648bc", "value": "b8fd144dff18a4997dc10c60120019ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686c80de-dceb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709861412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861412, "uuid": "1c37f306-82d0-4139-9ae2-3ccc6b1aee7d", "comment": "Malware payload (RiseProStealer)", "value": "a9998579e42978348ad87e473d97484a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861412, "uuid": "a4daa120-d42e-4ef8-9f04-80d72d85f157", "comment": "Malware payload (RiseProStealer)", "value": "8bc3990f004b22558934ae39d088d52e4359509f5d7be8542dbdc8cc05ee7e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861412, "uuid": "304d4cc4-aae0-4540-a7fd-ebe3bba38c87", "comment": "Malware payload (RiseProStealer)", "value": "39d7168a7d04ee53ea044f7e05602e4cece0e3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861412, "uuid": "7782ee65-2ffd-47e9-8aa9-30a4befb67b3", "comment": "Malware payload (RiseProStealer)", "value": "c1c5bd2659c52566df775ba0d049f50e35b72218f5f81e5b00a3ad80b20d40fca71e366daec578c8a591cebdb4791900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861412, "uuid": "80db407a-8e03-4928-90be-1a420e661ede", "value": "T1F934CF2136A0C0B2D56BC63495A4DAB4ABBBF8725761C14F37581B7ECE307D09A3A313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861412, "uuid": "26b643f7-1248-48a6-8f69-6955640dfc41", "value": "3c019a063cc3cc46e117f4489fdd8fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861412, "uuid": "ba4a1c3e-5ead-4f2b-848f-f54cf9a8eac8", "value": "3072:y7FrVake2Z6XSn9ptBakFtswnmdObkyIyzwhd5XsAPep7FhGZ:gFYO6XYvtxvs8mkAsjp7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709861412, "uuid": "f7f2e904-df52-476c-a7d9-087e4d7c2990", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709861412, "uuid": "127de5dd-a5e9-4489-9bf1-cf237683aebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861412, "uuid": "8ce6e946-952b-4eef-9b68-d4f547502bfe", "value": "a9998579e42978348ad87e473d97484a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6125136f-dd59-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709908644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908644, "uuid": "fbd6c657-2289-4a13-a648-c702be3265e2", "comment": "Malware payload (AgentTesla)", "value": "9ee5a468ce3aa9dffa02583b4f379402", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908644, "uuid": "855dc7d8-f1ce-421c-a5c0-0fb9e780214b", "comment": "Malware payload (AgentTesla)", "value": "8be2f4d5af90796a75eeb0bcf35fbe89befbc482adb26c3632950a88c5b4883b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908644, "uuid": "60025470-6c0e-4608-a5a7-94136541f311", "comment": "Malware payload (AgentTesla)", "value": "93f12c5bf5bac2aeb0a29dbf36e2180cd5c55d78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908644, "uuid": "fab15105-3596-4f06-9dc5-96b5966f6401", "comment": "Malware payload (AgentTesla)", "value": "e7d01f88f9d61e572f91ba5c62609a9243c69a123de068ef34c6c1c9822d4ec126a34c21ff0c08410a72501f67249bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908644, "uuid": "af57cfda-8369-4b46-8df8-43a71249d617", "value": "T1FEF41265339E2BBAE57E2BF65572A8506BB7744E0821E79D1CD390CA8672B004F30F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908644, "uuid": "1e13f430-2c82-4998-9ff3-a1a6b40323ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908644, "uuid": "3aed1547-1bdc-4830-9fbd-c6c4b0389fea", "value": "12288:xvnFtImAFNyr+uxiClI27Vl/acWUJGTeTkK0mZANBetybX670O3U9vgmyDZLm:NF61Fali3Sl/aaGKKU0YtQ6AOyvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908644, "uuid": "1bd5544d-c783-4131-8b69-fe5c1a119526", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908644, "uuid": "fc2e5a48-f1e8-4fc1-8d17-aeee8bcc3e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908644, "uuid": "86425fe7-6366-4955-949b-b50e9e57f623", "value": "PO 02-2311-55R-MAP- 7Mar2024-19th Order-Euro38217- URGENT ORDER solutions -RK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280223f7-dcff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709869894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709869894, "uuid": "2fa885d9-d9dd-4c2a-ada1-edda60688e44", "comment": "Malware payload", "value": "6623adacd52b688eca978d252e7e9c62", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709869894, "uuid": "dccaa769-1906-4bdb-9862-0dc60883c2e7", "comment": "Malware payload", "value": "8d3d02e1874b93c50140fab246e0db91ba32010d2ccf2b619a229b8b80c6570f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709869894, "uuid": "85528669-08ef-46da-a018-c5c568adc425", "comment": "Malware payload", "value": "a0c213d6a96ffccf5284c96b11f83979040722f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709869894, "uuid": "628adbe9-054b-4e7f-9cdc-8c75bb193653", "comment": "Malware payload", "value": "991c6dd462742ead2452917ded37f5f9851b978bc95dfb1d32c253b709f187cb558ce353219755ee4e6a14b419c139e5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709869894, "uuid": "a698072b-7b21-4967-9181-72256a6f388d", "value": "T15563F36AE70F0965DF55E67B424A4B4A09FCB33D738500B139BC97343BAD81E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709869894, "uuid": "15f00d40-cd5c-4868-9813-683c1c711154", "value": "1536:ZLqzd6LiEtWZKmeNamkOPEagEU6NPqFVV2GsWW304:ZYKmeunEUSPKiGsWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709869894, "uuid": "8717544a-4355-49ee-8933-3af201d75628", "value": 69995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709869894, "uuid": "4a8fd7cc-f858-4457-bdb5-8430ed0c10c7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709869894, "uuid": "1131d972-23a8-4016-b5da-e33e991288e0", "value": "6623adacd52b688eca978d252e7e9c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec9ef65-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908399, "uuid": "b4fd747e-4606-417d-8b6c-b99d59b1a978", "comment": "Malware payload", "value": "d92c49ca712a0503de3e182f66e3dcba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908399, "uuid": "3953b6cd-b77a-4588-936f-5f36d164f9ba", "comment": "Malware payload", "value": "908ca27ec447937b2f97fd4053a8fea99f45bc7e2eb028152f2301c97f952acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908399, "uuid": "65297cc8-4089-4445-9ad7-d001b2ecd825", "comment": "Malware payload", "value": "97f716142447128859561a75e4677f978aca7fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908399, "uuid": "be7129a0-e6ee-4465-925d-2eb949d15c30", "comment": "Malware payload", "value": "7c3f27253b59d7672a9f2c05cc0fdb484ba8c197e48e72b04cd00a5bfd3ae60461bfd53ae50ab573f8d32dc19add74eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908399, "uuid": "a27fa665-709d-4fb5-b8fe-cd02bc722c6a", "value": "T1A4E37A327EDA17A9F65190BC1E410BCD3A1A5E96768F4F7B2507BCA1C039CE52C9B780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908399, "uuid": "eb04adb6-e11c-4d71-9b8a-ac977c13d09c", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908399, "uuid": "3fcebf80-187f-43ae-8e8a-ee30e7ace8bc", "value": "768:p+/unhi1zOzZ+/unhi1zOzpBG3uJ1zxTg+/unhi1zOzxM+/unhi1zOz:pti5OzZti5OzpB91tgti5Ozati5Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908399, "uuid": "1fd63ca2-62be-45e6-b92a-282ce8f86680", "value": 143398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908399, "uuid": "15f92990-0310-44de-8591-ce92037c3a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908399, "uuid": "77fd6e65-2309-4dbd-af6d-85f2c6782a4b", "value": "ChromeSetup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff764d4-dd0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709875839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875839, "uuid": "6149e3e6-9ff2-4302-8be4-481188d40ca0", "comment": "Malware payload", "value": "244ffe8176490e90a34010522491ab86", "object_relation": "md5", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875839, "uuid": "1be06f0e-a839-4810-8b62-63ffbc54ae28", "comment": "Malware payload", "value": "918cd6d713f9edeb4505274c343f4913da09a2fdc3fc72e5dc9f0ecc086854ef", "object_relation": "sha256", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875839, "uuid": "2204c4d1-ec2f-4daa-87d1-a1351f52dfe1", "comment": "Malware payload", "value": "53c112b65bb949ca1d850090c160e9fc5391aac6", "object_relation": "sha1", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875839, "uuid": "841f9423-ca5b-429d-97d0-05c7d805c98b", "comment": "Malware payload", "value": "94fd5132a001d4099927cd3cfeed46c826240938302f4bf07524d977364eaa4cdcaf04f74ee265d81c932968628fb7bb", "object_relation": "sha3-384", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875839, "uuid": "03d1b370-6bf2-4e93-a1fe-bc464e76538b", "value": "T1DCF61A27374433364B5311926A4F16E9AF3DCC3973619450686C827C275AC78E3BBBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875839, "uuid": "a536aa16-fe87-442f-b1a0-8933a2635570", "value": "49152:m28rmtlANlQK/mMdqwyKfQ7HR4ud4uYma1FJt4X7X7XTHL975cnDcnjdqwytC34w:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709875839, "uuid": "346898e6-1e47-4a77-a3cb-73ed1d5285b7", "value": 15377270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709875839, "uuid": "37b258b1-7fdb-43e3-9f0d-4d7aa8eab537", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875839, "uuid": "136e517f-28f6-4d0f-8896-e02f6ff64b33", "value": "756923_DATE_03_07_2024_44292664_654532.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1561b3-dd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709892769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892769, "uuid": "a2fa346c-f7fa-4f06-a6c0-f041dd415420", "comment": "Malware payload (Mirai)", "value": "fddf14ce1a1dbef71c3ff4bf8b093112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892769, "uuid": "b12a8134-7c63-4172-8dc7-d17d340c35f6", "comment": "Malware payload (Mirai)", "value": "91e6d3cc2a0040e047d54286d1adeff1a7d405dfae83571c4987438eaf2f85aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892769, "uuid": "173722ac-fbef-4595-ae19-e09bf43b93d8", "comment": "Malware payload (Mirai)", "value": "262bb1338d1b2cc329599d996679f043f90f8d2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892769, "uuid": "da1072f4-1b72-4a6e-87a1-09537b746831", "comment": "Malware payload (Mirai)", "value": "f7016c38ca05ce4f5bc213a5ff43ccf1063ae7d89240429cf6c33d56bbc4cf4f584d54e8986ee272f0c6b7b16d385e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892769, "uuid": "b943976a-0d2e-4a6e-a30f-590b2fefb450", "value": "T15084E15AF20B3D83C9DBC435258AD1459795E89733F383063F42A5BB382967B8F28785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892769, "uuid": "7960f4b5-b775-4fc9-a6fb-98a20390acdc", "value": "6144:2/HYIXszyOOtbL5/VtUOMfeUaW4GMt7p1Z6wGe6cDGXr8prZRP2M:2/0TOJLpgO/LWAteQ6cDGb8prZRP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709892769, "uuid": "6dc61844-df09-44cd-8523-f81d80ca5485", "value": 399344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709892769, "uuid": "e544887c-5315-4977-ac53-c88dfb4777c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892769, "uuid": "b9fdeaa1-1bb2-412a-b29c-f7f75dec8921", "value": "fddf14ce1a1dbef71c3ff4bf8b093112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae2bbfb-dd87-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709928605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928605, "uuid": "faa1c277-c038-4cdc-858c-8ac3f0d5a3f5", "comment": "Malware payload (RiseProStealer)", "value": "c7879e91ee30bb61535a8b9b95b501ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928605, "uuid": "997d0bf8-f731-4c9a-ae56-663bf99d18e5", "comment": "Malware payload (RiseProStealer)", "value": "9289355c0f6c5ad181e557e945d9cf5cc7ff9c97a67532e04175fa12efb7d095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928605, "uuid": "b14c92b9-8af4-4fe9-b501-e91d9e58c219", "comment": "Malware payload (RiseProStealer)", "value": "de3560532268112feb7f0adc244c35b4559438be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928605, "uuid": "fc185d48-7ef5-4e72-9696-eeb54cafb337", "comment": "Malware payload (RiseProStealer)", "value": "a4a0788764e90fc270637537b679f033933ef58568711c7b59c726c1812f0580f5b6e88a42e0b7192cd36bada06d04ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928605, "uuid": "2a3678ae-80e7-49af-919c-6923a3d1cb56", "value": "T1DB66239A2AC700EAC8C11CB4C73B7EE623F365D919A64C3D77C1708561F6E7A706B846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928605, "uuid": "4c292bf6-8fc2-4d45-9668-086b1c6487aa", "value": "a4c0f65297350a2f4be573847bcf3b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928605, "uuid": "66f09c79-9f67-46b6-9265-6adb68ff6950", "value": "98304:VDZQpXdqeTc/6QXRe8Qun/nzmcZlCzeP0N6519DLqs7bcGsbe0cYWcAbeJkFa5tR:rBeTxaAzyi63dqsbcXbcYWcAbmVzJOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709928605, "uuid": "32c3ba45-b3c2-49d8-b9e3-bb2fe9dba068", "value": 6643712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709928605, "uuid": "7b026641-8bc6-40db-ad20-f51fc3c2f3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928605, "uuid": "2bb5b0dd-2c61-4f9d-af8d-29ff3bd53b3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e3e904-dd49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709901963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901963, "uuid": "bce0021d-6bf4-4bbb-be3e-d941efd2717d", "comment": "Malware payload", "value": "b199585b4767bd5f22d87f2a1b05d8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901963, "uuid": "1afb300b-4d72-485e-b664-7b90dee71bb3", "comment": "Malware payload", "value": "939476b5429a74c095f140f63858a9e59ecbad281af00ba2d11fcae513290b86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901963, "uuid": "8e941203-aecf-4e0d-8313-75fc7e5f7404", "comment": "Malware payload", "value": "b42746f392ecd9195f75edd99b9ff0823477a2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901963, "uuid": "3fc4de46-985f-45ae-8f67-847689aeae94", "comment": "Malware payload", "value": "627fd39886481224cfb595f0ab8e9e5957cf6202595395485ba043e3b96fee7671ef4d731823473ec9bb835b40e12d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901963, "uuid": "be9f865e-f4f8-4d2a-91b8-0d699bc3d1a4", "value": "T126F59F51B7518122D89200B7C2EDBB7D492D6D2433B940D767C4B9AD7C303D2EFB6A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901963, "uuid": "1dfcc2e2-9e38-4981-8969-cc9131831b37", "value": "3b01cd87b6797e0261fe3c525bfde816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901963, "uuid": "4e6f8e3a-60af-4d65-8ad2-b4511135cf64", "value": "49152:V1atqhr93gtksRDFs/xIDoDwtQ/Iis0VQBykMcRc/s+kobXnz/q/xnd/c/fnr/as:Aqr3GgIDMwEIis0VEyZZjggqf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709901963, "uuid": "b0906e29-cb27-435a-9974-955dd8563f8c", "value": 3493352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709901963, "uuid": "5855f35a-1f88-45b7-a8f7-798a9982bbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901963, "uuid": "a0193af2-e4e6-44e5-bcad-42cc8630c2dd", "value": "SecuriteInfo.com.W32.Sdum.Z.gen.Eldorado.10489.25730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5cf259-dd0d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709875912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875912, "uuid": "c7dd7659-2d40-4ccb-a1cd-dbe1107a5ac3", "comment": "Malware payload", "value": "ec15ec4a99be8d69ffa564b3f19de02e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875912, "uuid": "65457d49-702c-4a8b-acdd-ff7457d1a8bf", "comment": "Malware payload", "value": "95224130fdf2c17805c1d258b11b766771dd825e2b400d635d166bbd51d63d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875912, "uuid": "5cb863ba-e250-4a14-98d5-fe3618bd8054", "comment": "Malware payload", "value": "e4386e71201ab175c55789f769ca1596eed1da03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875912, "uuid": "cc298ca5-26a1-4329-86a1-7001f11faad2", "comment": "Malware payload", "value": "d7ba37fe16271ce51a4cc93916c90898e94c3a976a90eaf334df379bd9d011ff084d5206bdd075cf07c23b2a9013d812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875912, "uuid": "b3f72ca8-ac3b-4d5f-81b4-14c67b5f32ed", "value": "T14A94BFE156ABC566DBE882B8D0C21912E3FD458BF362FB55A4F400E15C17784E7232EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875912, "uuid": "bd46f817-624f-44c3-b1fc-1592331360c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875912, "uuid": "d64179d2-7194-497c-96d1-688ff9a65084", "value": "12288:4S3a2qhCxnbcZEIsB73q2JswZ9BlGnWczEPt/VUeEPxtq2aouTng/Vlpx7IhCFxE:AeCgiOPgDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709875912, "uuid": "6291b4df-f0f7-457f-ace7-8565731a35f3", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709875912, "uuid": "d74d4330-6764-4c6b-a090-ff89be781fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875912, "uuid": "bab07a4a-e06d-4904-8ed5-8459f3a32498", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca71d37-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874975, "uuid": "879b5c2c-e344-41f7-8903-a635240a83d2", "comment": "Malware payload", "value": "547cef63c0f3bef02a4e74587b5e0cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874975, "uuid": "033a47f4-2370-48e8-9413-08e1ad7748f7", "comment": "Malware payload", "value": "966c711f0854f33bd07d262239888317a772013c02e3bd91b71c0b64c3886d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874975, "uuid": "50b0c307-fff0-477c-a47d-25bc03c1c228", "comment": "Malware payload", "value": "399a27abc8580116f09a6cf7ec1073c75548d096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874975, "uuid": "e02e246b-0feb-4599-aa75-1139c32c3487", "comment": "Malware payload", "value": "bdc1d3aa71747c9bd2fe89e403f38de086a719b6c07fe71a03af9621f8115cf4e57f020ab483bbc3273dc054331a110e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874975, "uuid": "2f45d3e7-dcb9-44e0-8486-4377ecab598a", "value": "T1EAE360072784CCA5E26156B9891A47C182667C0077B0FE9F52D8B6ED0BB3BF1D96B343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874975, "uuid": "1a29625e-a56a-4fe0-b11e-1007638526dd", "value": "a61c6a7c70d96521c2bff14915509046", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874975, "uuid": "768ad4aa-0f50-473d-b200-77fe14e5883e", "value": "1536:p12DBwc+PJ7NhSP00dbBtfdwj7w9qBaK:fzNPJ7NhSP0+ijL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874975, "uuid": "6548aa09-9df4-4ec4-964b-ebf652a21efb", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874975, "uuid": "d5e62989-e6d1-4c31-817f-a3c1737bf6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874975, "uuid": "b7c2dd2b-697a-417e-9912-196bd1da356d", "value": "SecuriteInfo.com.Win64.SpywareX-gen.786.5855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c9b902-dd2a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709888419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888419, "uuid": "56303dca-e71d-4f28-9227-74232cc07560", "comment": "Malware payload (njrat)", "value": "af1f826f62d0f0879198f2c7b11c8b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888419, "uuid": "4e02aac6-49f5-4d5f-9792-662c51b36109", "comment": "Malware payload (njrat)", "value": "981e3f58c9f3e3eac278fd6a746f53b4d2bffc2f7acc22f5cfc36b26a32eb966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888419, "uuid": "2d489fd3-c1b8-4b2a-b730-ee2541b28375", "comment": "Malware payload (njrat)", "value": "9175e0e667d917d69d60f8e5bb3abf7b9d04dc71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888419, "uuid": "90400a8d-0ae4-4bd5-a2eb-bb22b21273fb", "comment": "Malware payload (njrat)", "value": "ec87c4bf7a5c8192c4c25105045fb8b31c44bef09ad8819d61604b63d75a92db6a3dcb4705dd01cc67011b19eb41d9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888419, "uuid": "c4f29661-d14d-4c2f-9090-2ae89a33cf9f", "value": "T18113D88CBB44E174D5FF8BF0A892B2990B72A017A942970F99F114D94F73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888419, "uuid": "67b93383-6c79-4a8c-890c-952a73439662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888419, "uuid": "5d1bc65d-8e33-497e-a442-ba00579312d8", "value": "384:FZejmg98NaIyrLPb3cWESEw6ik7ajOCnKs1jUNNNCP33hYCtVKwJR7AMt/greT0k:P0ywFrzb3cPxGOCKuUVupVZt/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709888419, "uuid": "bafe540f-38e2-486a-be5b-1a0826ef6cde", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709888419, "uuid": "452475ee-cddf-43af-a35d-3c612772b8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888419, "uuid": "b000c0e7-78db-46fe-ba52-1c2f8453f37c", "value": "af1f826f62d0f0879198f2c7b11c8b85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be45333-dd2e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709890086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890086, "uuid": "2e11ffeb-1a72-4dd1-9184-00eadc1a76c1", "comment": "Malware payload", "value": "d4f685deb88b48dc0e55703f7ab56d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890086, "uuid": "15e0c4ae-1621-40cf-a5e1-bce1d311d021", "comment": "Malware payload", "value": "98faaafd3b450d836415eff09da56591fe31c54b4a668498416537262f2cd4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890086, "uuid": "8796cda1-251c-4ea3-979d-a4a0223468cd", "comment": "Malware payload", "value": "4db0f7c4a2c299eeeecb258c14d13c8c0714206a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890086, "uuid": "4dc74630-68b5-43c8-8c0b-daffa4a31fb9", "comment": "Malware payload", "value": "5bbe9d5315bddeada929637465e02c4be190964d264c1ffe10117ff309e150d9e9c498b356791f0d07b965b9e08b52b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890086, "uuid": "0a590207-bc98-4932-9a35-05c6d8922025", "value": "T13718331F93BFD728F00BAB7235140496396420015ABB2DD366A9BC524B75B308B9B7DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890086, "uuid": "f03ec2c8-ec9e-4c90-a623-c9e6277789bb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890086, "uuid": "fe27c8ec-e98c-4df5-a29e-75054797774c", "value": "1572864:V/WHHr9qNUFkOVYIIu+eTt1Thl1RJzve1FizRreIQeLcsbI+No77:V/8L9qKiOYu+yzThlFzW1FizAIBQcNM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709890086, "uuid": "9dcbe10c-3827-42e4-8335-470f8f0d9fd3", "value": 85619648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709890086, "uuid": "125a0936-c0b1-4269-aac7-c406066bc773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890086, "uuid": "5f4d5ef5-5f24-4c26-8af7-bb064f793d24", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a883672d-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709923367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923367, "uuid": "201fbb1d-97b2-481a-ab90-5c7767071bb9", "comment": "Malware payload", "value": "0c6af55541d13c0cb1acf8e092b2e8c6", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923367, "uuid": "72e38824-322b-43cc-9672-07885b1a7826", "comment": "Malware payload", "value": "9975b71293672b41c38189df3edd83f0cf569e8304e66bd79b52ce8cbac4813d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923367, "uuid": "343aa660-618f-4e6d-9253-01f4340c4ec0", "comment": "Malware payload", "value": "7eafc1e6226f6fd89efdf5e656ac63fbb36de33c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923367, "uuid": "6350558f-789c-4d57-9391-6d6a67e4943f", "comment": "Malware payload", "value": "0069e084c59fed917e69107b8972d9f1bc9c13435f5aa8ade407d9c82744459f6315e8619efe2a13e05c62d2b3425ebd", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923367, "uuid": "fa680ed9-fa79-4868-b5cb-68f1a0edf7b8", "value": "T1C0947E61B143E131D46E14F45D2CAA96393CAC550BBC8AEBEFDC393B6D350C09635E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923367, "uuid": "684117d1-e92c-4fa5-b7e8-50756a683928", "value": "f4797f8a82a62e2b9b038ed20d4a1e3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923367, "uuid": "2893f362-06b4-47d0-b763-ac40ae612956", "value": "6144:EeTI6CI0EetXjAtb+L8oYlsf9JhtWGQt8LJ5tV1e5sAOzaK+:rxp0EetXjAtbboYlsf9ngX5s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923367, "uuid": "78f06e88-90d5-4835-a711-796d085a0a35", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923367, "uuid": "aba7d7e2-d0aa-475d-a2a4-aeecb70dfea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923367, "uuid": "bcc65c78-8314-4da3-b8d5-40f367137c6e", "value": "redislist - MpClient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f4109a-dd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709874970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874970, "uuid": "2fb97fac-7d45-4ce7-8c29-573a7841e2db", "comment": "Malware payload (AgentTesla)", "value": "5be1f2b833a36e7727b07c1cf331cd30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874970, "uuid": "0e3df98e-3f62-4707-a7c3-e76eb0fd3435", "comment": "Malware payload (AgentTesla)", "value": "9a88189ebc687ea4c787cf94739e4867fd2400e82398ecb8efd1a606c6d9d5ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874970, "uuid": "5d730695-1f0e-4308-b587-02ebcba8e269", "comment": "Malware payload (AgentTesla)", "value": "7851ddabd9b7c5871570798ec6c2f6d3971c7601", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874970, "uuid": "574d64d4-67cc-488f-8461-e916b556d0b8", "comment": "Malware payload (AgentTesla)", "value": "53361c3dea0191d384fe13f429877facf81ea591b60b346c3369c63fdaf97683dcfaadf24c0c250f9ac7bd518207e8f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874970, "uuid": "09c26be7-e713-44ce-8935-1847ff3cd5fb", "value": "T1ABE423443A6D5433D48B067918FB314263BC473AB391F7CF5FD2C6EAA996F8A2804547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874970, "uuid": "ffee194d-a618-41a8-81bf-4c3726e6bfc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874970, "uuid": "9cb62068-fc95-4490-9ee5-321e024130c4", "value": "12288:AlFtImAFsfMuIqNWdN823eEO9EotOtawrRcSqsyidbnNfWOpDvx:K61FYM6QNpeEO9TtW3qsyiJh3pDvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874970, "uuid": "36648d43-f1f4-45a6-9442-992002d87089", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874970, "uuid": "93950e0a-d9e3-4fb3-8f52-703606cbfee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874970, "uuid": "735b50a2-f0d6-4682-912f-6830143dfadc", "value": "SecuriteInfo.com.Win32.PWSX-gen.5054.6994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de179dd5-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908424, "uuid": "4504194e-aeea-451b-990d-2509f195f980", "comment": "Malware payload", "value": "2366f34130db5f39d0d5255782974392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908424, "uuid": "f2e4d756-52be-4dfd-b486-54995cb2c93a", "comment": "Malware payload", "value": "9e495b41518154b5c5cb3fff866aa26c894adf164b2639f05ba23bb5e75be5ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908424, "uuid": "28924d67-a2ad-4cb1-b29f-2804fe6a8740", "comment": "Malware payload", "value": "6323dd08850cdea997298f91f74078cf0c8e78a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908424, "uuid": "ca0af7db-a241-4203-b560-008ccb38019a", "comment": "Malware payload", "value": "6c90fccea6f8c66636be961555d9071940211cab9d9f3a30f6f9ab06a6dfbf51e4ab6161fff093dd399d129e8359da96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908424, "uuid": "9c61b38a-e544-486c-acb7-d2a61ee36a10", "value": "T1683523608BF6C077D5BB49741C690A29F9FB0D402876465B7F247B2EBB31487AB4EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908424, "uuid": "d4b54cd9-0451-495f-b695-037cc2d3416f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908424, "uuid": "cd0713e2-846b-4cef-9c20-98e8ebe685df", "value": "12288:zN7PaOir036Rc10z4JXP+H6oZjkg6aYGCPYx+f7W7ufszMIRVRHqz7Iqse4sIQeI:zN7JE0Q60zOWHrYgsGCT7nfKJTe1NTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908424, "uuid": "0cde4820-2278-4a69-8bea-c83c5918f31e", "value": 1059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908424, "uuid": "da6a43a9-a24d-4664-b297-57655b14f698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908424, "uuid": "4fbd4a18-8844-4771-9bad-56656e55f1f5", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b02a85c-dd64-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709913466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913466, "uuid": "137862e1-9a45-400a-bff2-ba0fa091375d", "comment": "Malware payload", "value": "33aee0a29e6e755390997b138a7bc3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913466, "uuid": "55cc6436-e8ad-4444-a7c1-c481e2aff86d", "comment": "Malware payload", "value": "9e4ea8ec8b01400bf65120de422df7a1bf3405eb9c526567302f5df9a0105b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913466, "uuid": "22150509-4422-4d64-b6d7-6070c65beb8e", "comment": "Malware payload", "value": "3771201083f9fc6aef130b2edccb8c7d1633ed56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709913466, "uuid": "1478185a-060b-47d8-9129-5b927f2b55be", "comment": "Malware payload", "value": "8eb7c024be77a20f204038ec82f578fb27a5ef4dbc4b83a2c4a71993220918ca72d7f5a3c6ad1c3e349a588b32a74208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913466, "uuid": "6559fe80-5a42-411e-a233-a2266722a6b1", "value": "T1DE141296BEE1855AFD6343B1A3476735FA300D02CEA56DA2B18DB00F59764C48CA7F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913466, "uuid": "91038620-d046-4355-a6b2-364684cea6dc", "value": "3af3eabc24a8aeabb57fd851189b390e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913466, "uuid": "b9587ae6-d3dd-45e1-8721-d6eb400de281", "value": "3072:EstQZLgXcdBJ4OxWm1M/j0vBP6xlL+KJC23IasjoqEuPf0sJjCXrUKbHmbU:/QdEcdoozvt85C23IassqesJeBGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709913466, "uuid": "26262baf-abc2-4575-b3c1-fbbcd3e4ac76", "value": 202292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709913466, "uuid": "2719f3bb-9ddb-4fc5-82ac-bab342a50ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709913466, "uuid": "e6ac2512-4de9-433f-abc2-b2c30dcfc6a4", "value": "hiao0k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2934905f-dd87-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1709928307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928307, "uuid": "e4188016-8d29-4567-9b99-415ac2261565", "comment": "Malware payload (Stop)", "value": "373dbc2f5f92e4b275e9a6716b432d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928307, "uuid": "5f512430-8ad3-4cf1-813f-51b5cf932b64", "comment": "Malware payload (Stop)", "value": "9f24cff00ff55730e61d9fd9a182f92f272735ba6ce55bc93bdc7ea24424dc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928307, "uuid": "4b6cfc31-d2c4-4ffb-aa92-82528767c508", "comment": "Malware payload (Stop)", "value": "a74b2bce1c8d9d89ec0cb5c80d4df3cad0a1480b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928307, "uuid": "2aae1b97-07bd-483a-b2a0-441c7b62b9f6", "comment": "Malware payload (Stop)", "value": "54aa47a3c5c293ca90d3e6bfe9497ba65113e309085f7b516b92e49eb014a75537e1224ef1df7f8331f0636e33e432fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928307, "uuid": "5016a452-d44a-4c58-9e2f-8358a7970e22", "value": "T174F41212FB90E0B7E2971D749979DFB126ABB992C632175A33D0677A3E303801622357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928307, "uuid": "6d525cab-70ab-49f1-b496-068b691e089c", "value": "e4b2b7336d3e0f97560f9bdf06345817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928307, "uuid": "e6e5c23f-7fd7-4ec6-b1db-744a1d9d134b", "value": "12288:OHJ05KhRStp9kf6pXA1BBoC+iW1UGIKYwpppP+MIzPcyWtnUjGrOv9hQsN/S/lS:n5KhYg6pQ17oC+e5wppBXIoNtUkOvQsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709928307, "uuid": "19161bec-1043-4d85-bd14-843e41d851fd", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709928307, "uuid": "0ffab34a-064a-472e-ab97-e3b4152e22d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928307, "uuid": "8429bf83-c620-4c11-b339-2cec06ffe4d0", "value": "373dbc2f5f92e4b275e9a6716b432d98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee296484-dd7c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709923913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923913, "uuid": "c6877ee1-6b7f-4494-a79d-057e74479d81", "comment": "Malware payload (AsyncRAT)", "value": "97afcdc892c1e6a15c344073bae2a8f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923913, "uuid": "9905fecf-267e-4bb2-8de8-6d22afb34686", "comment": "Malware payload (AsyncRAT)", "value": "9fadd95f85f5fe2ae6669e06144bec6184d15abdd97ecf0a3614d21183cd264f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923913, "uuid": "a35de300-5faa-4e1c-97ec-6e04d8d60434", "comment": "Malware payload (AsyncRAT)", "value": "dd0be39e42743e14d2e4d5851ef9a7ade81311cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923913, "uuid": "9c65ee27-7635-4869-af15-4ab2026924c2", "comment": "Malware payload (AsyncRAT)", "value": "9a84c7e3ae9bc5ee60d4d5c7c479a2854ad01b396a3cf3f9c54e20f87903232027085df8b87f941273d791338d66e53c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923913, "uuid": "bb3cce29-a805-4f59-a7f2-8f00abbda477", "value": "T1EF233B003BE9812BF2BE5F7899F22145467AF2633603E54E1CC451DB5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923913, "uuid": "136e543d-b541-4e33-b32b-219b252ddc4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923913, "uuid": "317e8cc9-44c6-4830-947c-1de2a8c0c3eb", "value": "768:wuyxNTAoZjRWUJd9bmo2qLWO5QfCBQPiNjPISzjbwgX3iPch92bpbdIj7ciCYvcA:wuyxNTAGL21O5c/iKS3b3XSPcOpbij7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923913, "uuid": "69b29f6c-70ae-4e8c-a1e2-aa52b07f9c3a", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923913, "uuid": "2ec18ec3-6524-4176-bda4-9dc21d30197e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923913, "uuid": "4460eafa-d01d-4c01-9b76-5bedc44a0b4c", "value": "97afcdc892c1e6a15c344073bae2a8f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f339c4-dd99-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936165, "uuid": "98454087-bd7d-4dda-849e-0d885739615a", "comment": "Malware payload", "value": "e7ba65fc4a45f1a5acdfa31a5652bcda", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936165, "uuid": "64338e21-a2f1-4c47-b751-ba2c3e910fc7", "comment": "Malware payload", "value": "a19aa0ada9ba9aa9343d0107e45c3ef56b124847469ecbfea1da4338e8984500", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936165, "uuid": "56371625-404f-4215-824d-bce327a6b104", "comment": "Malware payload", "value": "2514accaaa04311cba6d5423672659d09867a836", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936165, "uuid": "304eef32-b06b-433c-9971-0a109347defe", "comment": "Malware payload", "value": "a359ea1fec14326fc96ae75dcd49dbbb5e53fdd77ce45a247b26c987c9e938ad8f9ecffe5f9adaecf55e304ddfa90f16", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936165, "uuid": "90ebd6e7-6d42-4cc9-bc45-b96feba63d2a", "value": "T1C586E7368904FCC1177E744490AC3AAA1E989F6F47649274FC4C34521BF86B2DF6D59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936165, "uuid": "fd050b52-d0b3-446d-91ae-d48b702effb1", "value": "192:NSSWGDVWGDw2BVP79NQeSmG/4KDzvFaRVLE:cERJaf/ntKVLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936165, "uuid": "f169c9f1-04e3-4a5d-8c8b-1b6e4dea4589", "value": 8417028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936165, "uuid": "38d84589-088e-41d8-ab58-ce80bdf6a882", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936165, "uuid": "e940fa99-6deb-44ae-a0f9-b073b0235869", "value": "new.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c19e030-dd41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898355, "uuid": "a47508fc-996d-4fe6-8575-7a0f6c1f3f40", "comment": "Malware payload (Mirai)", "value": "aed9f3d26d357f5aa1bbb7072bd441de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898355, "uuid": "02f4da58-9b28-4615-9328-b1780354f4ba", "comment": "Malware payload (Mirai)", "value": "a34fc3a484893818524dfdee45736a896c129dac8c5258f28938d674de541526", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898355, "uuid": "fd5e5a9a-b8c5-4cee-b3af-346ffc442fc1", "comment": "Malware payload (Mirai)", "value": "4d948e4bc0c8a40e3bbb8f2746cfc93289416449", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898355, "uuid": "74a203b4-59ca-40bf-aa1c-b18b6328f92c", "comment": "Malware payload (Mirai)", "value": "a0d0af4e61a31ce82618962748e24bda527820c100545a8225f251431063211b9add83ca57444f7f8f32a46524fda472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898355, "uuid": "23623b8d-fa6a-4998-94a8-f9471abb4045", "value": "T1CD335C21B93A1E17C0E8B87A51F74315B2F5265F69B8CB0E7D720E8EFF2198069431B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898355, "uuid": "565f4a8f-0796-495d-b24b-deba9654b3ae", "value": "768:Z5op08OPCQT26XyTNDS5bTtTIO0I/0lI6t3O+378+Xm5vhW:Z5v8OPCQT2BS1tTIrRro0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898355, "uuid": "618a2db5-29d1-4b80-bc1e-3606f03fc9ee", "value": 50680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898355, "uuid": "2a1b22c7-51aa-40fd-867f-0bcdde3d25f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898355, "uuid": "ecdaea49-b510-4e94-bec3-989476a8f06b", "value": "aed9f3d26d357f5aa1bbb7072bd441de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262f7faf-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932597, "uuid": "9ecc9d2e-8944-4816-b15c-e2123a1cb727", "comment": "Malware payload (Mirai)", "value": "7410cb00cb7d5e38aa6fa2370dc1bddb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932597, "uuid": "6421e5fc-f72d-4d7e-8aec-6be439577e57", "comment": "Malware payload (Mirai)", "value": "a68e13f401dc9cdc273bd5d0dac99810d9768dcf111d493ed466dbbd4362554d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932597, "uuid": "c2597359-b758-449b-abf8-554ec443cefb", "comment": "Malware payload (Mirai)", "value": "6f24dbda13be653f9f0f4a0a5ca6ced32d1cc019", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932597, "uuid": "344d1e26-bf3f-43b1-9af7-13ef7a82b6e1", "comment": "Malware payload (Mirai)", "value": "0a2c652b18d51aee71274ea70b387941b29cd43ae7b7ec9fcea11810bdf481ea3d3a5bf06b259e15f7be7481bc9897b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932597, "uuid": "1ef5ad07-bfec-4831-8d8b-c6b272e35fc4", "value": "T1EFC3C70BAB51CEB7D85FCD77069A820110CDE55A12D9B76F72B4CA1CE74A88F48E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932597, "uuid": "3ea7d07d-29f3-4825-9ebf-437dddc1fc1b", "value": "3072:LcokJFFAdrNdhQzsJLZq+sQ3Ih4gw6Gb9uOW:L4JFG/dEsJdsQ3Ih4gw6Gb9uOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932597, "uuid": "281ed1d1-e2f2-401d-b2c6-ec29c89053ed", "value": 124743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932597, "uuid": "a418d9ad-337d-405e-80f3-9dd5a5b6ec6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932597, "uuid": "a52e06d4-073c-4912-8dea-94c651eb9f42", "value": "7410cb00cb7d5e38aa6fa2370dc1bddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b051eeb-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908178, "uuid": "87d37cee-5981-4edd-af1e-d136813d75ea", "comment": "Malware payload", "value": "b5c25db769931cc3db9069874c4682b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908178, "uuid": "4daeb4f7-e2e0-4d18-a1ac-3633580aba14", "comment": "Malware payload", "value": "a84c00ead6c345d4ddf53e9147379a4d0c5ff4220648de370fb7097f2ab5e3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908178, "uuid": "c56e9598-6f14-4068-9359-1f95e1812f3e", "comment": "Malware payload", "value": "55b22654fde0e871f18e9bb0d067575ffc07cbd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908178, "uuid": "23d954cc-f531-48d1-b49d-eaa0451dc24f", "comment": "Malware payload", "value": "61bddfc41113f60f2f4ce4602d4c57f51b2abf06c0757a4ce01214ff8c1d639277ad42c5fd7793ee321687769cdbc70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908178, "uuid": "5d3d04d9-6f24-4f44-a416-9da23cbaac6b", "value": "T169474B81F9C741F9DA426D30819BA22F27344D058B35CAEBE6957E39FC732D61A36309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908178, "uuid": "bbe630a4-3dd0-4954-b76a-4151ccfede85", "value": "ea509d361799935a94335b88f534a970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908178, "uuid": "91dc01c3-a5a1-454a-8b99-dd2d86682738", "value": "196608:mo9uC+F0jSiIfesV4gEttmJNrOXs7Spi8OtV6wyjnAK0vp4Nkr:mo9IwSvfezbmJNyX/8rP470vekr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908178, "uuid": "2d8fc637-88c4-469a-8b0a-82a957b3b073", "value": 25866928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908178, "uuid": "6d7853df-189c-4aa1-b784-cd69541325d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908178, "uuid": "7cc52891-b509-45f6-9ce0-7055a8cce36e", "value": "SecuriteInfo.com.BScope.Backdoor.CobaltStrike.27876.542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8671ae3e-dd62-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709912572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912572, "uuid": "92a8dc83-531d-43ee-bae2-664ffc3867f5", "comment": "Malware payload", "value": "f4d0d99263289672dbd69fa4462f8705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912572, "uuid": "0e68bb8e-2f43-4438-a46b-5cb478ba5a09", "comment": "Malware payload", "value": "a92d321b4a095f295fc30816a53b6076b184ba87553d874b268aebb48c2fc570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912572, "uuid": "d0a38287-ccc1-49ca-862a-bbcad982ba70", "comment": "Malware payload", "value": "df2d30854a3b1364d7a06fe10d94b86246856e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709912572, "uuid": "aba6e864-e4d4-4dfd-b43e-12266d2adee3", "comment": "Malware payload", "value": "ad8c79b1660764919429036a0cc60568b0eb9630c38bf520e3edf54d2d05e4a70f9875935d2f7a4358f8eea1452e958f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912572, "uuid": "d05ebab9-a8fe-41b5-af25-c4d2a70be4fd", "value": "T1F1E42352E5A47E31F2D49B321E067422E7BF3EC7665044538F8A3A8539728CCD90E5AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912572, "uuid": "318de532-9856-4d1a-b41f-88305796937a", "value": "32ca8d5fca836efa8536566f0eee05c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912572, "uuid": "5c7655d1-541c-46a8-bb98-a80be0df19a7", "value": "12288:zgCtunpxtov7Ks/tbE4/021uOqIJCAH7MNcm/dpV3lwX/cCy9ATyHwpIhwzpkh:DMpxts7PyaB5JCAoeQdmX/cHbH1GW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709912572, "uuid": "8354699a-94ec-47db-83c7-2a0be8b517ae", "value": 721790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709912572, "uuid": "4fae02a2-30c7-497e-8100-036925148bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709912572, "uuid": "df1be375-3018-4a92-bf50-225b83b7b3e1", "value": "baif4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac11e4f5-dd9c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709937546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709937546, "uuid": "1d0e0763-011f-4c37-9eab-8b647b4fa4a9", "comment": "Malware payload", "value": "3d45e52d04b0ae638442b23dd76cf2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709937546, "uuid": "7fa0a692-781a-4b9a-8bad-79cde856360d", "comment": "Malware payload", "value": "a9f1f5da055f6b147da24eb46f8f48ef014a55c3343cc1ada901b282d927ecae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709937546, "uuid": "c3332609-9230-4ccf-a974-c03f8ecdfc4c", "comment": "Malware payload", "value": "404e0b60eed90c579b55c6ff7b51cf33020c0ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709937546, "uuid": "3a6af298-8b67-45de-8169-b406cacc02e7", "comment": "Malware payload", "value": "fef41492923c699f04bbac8e80db9b7804a59804c612a04cf5a77dee090a5375c460927ee0173082432f621fbf34fdf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709937546, "uuid": "70bd59bd-2c93-471e-ad59-a727c377cbff", "value": "T1E464E11933B2DCF0F99279748D75CAA05AEFF8511635869B17902B3F1EB0290897E31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709937546, "uuid": "0dc64fe8-2a17-4d36-9019-a23f1ffb7a8e", "value": "e873892accab4ae9362103d2141a6549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709937546, "uuid": "f9110a72-8c1a-4dc5-bfc5-729d5a988632", "value": "6144:kDUKgyf8anGaRqogZN1tsoqKg2vMhG+9TADu:koKt8AgRPs09vMhX6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709937546, "uuid": "2795bbc7-0ae0-45e5-a711-e456810a5c60", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709937546, "uuid": "65f788d0-db67-43b9-b0a0-5f25c34de712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709937546, "uuid": "d18d59bc-15da-4918-a60f-545295d3eaaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d715673-dd22-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709885042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709885042, "uuid": "5a2ba3d1-1d02-4d1b-907b-004436e188f0", "comment": "Malware payload", "value": "1808131eb66ea5a6129b93ac6f6c4cba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709885042, "uuid": "53d20cce-57a6-498d-b52e-f63af631a934", "comment": "Malware payload", "value": "a9f548f8d82dd86f53015c7b5add82e5bd699ae1ffceece467253e87b04f71a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709885042, "uuid": "b76d3bdd-80b4-4d35-994d-641a0a35d0ba", "comment": "Malware payload", "value": "86984b201cd4783882f5d35ae757faa0b0b76fe3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709885042, "uuid": "da449cc7-b5c5-4257-910a-cb6258ecad1b", "comment": "Malware payload", "value": "1c283d702c7b893c15a61d04454c468b9c6831629a288ab0b8fa7001b3e1f58ecc863f03669380dddf7474c0cb6ff616", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709885042, "uuid": "e331a958-06dc-4afe-be1b-e5b23c1d7d54", "value": "T1F2C02BC8D02F0D24B33E62EF240836519085F40F0C141A4040E0DC95B34E02AB1C1A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709885042, "uuid": "4fa06c83-1729-45d0-bc47-16c550fef308", "value": "3:TKH4vM7RddH8xjq8771LbtiADMJi4Q3QyyHrB2Qi:heRddcVZlLbtiADehhyyLni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709885042, "uuid": "c01ec65d-0aac-4732-ac1b-077a811bea6c", "value": 148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709885042, "uuid": "4d7c7d6b-f0dd-429f-8c33-08241cd0d72a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709885042, "uuid": "47f3760c-d440-4604-af25-8651136089cd", "value": "httpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f0717d-dd52-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709905666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905666, "uuid": "73900bb2-0993-4de7-a939-0b4d2ca805c0", "comment": "Malware payload", "value": "d6111b89bc10769e398ddc3c5899f468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905666, "uuid": "8d47a433-1e7f-4dbf-9cb7-b479d067e9a4", "comment": "Malware payload", "value": "ab8883adf838951edcfa1dbb8cf5095c39732c5f12cd3288aa9b802ef4bc5395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905666, "uuid": "584e18ba-3c70-457a-b6da-d23d0faffeac", "comment": "Malware payload", "value": "2ad9e6af7f55c252420f5ef2d078b5c1ba0574eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709905666, "uuid": "8c7324b2-76c1-4d69-88a6-33e8c0601b47", "comment": "Malware payload", "value": "32c5a868888addd0cec6ae04a02a3c99fbf24f5d0f2cff38c43fd8fa288df039b601445e8b6e8868b9157871277f064a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905666, "uuid": "8f25c862-7e9d-4cbf-9ffa-355e6e79d16a", "value": "T1CD1502AED71BF441CBBF66386072281DD27644D7A582E20E1CBA91CAB3B32C46DD3457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905666, "uuid": "e3420dd0-cd53-41cb-9857-796a69a79720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905666, "uuid": "c53d4992-7145-40f4-8a9e-3839d8f40024", "value": "24576:tXeZC6En/BRimL8TqAVSg+3gsR75AUpYgA3c4j3:tuZCPJLl3lRyUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709905666, "uuid": "6644cd47-5a89-48d5-9289-c047a751e2a3", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709905666, "uuid": "7db22048-474f-421c-b0f5-7d817f86036e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709905666, "uuid": "30041f88-2eae-423b-99cf-0e0498f68eac", "value": "ab8883adf838951edcfa1dbb8cf5095c39732c5f12cd3288aa9b802ef4bc5395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fd8f5b-dd92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709933045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933045, "uuid": "9aa82a33-a81f-4714-aa8a-72d33de4d476", "comment": "Malware payload (Adware.Generic)", "value": "92993ba57b636e384ee89692fff57434", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933045, "uuid": "8941e745-423e-43e4-a90d-1cabf5725a7c", "comment": "Malware payload (Adware.Generic)", "value": "abbe60ce3783a8ece902a7ecd2a682be50d16ce1bba1e578d48f8da953f7da07", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933045, "uuid": "771de69c-506a-4000-a429-be377881c1e9", "comment": "Malware payload (Adware.Generic)", "value": "f04574acf9a1557dc54bfc72b379e2ffc3da90b4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709933045, "uuid": "84831c93-876f-4d1d-8b7f-2e32b47c2c6c", "comment": "Malware payload (Adware.Generic)", "value": "ff607dd7f5092db4d4c0c6ba5c6fb4ef2db4f6fcc8466f686a39310081933c37e59baa9b496de880413ad1db79057e0e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933045, "uuid": "e5b35603-e54c-4e73-a106-bb76a6e9455c", "value": "T1A536123FF298A13ED4AE1B3205739360997BBA61A41A8C1E03FC744DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933045, "uuid": "ee523b0b-c5c7-4515-93ff-5af56fb528f7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933045, "uuid": "f90e5382-4801-4ae9-ac61-4ec5e436ecb1", "value": "98304:SkLQIpGrAcgSNBn45dq/Wfmefs1TQAL3LDfDe0+9VNp1bksK97uwh3+bsTTa7P:9QI2/rp426fsBbLL3qptkIDsTCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709933045, "uuid": "36e4a06f-1085-48aa-86ba-e95705404b39", "value": 5327578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709933045, "uuid": "b202eb8e-18fc-4ef2-89d4-65c4cec4fa1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709933045, "uuid": "b5166b81-9f46-4b6c-810f-ee29f8d481d0", "value": "SecuriteInfo.com.Adware.Optimizer.8.24462.6793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9f5434-dd59-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908586, "uuid": "d424b58f-ebcf-4c6b-b217-b8223b42dfeb", "comment": "Malware payload", "value": "d63c97a2a73793a5436959320aeb5fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908586, "uuid": "09b5c6c6-fc29-4e8c-b1ae-b7b02868945a", "comment": "Malware payload", "value": "acbcf440766ffd5ff6b021139eeebdd4cd27b4cad2eabd09400d42e7c36cbc93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908586, "uuid": "1114433c-9efd-449c-aa76-e825eb2257a8", "comment": "Malware payload", "value": "291e3eb3af5e0ea6ac88d98318d68ad664a4747d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908586, "uuid": "232d6fa5-0cdc-4714-8119-af086ad34380", "comment": "Malware payload", "value": "96b2c0ccc7d46d6e678bbd1e84a178854714a850eeb0a923d81bd7e9251a7492d93dd1d2417ff7eb19180e0fa45e42ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908586, "uuid": "1ef8097b-9c15-4a33-82dc-9c6addb0c2d8", "value": "T194B40215376CF8A2D8214A324B4F86A71F643CD25A220E5F36606F3E7C70EA1D519F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908586, "uuid": "c60aa549-49f2-40c4-82e2-5f54aa3f49ae", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908586, "uuid": "15411340-f3c0-4cea-941d-fd2b548ea826", "value": "6144:hmOP0pJkkuNjE241F13gygfWo/GN8aIfZEdYoOUVla01li8FaPyCbhQxr9131s1O:akNE2cL3rJo/GN8aIqSRgUK1ceJW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908586, "uuid": "0f83d25d-cefb-4ee3-b60c-d6d7d520ebde", "value": 526411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908586, "uuid": "29d96723-0013-4c0e-ba05-9d9b38a677f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908586, "uuid": "fe037b4b-a2ac-4ef4-925f-ebdab2d8eff1", "value": "20240306 The new order about PO#PW225084YL.50L of 23AW1203A285 2ND SAMPLE ENR xls.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529445aa-dd84-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709927088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927088, "uuid": "5837818a-4801-460b-821f-431713cb4508", "comment": "Malware payload", "value": "d8df558c411548de703b56eac8e05143", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927088, "uuid": "7adf3a77-b150-474d-9657-e1b97e4d87a9", "comment": "Malware payload", "value": "acbfbf6fd00fa347a52657e5ca0f5cc6cbcf197a04e2d3fd5dc9235926b319d7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927088, "uuid": "4e42cd2b-4556-47bd-bfa4-c59abb0dda75", "comment": "Malware payload", "value": "b0c489a139435bbdf7b565fa70733b7fda1c660e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927088, "uuid": "6a53792d-319d-4780-81b2-1c10bc175f07", "comment": "Malware payload", "value": "49939c14c75cb638b3f8cd70868c15144c5c561119a398eaf27a55caf1a7cd5b2e6a6f0d4ee62de9f66f83fc4617ca13", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927088, "uuid": "2ea09bae-7b45-44a0-b3dd-e868a46376eb", "value": "T1D95533A865B56BD3CB80132DB456E1E9827F95F048B2F93B271D442D26C3C50DADBFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927088, "uuid": "e0c7ff1e-2c63-4521-b937-590162399d1f", "value": "24576:0EkS4d0mA42vni/50WwiA6lMxjcs2IqRI+pFtZUFPFSvPX+:XhI0A+ih+H6lcj/27I+jtGjwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709927088, "uuid": "795ec8cf-dd3b-475b-8130-c94b07d2b8aa", "value": 1321364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709927088, "uuid": "b3c6295d-fce2-4df6-9b81-6fed03e63bc4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927088, "uuid": "b3e7027a-ac67-4604-849d-b376fce29c86", "value": "Hybrid Warefare.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f89d8b4-dd84-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709927110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927110, "uuid": "ae2b0ee0-2a2e-4cd1-a49a-c96a05a4743a", "comment": "Malware payload", "value": "93218acc122647fb1ea170281303af5e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927110, "uuid": "1132a30c-b640-42ed-a702-f1716b19a8c8", "comment": "Malware payload", "value": "ae22f9da201032d007a0b3f54c3a53ea7a41292bba6e9855d48dd21b55c048ae", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927110, "uuid": "6c59d7d7-7d12-4e5d-b86a-581398d379df", "comment": "Malware payload", "value": "e0467f0f005dd394b7209962d0ddf34853ac076e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927110, "uuid": "5b760ea6-fac7-48e1-9bff-8b938c953609", "comment": "Malware payload", "value": "7a8ee9eeb35bfb3ad26af21f864e32f518864537c136c6e66c2a9fb8a7901533c33068deb1162799725a97c240c51452", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927110, "uuid": "3a34ec36-b4a4-4761-931b-8b4beb92b347", "value": "T1289423A748D36940E733D73696901F7672EF0612B0146FA84BABEA839CF0D875767A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927110, "uuid": "e35489fe-e6b9-42d4-b627-20e5af3644be", "value": "12288:Bd3pC5l2Upd28vRk2Cvods+wuclC9+g4b0cz:Bd3E2Uf2+1CvwwuclILs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709927110, "uuid": "dd5fa934-8bb9-4e95-bd73-1283f4d161e9", "value": 436383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709927110, "uuid": "d87608a5-c538-40f2-8169-dd325fbd89da", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927110, "uuid": "a5d35c86-04db-474f-a311-b1079fad0730", "value": "PUBLICATION_553.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181561d6-dd2d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709889624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889624, "uuid": "d1885fda-e41d-4707-915c-323eb92b1c1b", "comment": "Malware payload (AgentTesla)", "value": "ed06d0a2b54f63896fad92220cfa996f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889624, "uuid": "bedf5290-7688-45b0-9a20-4e6c7b3e1567", "comment": "Malware payload (AgentTesla)", "value": "ae67088e35d84034a56217bffe9aa3f830ea745b521432a6406106f446cfcee2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889624, "uuid": "fce09c67-f3cf-4f4b-8fa0-7bb9d42f5845", "comment": "Malware payload (AgentTesla)", "value": "e980059436fcfe66ce77ba7395906b515c23ce7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889624, "uuid": "4b3d0c4b-9075-4cd3-b57e-144d8d056971", "comment": "Malware payload (AgentTesla)", "value": "5e6c9930e229b1532fab9366702b2fc6e1e010e39289732528d934df2ce7bc5ecf32c6323928f4f86ec869b4498c1d08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889624, "uuid": "44ace9ce-563d-4cd2-a20e-1b5ea4f91713", "value": "T1E4F4136672BCBF29E13B97FA15331590A3B6B44A5825F68C0CD390CE59A2F044B31F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889624, "uuid": "359ecadd-fa3f-43eb-96a8-5e74a5c4ea31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889624, "uuid": "af5904d7-b609-425a-966e-7738b8cb3c37", "value": "12288:6vnFtImAFNyr+uxiCaYSt1vQU2bKPIj/f5dpleqIrAEv+txXzoE/qkPY:4F61FalixYS/C60zplVzxj7dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709889624, "uuid": "fb42df30-139f-44fb-8230-8b75efaa7e5b", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709889624, "uuid": "d9a82e68-3688-4721-bb8f-e8bf51958416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889624, "uuid": "0a0da0da-8236-4f48-b9c8-f5ccf35c5c8c", "value": "SecuriteInfo.com.Win32.PWSX-gen.6931.14638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cbd2b5-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932590, "uuid": "d3ba898e-e834-4a99-ae37-b74351fafbbf", "comment": "Malware payload (Mirai)", "value": "463efc7550b1d1100e6d0fb8a901032a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932590, "uuid": "1b1b5d6d-d81e-4748-878c-8520d3230789", "comment": "Malware payload (Mirai)", "value": "b132aa0e278cd36766d5e3443dcaa6d9e0dcccf61dcda4b03e543084f06e2e7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932590, "uuid": "d80b64f9-d054-47c7-a1bd-7caf5ca1d527", "comment": "Malware payload (Mirai)", "value": "acd0f0cf546bb4c09a2bdc842f6db2dd8f916a43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932590, "uuid": "d03cea44-4029-4584-9af9-67359b1eae39", "comment": "Malware payload (Mirai)", "value": "b2c2ff860013ae12b751f1d5eaeb4e3e64ff7702440cfd99942f79d61e98a8cad4379fdbf69e1c72fe39d29cc30af96e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932590, "uuid": "543314c8-1e92-48e1-946a-105710b4548b", "value": "T189C3C56A3E11AFFBE5A8863147F35B70C3D5329626A29781E26CDB185F3128D0C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932590, "uuid": "2ee5013f-67a5-4c29-841d-cefd4e599710", "value": "3072:DVlj/PaHqoNFBNSMdhQzntc43Ih4gw6Gb9uOW:hV/PalFyMdEntt3Ih4gw6Gb9uOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932590, "uuid": "ebeb315e-1ca0-4792-9505-609640cbce95", "value": 124599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932590, "uuid": "f75889ab-6820-4ee0-8bdb-f691070f7d86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932590, "uuid": "5904db5a-7157-4956-9984-208d55545949", "value": "463efc7550b1d1100e6d0fb8a901032a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5ed6e7-dd9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936609, "uuid": "361cd389-677e-4fee-986b-4a5b0f98292c", "comment": "Malware payload", "value": "1faa8b92b51b09c16a5f1368ee87c9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936609, "uuid": "d5d94875-c068-4229-9406-501f286d2801", "comment": "Malware payload", "value": "b19b4aef8f8129afdd60812b12e227592ba670324e0a39316b62c329c6a9a044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936609, "uuid": "fcdc3993-bf25-4299-97a3-345f6fa254e6", "comment": "Malware payload", "value": "25327fab81a252d1917b44b2e3ed4024ccde9e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936609, "uuid": "c02d839d-7ef7-424b-bf19-af3115f57926", "comment": "Malware payload", "value": "846627e4d48f4043f08ad27f8caed0cd242d63c26455e6bdad9712f2bdf98b298a30126776b2ec2a331e992d658c2b1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936609, "uuid": "accd40f1-a0f8-4dab-82f6-8cd57ea96daa", "value": "T192E612107CD29563D1132031AE1E77BDB47EEE60477B41C31B487B5D2A29AF25A3BA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936609, "uuid": "0531115b-0acb-4345-9df5-ddf4c24097a1", "value": "54790642bb2011ff01d2827d7adb5dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936609, "uuid": "dba84610-b283-4e43-b706-91c7abebf6c5", "value": "196608:fpwquP1rhJQxjUCqpggY5YSjRKgyt4SOT8bbMlcnDkDHe7xaFTkXf4BoBfZ/ng5V:hwqY1eOggY5hRKg+D8DHsx9QOfZ/EwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936609, "uuid": "48d6098f-518a-4891-b491-8554c641b705", "value": 14822912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936609, "uuid": "81a45034-9b3b-4ace-9cf9-e9b6caf56a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936609, "uuid": "fcfdea10-2aa1-41a2-a1d8-31e8c6eeb323", "value": "SecuriteInfo.com.W32.Bredolab.O.gen.Eldorado.6984.5784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a1aa84-dd03-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709871666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871666, "uuid": "3666d964-2676-4ca6-aef7-5378bf5e7ea0", "comment": "Malware payload", "value": "d92da4af34f68c8fc07a48c3eb6c0dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871666, "uuid": "b07783e3-4e90-4111-aed6-5d49336bb454", "comment": "Malware payload", "value": "b4bf95f7930a88a7f0220e020c3cbf4938b88800a78d98e51c3bce3beed1643c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871666, "uuid": "7ddd1aa3-fdf2-46b4-a4fb-f39a495d8949", "comment": "Malware payload", "value": "08eac8c6ddf07b9957bd20c0a31fa22d151a17cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871666, "uuid": "e346139b-afea-4464-bd12-95b77f8fccb6", "comment": "Malware payload", "value": "6a68ea6f900b812bbab590618db17ac7734566b651e5a85e1e04a9477d773badecf287b195a2dbe676edc0d7c795ea72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871666, "uuid": "fb1ec889-b9b8-4393-9a35-1d1b788658c7", "value": "T1636412B685AD63B1F1F12CF2949677E74BA1CF1233A8054DAA8C70B6F037B7256D1290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871666, "uuid": "70d35701-f7a2-4598-844a-e7ce37261144", "value": "604d14eda74ecb05dc3fd3f2233fd004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871666, "uuid": "6aab4cee-79cb-4982-b718-e568235eebec", "value": "6144:JxpqDW7CxijxIgWme7CDDeO95vcBuQUg3AMk+5hFtlKmiIrcsTyeX78l8a5BoSaS:JPqDRlbhUTfaucAMk+5hLdxTjcoSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709871666, "uuid": "2dde9ae5-2af6-4557-bec2-11d21f1cf289", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709871666, "uuid": "ef1499c6-1130-4fd3-afad-5218d9e2f12e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871666, "uuid": "d8968413-57a9-4dec-b27d-bd1ae0cc97c4", "value": "SecuriteInfo.com.Win32.Evo-gen.10759.18333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db8a6a-dd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709935625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935625, "uuid": "09411be7-231a-45fa-b863-4fbaaaa5a6e6", "comment": "Malware payload (Mirai)", "value": "43612c45701dc6107a8850c551831ba4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935625, "uuid": "3eecdd75-7f6d-435d-885f-dfe4aeef25b7", "comment": "Malware payload (Mirai)", "value": "b52f616e66b9e2903a07030400b48780f15e6b052df4af5d04562261c8189cf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935625, "uuid": "3b52adde-3d9b-4515-8c3a-8705911bc972", "comment": "Malware payload (Mirai)", "value": "b3fd86bc396ee98277e3ea248a3277d7053a45a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709935625, "uuid": "b59a5f85-b2a2-4ee2-b961-ca04b00738c7", "comment": "Malware payload (Mirai)", "value": "70f64df616b39edb37569a36b39fd690ea31ba7124af0e85c900567a0bddaf232f128c1e8510a96970e9f51fd4980b3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935625, "uuid": "9e567317-dcd3-4731-857a-bfaf09703799", "value": "T118A2D025D3456EF8DFAF9D9056C2C3C27BE546C6278AC8E340EEAF017916046B788C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935625, "uuid": "a87a6ce2-a92b-47d2-976b-7df3afffc0bd", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5b4DM4uVcqgw05VxJ/:9RxsSVsMD6xiJJE5zRWNT4uVcqgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709935625, "uuid": "99000e17-4836-49c4-ad84-c79315d2bd5e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709935625, "uuid": "c9b15f8d-7cee-4d2e-a206-da66f7f2de5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709935625, "uuid": "ab661de7-f748-415a-a40e-706c93626abe", "value": "43612c45701dc6107a8850c551831ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72890c6f-dd15-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709879468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879468, "uuid": "cdb0e880-49ea-4025-a829-a8f036a2f16f", "comment": "Malware payload", "value": "8d184320446e65a4ea2bab20f5485a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879468, "uuid": "3d9a4d0b-b902-4150-9e3b-b10f51b29891", "comment": "Malware payload", "value": "b8d16e3baf21ebb5ac7c138bcf5a71c4b195d41dd96d58919052bb3567bd367d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879468, "uuid": "577826e1-7ae0-4c4d-ad9b-811fa769cfc5", "comment": "Malware payload", "value": "8d6d761d03fcf7aa13239b49303bb3ef148cc027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709879468, "uuid": "ccc7ee54-bf3a-4bfe-8d6b-a764bb51216d", "comment": "Malware payload", "value": "235106fc3a43d5814ba87a0cb658b211d25d8c24dcaab2f1fd20500524402f2970e013850d6cc224bd8c49173bbc3d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879468, "uuid": "cc70ef2e-f811-4f19-a7ed-ba2f28a81a1d", "value": "T1E1E423E23B4C8953E67E9DF49561380377F2EA630AE2E3E53C4C64D87C527607612C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879468, "uuid": "e2d9fb1e-6293-47c6-94a2-fed9864a4e18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879468, "uuid": "749a1ce9-b7ca-4c99-8bfc-1689f249403e", "value": "12288:W6FtImAFqmeeYQhbpv6Kl2iSt8UgWbtiR7jkorqWXbkNbrxB+ZkR:D61FstQLhl1A3gWpiSoWaoDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709879468, "uuid": "f93e13ad-4163-436a-a5cf-8f5d44bc7627", "value": 674312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709879468, "uuid": "0bc99900-25d6-4543-96ea-968b78654dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709879468, "uuid": "8a467f57-12e4-462c-a13c-f0178566a9a2", "value": "Overdue Account Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a34b9fa-dd36-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709893708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893708, "uuid": "ec5a1057-4f89-4e24-af2d-68eb0f99f531", "comment": "Malware payload", "value": "7e168e58f27d5cc684c5b45cb1551f46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893708, "uuid": "3ab019a8-3d7d-4fda-b669-033486813d26", "comment": "Malware payload", "value": "b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893708, "uuid": "0cc87484-d535-4837-8619-9b29aa31a8b6", "comment": "Malware payload", "value": "659b8a50bc4d381c95bdbd4b977700f9fcd8e52c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893708, "uuid": "41be2f33-0687-4e77-b360-66d14e5a336d", "comment": "Malware payload", "value": "26d4f1d8a79eedc694d17c4764351085b2bd768a90f768a2f5fc8a950b925da2eea9015ecbfbeda2aaba45e605cdd012", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893708, "uuid": "ba0286e5-e415-40c8-8a07-8e5fbf644a4b", "value": "T1A564390F2151E929F42817303438E5BD94A96CF06294C2937B81FF2519F62D26FA7BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893708, "uuid": "81334bd9-532d-46fa-98f4-be6f2e12a159", "value": "4bad3bc1bf8e5d1161dcfe7b97c81b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893708, "uuid": "0175392e-61da-4d3d-925b-541541bbd139", "value": "6144:H/Fiu1ttQRQ8FYhVTu/v/sJBDklP29tKaaj:H/1tQZFYhVTCvUTDRzaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709893708, "uuid": "73fa5b71-ac6f-4cd8-a2eb-cad327bc8558", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709893708, "uuid": "7c13d4bc-8927-43d6-9af0-5750a6056b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893708, "uuid": "56fd27ca-028d-4209-8f6e-cc1a7cd7001e", "value": "b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca0563a-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921307, "uuid": "b465fa17-752b-4daf-8211-5a9bcf806957", "comment": "Malware payload", "value": "78de600219031dd439a4fde06db34a41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921307, "uuid": "c5e4a3c7-905c-4578-916a-15dd5808bc97", "comment": "Malware payload", "value": "b9e427b99f1d1ba4645ed910c33c04355b7ffc17b8c69bb0554a97971654ff03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921307, "uuid": "439a09a4-c876-4cb0-aaf1-2997841e6623", "comment": "Malware payload", "value": "dee64903a306bf03f8cd26245bc9f4921da46fe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921307, "uuid": "e25acc9e-2a74-4c1b-8019-b609e8477b2e", "comment": "Malware payload", "value": "e270ee592a90b2298a53ad3f9dd788221198cd37813ab3d146d00a33e456873008637413a3e9d78b996471f7d7262f63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921307, "uuid": "847e2ba6-cd0d-4336-82f5-c52373d60f2b", "value": "T1E253A519BF650FB3DC6FCC3706EA1B05288D654A22E87B363934D868F54B24B59E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921307, "uuid": "ae6470bb-cf90-4c4f-9e74-1d0cf31b9df9", "value": "768:/N082Knwu71UX3ISqeoHetKeWNfvRwZMM+XiowpOxW33w:/Np2KnVZfdHYK3NfvWZMMTQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921307, "uuid": "b6f5660d-d018-47da-b5d8-51105522ce13", "value": 64276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921307, "uuid": "d2a17336-3dc1-4c96-9623-15dc64cd1df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921307, "uuid": "07c6b0fa-b44b-45e9-a85e-e2e9e72e5e13", "value": "78de600219031dd439a4fde06db34a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0461f52-dd67-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709914897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914897, "uuid": "8b1d7c99-939e-44b8-968c-ec8fe7e3df8f", "comment": "Malware payload", "value": "35a8e2a645482670285f618d412c14b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914897, "uuid": "1822a7ff-560b-433d-8b83-a5c44265060f", "comment": "Malware payload", "value": "ba42b13fafb9b38cc905b0764c8953cd0888c203d17dfd37f491de1793cc7c0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914897, "uuid": "6cacfc63-a1d2-4e07-ac55-78b6bc1869bf", "comment": "Malware payload", "value": "3c1f12156bc479a920ca876fc3eb1b9dbf52851f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914897, "uuid": "e2f2dc59-02bb-49f7-b6c6-896987fb9b3e", "comment": "Malware payload", "value": "7f38a932be64442922f9eebc1c03280d680cb8df757583385a931771cb6559a56f4060a22c3a433170aadb22b9ff7a43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914897, "uuid": "123e98dc-34a9-41d5-a75b-315bcfc923c0", "value": "T19DE56A59EA4340F2DDA35170515FF77FCB306A098035DBABEB89ED04FA336D1AA09219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914897, "uuid": "a937b533-3487-45ee-b05f-3eb47409751c", "value": "49152:SveXsjEQrw7SKwh0KnWpP69ZRAYUdCk4BsjbubWmGIDV3NUzwbqtIHVxG:S2krewCKnWpy9ZRQdCk4Guymt7fdxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709914897, "uuid": "bacc4c44-7ec7-4f48-9b81-fd7a2fe1e6d7", "value": 3076962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709914897, "uuid": "a4c90083-b9ae-43a1-b7bf-4356a365a019", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914897, "uuid": "f6a25f65-eef7-4262-b41c-6404a4731aef", "value": "sark5j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a84f303-dd69-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709915505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915505, "uuid": "fdc32837-8acc-4247-85cf-9a97ba2e50a6", "comment": "Malware payload (Stealc)", "value": "89c65c707c1272db211c9eba6ceef33d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915505, "uuid": "0bd701c4-e1ac-4eb7-9f42-6f220a7944f7", "comment": "Malware payload (Stealc)", "value": "babcd80ae40961d429451fe9e737852810a1448c2666ab4b29d329763cf2f2c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915505, "uuid": "bbdadd5e-a0de-435b-863a-3d8029885daa", "comment": "Malware payload (Stealc)", "value": "70d727481d6bb784e2199c81f1d0ef3850f36477", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709915505, "uuid": "4e5d228a-fb81-41e9-ac14-bf1169b42937", "comment": "Malware payload (Stealc)", "value": "7c60768770b52708f2f0f72c3cb3896c6bf2c51e24692f6312631c55b043c3ce6a7c7eae5672e9ba97eeeefdde63767d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915505, "uuid": "e4cec9ff-c0b6-474c-a32c-35d5f742a900", "value": "T1DB24CF1923B2ECF0FAA279708D66D6B05AEEF9514B7447972350263F5DB02D0983E32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915505, "uuid": "bfba7298-94bb-45ce-a4a5-0ecd48d6a10d", "value": "89477119239b07e41fe167cc01656f61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915505, "uuid": "e2336511-8582-4c95-b36a-7303dd3d481c", "value": "3072:KzTwtIfhv8VDhCXuQBA8lr9kZMpa+V4xiLZxnvb4zSqq8v8X6cDUtR:gTwUGk+2A8lr9kepauDnnBDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709915505, "uuid": "6d298ef7-b205-4af6-9ba3-d4d2213d3f94", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709915505, "uuid": "f84810b3-8aed-42ae-a1e0-ea6759d98be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709915505, "uuid": "ce0439a3-ed0c-4645-9e79-a489597b0cc9", "value": "89c65c707c1272db211c9eba6ceef33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6d7f02-dd03-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709871669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871669, "uuid": "d35eb3ce-1a12-4935-bf47-7ca1af15c4b0", "comment": "Malware payload", "value": "cec42c46f7d859315683e486d91f4584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871669, "uuid": "1ae39add-89e1-42c6-adaa-ee8555b10d91", "comment": "Malware payload", "value": "bbe21d39bf22888323f51de0ff9d6fdaf1b5d452aab4bb9196f33180e447d2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871669, "uuid": "7e0d62d1-26ee-46e8-b7de-2d2ffe1cad17", "comment": "Malware payload", "value": "b649a73d2b8b78457c413f4a3027729e266a527c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709871669, "uuid": "47ac3e86-3d77-4847-bd7b-0f2220a1da88", "comment": "Malware payload", "value": "dcdbc13e1d8d0a113af4fd3e89cb8103e14db9dcc0592f94c9bc84c08df908cca301fcb8c0d990649ae8fc896bea5402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871669, "uuid": "cf9543a0-ff70-419a-9dda-c3a0f75eb3ef", "value": "T15D46E07FB5D500D8C22B55FBE0BCCC0C6B99A6729B673084EA2B877166149DB7344F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871669, "uuid": "8c6475aa-a5ea-499d-be5d-8abe14854f19", "value": "14676fbd4caab261438367fb0e586a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871669, "uuid": "57c6c174-f581-4f9a-bfa3-c0e38c15c7c6", "value": "98304:MbfZ9j2c5LP6TKYYjeY2804gC3LSa0myaNjlT22Op8yP2DSPY3aRPVfflwIXh7:Mbfjb5LPK8jllp0myaNjlTdSAggE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709871669, "uuid": "af658c77-9585-44b2-932a-c89bd39d8083", "value": 5467416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709871669, "uuid": "eb5180cc-11b2-466e-a923-a4de473d22aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709871669, "uuid": "b3921fa2-7646-4f1a-b498-90ded5e6df63", "value": "SecuriteInfo.com.Win64.MalwareX-gen.24746.32521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc64b26-dd84-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709927107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927107, "uuid": "c3199357-f11b-4b94-86f4-52c621efbde9", "comment": "Malware payload (RedLineStealer)", "value": "bab0c012ede4edc3c262fb887bbcf748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927107, "uuid": "b848ca68-2229-48e2-87b4-9969236f4885", "comment": "Malware payload (RedLineStealer)", "value": "be060b4ecd98f409037a0ff872f7720987c02d60d5ad6255960302c4b7cf7f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927107, "uuid": "10858f98-aac1-4da7-9516-1e91677407c6", "comment": "Malware payload (RedLineStealer)", "value": "9e266718f491447d42a72d2c0d1fb81bd2d78dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709927107, "uuid": "6fe71d3b-72d8-4cd2-b09c-ddf679966ef6", "comment": "Malware payload (RedLineStealer)", "value": "f2bf3c668b30f2ece302dc1af852111c86d32f0f4fa792bbe64b5ae32535aa9154257d9a76b4fc25d84079278b8b06d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927107, "uuid": "92c218ea-68cf-4785-a53d-316315990ecc", "value": "T1F5846D0FAA56D861C3AE4773D0CE52260770CD59D9C6D317BBC1FFA63A1376AAA02143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927107, "uuid": "9fc3a5cb-2a1d-4368-ad77-0504a67e0897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927107, "uuid": "51264bac-3fe4-4b48-8582-3e23ab3774d5", "value": "6144:Il3KSbD3E/2+2v4oNnvk1VqLDHMKLDH5FI0nxX:I5KQEev4opk1YL7MKLDH5FIgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709927107, "uuid": "0b50ca6c-bf6c-42b0-ba05-5d83006d75ec", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709927107, "uuid": "33be333a-a8ea-4f42-b524-24cd583ce848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709927107, "uuid": "b3e72511-f848-4cee-8aed-6934c0a8c37c", "value": "bab0c012ede4edc3c262fb887bbcf748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2670abe-dd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709928940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928940, "uuid": "80de88d0-de0e-41b5-978d-ad59f55d28f7", "comment": "Malware payload", "value": "667aa6ae90136dda41300e4f668932f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928940, "uuid": "5e99b39b-ad60-48d3-8c04-6f8dd80ab634", "comment": "Malware payload", "value": "beb03f0089fe98fa82414bb1ee2cf421b63a5a195e1aa25c542f6294bdb55ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928940, "uuid": "e2b3af2c-cb01-4c91-8050-8a1045f73601", "comment": "Malware payload", "value": "37f0b059e03ef0fae54c56ae33d3b156da9b02c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709928940, "uuid": "1547377d-a7b8-4c40-bc26-c7f677aaf8fc", "comment": "Malware payload", "value": "bc0f6a4a95e7171bcd8e6cbaf2a42b0c69899cd42af84a908762a36a33322b195d8524bc306b691198106d92b503d909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928940, "uuid": "71d3570d-0901-4625-96f9-48386f67cce3", "value": "T18FA4CFAA13A7C17BE7E902B4E0414607A3FC85CAD361F719A96414F09C267C1F6A737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928940, "uuid": "6cbe6cdf-8a28-41c2-b51b-2a9203ea302d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928940, "uuid": "c96109dd-ce2f-4025-9c52-79359ca0ac24", "value": "6144:HeUUtGhDAl8FrxEhyTXSAjC9C2qHzTKqjBS27uwbPSijjNydQJjJqO98pPJ:HQsTXlF9jwqKkN9JqO98BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709928940, "uuid": "d406ed34-c928-4cb3-95b6-741ae5061aa7", "value": 480392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709928940, "uuid": "387ee6ef-30a8-4efb-8cc8-1c209fd41625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709928940, "uuid": "e5cc3d64-1acc-483d-a82f-8015e524b74c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0f6914-dd2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1709888902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888902, "uuid": "8049788a-285b-423d-952f-bc54053fe79b", "comment": "Malware payload (QuasarRAT)", "value": "77a90be3321346e8f5634f9eb8b4d0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888902, "uuid": "e775c6b7-6c0a-4af3-926b-9a7e5d04f33b", "comment": "Malware payload (QuasarRAT)", "value": "c382b67f4330082877b179fa1d7178cb8261f7519b2bf46965e6cabcd4c943b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888902, "uuid": "8b1c6ca6-32a5-4fd5-b881-fc9c1dc39acc", "comment": "Malware payload (QuasarRAT)", "value": "b3ee9e495f2bea953426d3089aa6d5cf931f9965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888902, "uuid": "b7031cbe-d381-4ada-9fcf-48b408907035", "comment": "Malware payload (QuasarRAT)", "value": "22b9d10dc9ad5e3188360c5dd66f6c5a5ed26dc615c69fe1efd16bb7dbe1e78eb646f9577c5cf13733682bc8908c7ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888902, "uuid": "687fa58a-f592-4a63-ae22-2f2625fd255c", "value": "T1C6E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888902, "uuid": "03534b23-db8a-4d9e-9dfb-80116b3e520b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888902, "uuid": "29b731b9-cca2-4185-ad54-07531a76cae3", "value": "49152:KvBt62XlaSFNWPjljiFa2RoUYI4ORJ6ybR3LoGd+eTHHB72eh2NT:Kvr62XlaSFNWPjljiFXRoUYI4ORJ6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709888902, "uuid": "880c6b32-a476-438b-afa9-ab9fee1b8d32", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709888902, "uuid": "216564fd-7439-4dc6-8b71-52a852ba9de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888902, "uuid": "7517dc42-ba4f-4404-900e-a2344ce8bc54", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbb2113-dd2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709889046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889046, "uuid": "b89385d5-b093-4862-ae18-b7c393f5039e", "comment": "Malware payload", "value": "25342d539a09f3ce5d0b7af39e58f229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889046, "uuid": "ef2fa892-4592-49eb-b600-8d7f3a36aecd", "comment": "Malware payload", "value": "c7fb77d22e1d937220cc3a7527dd9eb6f5b663da81c830c67f1ba892a868ca27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889046, "uuid": "51f12928-acc3-4e1f-9c9e-3dc19e29a705", "comment": "Malware payload", "value": "678d470a4d8c9d62eb0df8c0f7d5969254e2b84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709889046, "uuid": "35b74dae-87ba-45bb-8a4f-24b3eade5e07", "comment": "Malware payload", "value": "16aca34eb0f3cdcce47fdb7cbb832656f681670abcfa96efda5f6f48ba945a77bbf9adb505978a322d940134cd651dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889046, "uuid": "a600e955-5605-45a4-aa85-f6b87b79132a", "value": "T149B533B1006BE15DD4C34B3246C58A8B4F9CAF990F9EEE01EC1E975F861B168D8E12D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889046, "uuid": "6ff6db4e-c096-4786-863b-3253bb15ed2f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889046, "uuid": "d7dc52ee-655c-42a3-bc35-ca31d0aabeef", "value": "49152:+gXYCXqPGOdzgkX1F2wsDhxnCH+nrp6SSbpWnxJWA0ReEagj5B7/YEJbOHP1:3kh+wstx6W6SasWA+e2RJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709889046, "uuid": "d97d15e5-76f3-4a7e-ae28-0d34c6988cae", "value": 2407424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709889046, "uuid": "edeafd9d-5fda-4862-9626-c959e8a7458f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709889046, "uuid": "b9a086dd-cd40-44dc-9d5f-7a37ba063eed", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe99446-dd91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709932667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932667, "uuid": "362010d2-c959-4d8c-864e-dd0940100b23", "comment": "Malware payload (Mirai)", "value": "1fe171ed69936e4222a5f3895db76f9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932667, "uuid": "88497aef-6d73-4a54-895b-1bde7042f64a", "comment": "Malware payload (Mirai)", "value": "cabe0a79592e615df2baba1774f7d7fdb5a789bf768b60f59f135af17bdeb29a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932667, "uuid": "1d226c7b-6362-42c0-a208-915c8ba6247b", "comment": "Malware payload (Mirai)", "value": "c4cac92af0d81dcea85ec1c3a5fa4f0ed676238f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709932667, "uuid": "9dd7bf2b-faa4-4d2f-984e-486f76fa812d", "comment": "Malware payload (Mirai)", "value": "ef8b0eb248b35c6226f8cfa0607c7eb216d65196a5e599316c3dd26ca0fa53055eb7e6eccc617fe12e3cfa04e6ebc77a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932667, "uuid": "4e92c27c-fd22-4e12-8621-f9bf2bdf8fb6", "value": "T1FDA309A3FD00EE62F40A9A3A0AD747247630F7670F832975736779659AB13D43822F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932667, "uuid": "75dd7bbf-7088-4276-88e4-bfebb957323e", "value": "3072:rKEAONOPywf1JzcjEBECyqcE2j7yhwumLUVBCv3QX5W:riOBu1JzcjEhyqG7lumLUVBCv3QX5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709932667, "uuid": "42b3a2d0-8bf0-420b-be03-05b05fbd8c34", "value": 103317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709932667, "uuid": "3567b633-5d4a-4252-82f2-6c4ad6f65578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709932667, "uuid": "9487bbe1-fe20-4b5b-9874-29bc7faa9b4a", "value": "1fe171ed69936e4222a5f3895db76f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7c61e3-dd2e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709890383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890383, "uuid": "39057ec7-e9ae-4a3b-b79c-38d226c6138f", "comment": "Malware payload", "value": "e36a95382c9a3b1ca01cb86f8ef78795", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890383, "uuid": "bf628dd9-9217-477b-8e9e-e550cae1ff66", "comment": "Malware payload", "value": "cc51e5e96d789eb389a0f280a12a73ef31fdaf0665c17631aa9f1559bb2dcfee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890383, "uuid": "75ac7774-f124-4e65-bbe7-b8165f3129b8", "comment": "Malware payload", "value": "9e14efee94c467734da28a8b3019a37a05d1de19", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709890383, "uuid": "bc6726f4-a340-4bc8-a466-b9fac7c3cecd", "comment": "Malware payload", "value": "58532125e124a20336559d03c102027f71b68c11094d49ca79dc83bf64173ff6846d4129389a76e33d3ac9e41e48aea6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890383, "uuid": "e8595416-24cb-4921-a760-6ee2f232276d", "value": "T18D1533F08D985886A1CD092C774B65E4F5B03F76DF2801487F641E96B9ACF050A78FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890383, "uuid": "c8f74a44-1398-4721-85a9-0c6b2c1361f2", "value": "24576:SoNRmQBSeFtoNRmQBSeF6lBLNt2x3Z/faZ6RmnhJ9qO6zuU3x79q:SoNR/BToNR/BMg39asRmnT9qXxNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709890383, "uuid": "e9d78e93-e3d1-4d25-a881-deded7843dd4", "value": 899498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709890383, "uuid": "f2bb4629-c5eb-4e19-964c-64d835339ab4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709890383, "uuid": "86f45dc3-ad1b-45b2-971a-04a6109dde4a", "value": "UNB-DHLO88938MBANSOPE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2f8f4b-dd60-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709911585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911585, "uuid": "745e8e6f-8dc4-4617-a3df-3d223e2ce61d", "comment": "Malware payload (AgentTesla)", "value": "b3cc065a08ae54b888715fc65a1daeb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911585, "uuid": "d7ed0db7-9d96-4d27-8d53-49cb3dbd854e", "comment": "Malware payload (AgentTesla)", "value": "ccdb59873a1a5c0bc377b8854dedf692a10c9c4c9231e0ebff9365ca2e779db9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911585, "uuid": "7d87b25f-e75f-4a63-827d-44ba37399579", "comment": "Malware payload (AgentTesla)", "value": "de75bab87e1256c79fa7d0ddea288222273ea59e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709911585, "uuid": "01b7947c-c335-47ae-9b6f-d709bb1e1946", "comment": "Malware payload (AgentTesla)", "value": "b6bb7344749f10d8a1d5a02191529edb4339d0d29e46899d2a7f220d9a6ebc46911af94b58e9631d625d7bf29283ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911585, "uuid": "ce2f0dd3-608c-4aab-bddf-42f3504493cf", "value": "T11A25BF2373DD8361C3B25273BA657701AEBF782506A1F56B2FD8093DF920122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911585, "uuid": "3d4145e4-7828-419e-bec5-39f23079ce5d", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911585, "uuid": "6ea02d12-9bf3-4e11-b602-e417c7c7cf88", "value": "12288:5tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgalTJ0fxBWvx8cs2048Z5:5tb20pkaCqT5TBWgNQ7aRJ0ZYXD8Z6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709911585, "uuid": "cd00d6eb-8f12-46f7-a973-ff4ed0b0d585", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709911585, "uuid": "0c1c2d0c-fd82-48a4-881b-6d23de48f2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709911585, "uuid": "8e91c000-1f36-4c9f-99c0-b99eab273384", "value": "rOrdendecompra_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9daf500-dd35-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709893438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893438, "uuid": "ad640291-d6a5-4153-be5e-62fce7fc5cf9", "comment": "Malware payload", "value": "ea176a4e93f1ed89c3e493572955cf00", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893438, "uuid": "0dd016fe-2861-4e79-a9a8-0246c96fd351", "comment": "Malware payload", "value": "cd737ac8d66a47d341dd4a3c98ab0d2c77c7558d9a0161f7d08a4ab310d440ba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893438, "uuid": "9106434e-5675-4feb-8271-f21fb96a74f2", "comment": "Malware payload", "value": "aa513637176745a102d97417a5f5b2a902d514a3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709893438, "uuid": "9fa09faa-2335-446c-a61a-7f27eb2e803f", "comment": "Malware payload", "value": "ae7fb32755c09cff28c131b53380f76f9c4e9e058390522e9e6d8866a23d25ba54084fa7a4a8083d30756ae787a92c85", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893438, "uuid": "4f34a9a5-3c44-47fb-9f03-61193a2e88ad", "value": "T1AAA53385F07E24B65C47D35A683E05980B3B56DEA83C5BBC98948D90B7F273D693DC80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893438, "uuid": "4758cfdc-f451-47fb-ac35-7307c9a6a8f7", "value": "49152:RYCzMn2igaTEU60lVNuib3V1mfIu1p8+vw5DPF9QXnjrxT:RYCDYb1Xhb3KQu1Xvw5rbQXnjrxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709893438, "uuid": "add1f656-5b8b-4c58-bae2-4deadfb7454e", "value": 2189025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709893438, "uuid": "84ea9ecd-b47f-4b39-be28-04ed5d059f23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709893438, "uuid": "19ed8c54-f11d-470c-bc74-9265047ce35e", "value": "ea176a4e93f1ed89c3e493572955cf00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb235788-dd26-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709886891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886891, "uuid": "12ea967b-a85b-4cc8-8fc6-1c84b1a5b1e5", "comment": "Malware payload (AgentTesla)", "value": "80dd301bf2859dc7451fbb85287a66a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886891, "uuid": "a50e674a-3baa-4a00-bd43-9791d9eb7300", "comment": "Malware payload (AgentTesla)", "value": "cfb841fa2ffa56271126a33ff5b966379c509fdf3a793391ab48fdb5120136f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886891, "uuid": "95b2d6d6-9311-4bab-b91c-71d113323e99", "comment": "Malware payload (AgentTesla)", "value": "90ab0f2c20949b7063a424cb1fa912f7c626ff8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886891, "uuid": "e970d2da-fb85-494f-b107-e6f2c4b59b0c", "comment": "Malware payload (AgentTesla)", "value": "ee4cf3c40218e4a6509ac65a992f9b838e20bb5976d26b686ea6f4a9c0bbb37b3eee95340788644bb95ff0ecd79d3fe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886891, "uuid": "16c94630-faed-4cc7-82f8-9f3219bf2834", "value": "T14584C051F795ACF5E807027D96BFF90421237E8A8466CD0D25AF362E99B334290E7D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886891, "uuid": "d30887ae-d6fb-424e-ba29-0ff564d13445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886891, "uuid": "d4cab7f4-bad0-401d-921b-4a8380caf5e8", "value": "6144:tsmNnoQ8zwoN4Bm/MZY3/vBEx+Sw0uyfQaf5NimmZXEt4/YPzee7hT:msywn81/5EAS7uy15NiVZX+HreeFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709886891, "uuid": "ab9889a7-b489-4651-a53a-7f84afad2362", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709886891, "uuid": "e70fbc24-cdfc-4fab-b596-25e167b645c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886891, "uuid": "06726592-7b95-4b48-a68a-ce6a41651752", "value": "80dd301bf2859dc7451fbb85287a66a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df70d151-dcff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709870201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870201, "uuid": "3d3855da-2c11-4a20-a799-5dccc9c83a28", "comment": "Malware payload (Socks5Systemz)", "value": "6a39d835fe2fae61ed30fb2ade648dfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870201, "uuid": "b3e24040-dbdd-462d-bc1e-4e786683be58", "comment": "Malware payload (Socks5Systemz)", "value": "d0c01d603e18b79e8651eb01f4e8fde1b525b2fe941e1edf00a301aa096640a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870201, "uuid": "3c7fd763-cefb-4136-b868-0952fc3562e3", "comment": "Malware payload (Socks5Systemz)", "value": "a902169336ba4efa4f23444521a9bb7979c672ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709870201, "uuid": "07239cd0-1ed8-4f4e-aa96-ed85b0d961d0", "comment": "Malware payload (Socks5Systemz)", "value": "1b1c7c8536dae45b6bd4af33d69a6748cde77186cc6dd77348ba060465b59f721549f5694b362c73c4bb47744f83631e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870201, "uuid": "42ab6557-9eec-46c7-94fe-eabab32c8101", "value": "T1CB953343CD6D99F1E361CB740E66D8A16233B98DFA38441579ED0E4E5B3B289422E7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870201, "uuid": "49522373-dc47-42fd-b0dc-3a0cc5852d7b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870201, "uuid": "b3e83ecf-9ef4-4ae8-ab95-2a537667c551", "value": "49152:C9oo1oX5XgXP7JOVzL42ManqCWDXDaVeRsLYSsN:MLmXg7CE5anqv2VeGUrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709870201, "uuid": "82e12f4b-7e12-4b48-9b49-d4ecf5af4630", "value": 1901106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709870201, "uuid": "0484bd32-b751-455d-804e-beb746c5afae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709870201, "uuid": "65b2dde7-43e5-47c3-9706-14e7e1422515", "value": "6a39d835fe2fae61ed30fb2ade648dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18dcc83-dd83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709926845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926845, "uuid": "c13dc3ac-8f71-416b-b2a9-c5e829a088a0", "comment": "Malware payload (Stealc)", "value": "be174eb4ffb7b227b2e78644b98ef1ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926845, "uuid": "4d8e176a-3305-4ba0-9ec1-2b6a98a583d6", "comment": "Malware payload (Stealc)", "value": "d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926845, "uuid": "69b02bca-30c5-4616-91b3-f170dfe2b29f", "comment": "Malware payload (Stealc)", "value": "f97edc25319588b1c995beb7133daf037a1cca1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926845, "uuid": "75ca03cf-92ee-45ae-9691-0221589b5f55", "comment": "Malware payload (Stealc)", "value": "0a6d403d67aa22aee3d71bfea3e458a4281843892464d086364b75ebd20e3f56643b4fe4a5f13373103cd7f7ce437ce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926845, "uuid": "9da68f99-28f1-48c4-8a7d-5cabde48cae8", "value": "T19795228ACC9738F1C8E62CB54623D23A84728D94001D87619BE63D73FD3F9C5AE95396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926845, "uuid": "3c4b5a8c-e307-4a83-8e66-fa91d9a7d4cc", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926845, "uuid": "1a9f94a3-f67a-4df6-8c9f-11afaa02801a", "value": "49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709926845, "uuid": "fe8e4eb6-5fd5-42d3-b165-e9542e8cb12e", "value": 1891594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709926845, "uuid": "6ea2468d-74e7-4008-b0b0-0d5490a76b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926845, "uuid": "273b97bf-2562-4064-8d47-9708601a132c", "value": "be174eb4ffb7b227b2e78644b98ef1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8cb709-dd37-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709894086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894086, "uuid": "13f0c859-6785-43c1-9f77-1e4c04d0f1c4", "comment": "Malware payload", "value": "c632cf4dc707d99ccfbaa2c9c003c395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894086, "uuid": "fcfffecd-9e66-4e5d-aee5-b8ee4ca35ec6", "comment": "Malware payload", "value": "d4099327bea317eae5ba61ba0d6f27c2a2e82146255f4935933789e72205c9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894086, "uuid": "23da8819-d73f-4248-bcab-c464b91c1b2b", "comment": "Malware payload", "value": "edb736d37546e95da07f4a34e1a82cdf09ccf7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894086, "uuid": "4f957d45-c3c7-4ff2-be09-61d0b893b43c", "comment": "Malware payload", "value": "7f8a3dacd561d38bd6dc35f3b297dfd31b86cf8ffaa3ee78e9738f443b2cd15c4df625a0d44555335f967045c59996fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894086, "uuid": "c28daa61-2b2b-4fba-9dee-20015eef5489", "value": "T1E9748C4973F004E8F663E17C8CA36942E7B278450B20C6DF03A4865A6FB77E06A7B755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894086, "uuid": "dbf02202-0944-4ef0-8b7c-c8b4789915b8", "value": "359e62b5508f50a379668a9779b7a4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894086, "uuid": "2e9156ed-5d61-4243-9572-1c8bedc85cae", "value": "3072:1QMSvYSBP4Hi9gUWWUPtBTGnM3CzjcleyG1mCkfTkcUQntLXzuUIaIN8SQu756vR:1QMmYSRQBTGl37yG1m9fTvUeLjs0JCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709894086, "uuid": "df684fb5-0771-47e7-b8dd-614b5b71505a", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709894086, "uuid": "ce4b730e-8d93-4662-a514-8317d884b1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894086, "uuid": "bb153118-349b-4b95-b1d5-f69573a87d45", "value": "SecuriteInfo.com.Win64.MalwareX-gen.28603.20928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69ac993-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921297, "uuid": "4f062faa-d340-4065-9cd5-45bc3df8eea9", "comment": "Malware payload", "value": "981f69a097f02970fb59ede6ab3477a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921297, "uuid": "27e003a1-31c9-4583-b0ec-213367942537", "comment": "Malware payload", "value": "d491b11c948edd082786ed807fcd0080c07437a30a3c6d834cac44fa87ce12d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921297, "uuid": "b6bf5c2f-4e83-4b67-97b3-d0e94bcf981c", "comment": "Malware payload", "value": "38e3ee7f86cc5a40ffe9e338c87573d90f3aaf1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921297, "uuid": "64dd6c9c-3120-418e-9099-049e438e986a", "comment": "Malware payload", "value": "bfad260bc26e1ea3800a0904a5d4dfd214be797549cc7dfcc1d74b54987ff00ab83c0e3e6d7290d8d9e5d275f222640a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921297, "uuid": "7d55bf23-f373-4969-8d2a-7d485177c315", "value": "T1BB137B77D42A5E64D0991170B8609FB41F13F0C0D3276EFB5AA9C5A6884799CF808FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921297, "uuid": "6713e167-5887-4295-a577-ba5e10e8ce40", "value": "768:5wbsKOmUVXbLwmW2dnpd6iCXol4JjAQCrbwM:5is3mUVXbc60iHlc8QCrEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921297, "uuid": "dd95b157-85c5-406e-8fec-eea6c16638c4", "value": 44128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921297, "uuid": "45b5a0ad-5ab1-4930-ae1e-5f1ac2d6dcab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921297, "uuid": "bca71909-b7b7-486c-a9e7-8c75aaf1f599", "value": "981f69a097f02970fb59ede6ab3477a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f6263d-dd73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709919816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709919816, "uuid": "a3e07a77-7ddd-4a23-966d-e15ead5a56b6", "comment": "Malware payload (RiseProStealer)", "value": "8ed851e94ad6cdc7f06113fbca135666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709919816, "uuid": "a7ae76d7-dc38-4fa4-9572-d59c5b2772b2", "comment": "Malware payload (RiseProStealer)", "value": "d4cb0c0e37093b35fe64a838c141eb823809e2608cf3292f648805f0167a2f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709919816, "uuid": "3909114c-fb33-473d-8100-1e3ad108c0cf", "comment": "Malware payload (RiseProStealer)", "value": "1e2cf6c95be5f365dab3d54c57b4e173e548cfa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709919816, "uuid": "e49ee9f8-2a52-4f0f-b627-b705c826f273", "comment": "Malware payload (RiseProStealer)", "value": "ee65163a7a9ee47d5b82f06316b2e0d9dd92add01225ebde7c81704a488360af8d0316752f0e40196d4c31189d5f6a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709919816, "uuid": "c5d8e0a3-ce41-49e7-bf6f-5dc2eaaa9787", "value": "T17966235A1F8F85E5C8C61879871FBFE233F355A318918C3569C5384AA4F1FB6703A886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709919816, "uuid": "439780d6-8502-40b1-af9f-5b15f2efc205", "value": "a4c0f65297350a2f4be573847bcf3b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709919816, "uuid": "a677d37d-e1c4-4c1c-85cb-69d0b6a9af8b", "value": "98304:JzRpeI4m5y0cjEhI1TjHS9YP8WT2LQBxyZJUbwK8teUVFsTkoj6zSdagB+VkrGnf:fPujMoj5VBvbJqsTJmeIVkaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709919816, "uuid": "01ff855c-f276-4dad-b3c8-9d8d61827b14", "value": 6567424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709919816, "uuid": "9f33e185-984e-4e5f-bdda-0fe5cf192b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709919816, "uuid": "c9bd244e-964d-46f2-882d-5c44d867f96d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9622d8c6-dd2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709888976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888976, "uuid": "d78e4177-725c-49ae-9560-851ac7031f0d", "comment": "Malware payload", "value": "963c5c057045e5eb6d437339ecb1b9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888976, "uuid": "f664f5af-1e46-4b23-9c2b-e5e749dcc8f9", "comment": "Malware payload", "value": "d5760da745c915753a1364a3d9762e75b503192327473bb3bda85282a532f4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888976, "uuid": "ba326608-4981-432c-b3a8-db379313cdfe", "comment": "Malware payload", "value": "07fc1868558f8e158eef3481d9c834d3ff1890fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709888976, "uuid": "21060788-25f6-43c4-86f3-688a86c855bf", "comment": "Malware payload", "value": "e0afb33ddbfa0b3d70811a6adbae8fe66c8ad2b7662774c94b8a8768c7709018932d66fa5373c4055fd9ad66eb4939ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888976, "uuid": "95dabc1b-8c09-434c-9c21-9d4cb8d51977", "value": "T155B5336A23769DEFDFDE4B7AF92CA509F7712A5F02B10701184884C8790B5BD4B1ED88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888976, "uuid": "1ddcf06c-21d9-48b7-907b-494aa2d6539b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888976, "uuid": "b139fe9b-97d6-4b6d-9fc8-9ddc3f4c3a4e", "value": "49152:0fFK+3+CmxlcwI0ul5BC5d46M8X886aN6dat43AK33iAV:0fFzy4auDs5d4B8M6kKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709888976, "uuid": "d3bf54dd-ff64-427b-b685-8da4589cf965", "value": 2406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709888976, "uuid": "a45c33c5-603c-4b14-a557-9de51cd6c4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709888976, "uuid": "69e83211-2a49-4383-bd93-25041657a739", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbe265c-dd79-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709922359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922359, "uuid": "8b8c9cf5-61d6-4dcc-98ae-85076edf561a", "comment": "Malware payload", "value": "b08df6fcf8a6d7b7cae9fe77137476a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922359, "uuid": "34ca4d27-c6ff-42ca-8870-087f78a51647", "comment": "Malware payload", "value": "d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922359, "uuid": "914ecc90-41bd-40d4-aadf-d9ee80f45e9c", "comment": "Malware payload", "value": "21de94d07adabcd45f68ad8461fd94b435e058cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922359, "uuid": "08034f51-9f11-4e40-9700-9ce78918694b", "comment": "Malware payload", "value": "2214373c44580d273749ab45e6512c805a9e23b755f0e62bfdd245fda61155f705ab59089b57d5474737ee788c8773d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922359, "uuid": "723a5628-9004-4f2f-a0fc-403194adb3f0", "value": "T111D5B20C1B3A4695E511883D54331663D8A9BC1CD02CBBB6CEC49B463BD6F71A2B77AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922359, "uuid": "57c454eb-ecf9-42c4-bac2-100904f04b01", "value": "96f9c6dd6d7f5522adbe99713d391a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922359, "uuid": "1f585250-d1b3-4a3d-9d56-4d715f89c385", "value": "49152:YlJ3+cr+d2KM8KQ8RRGVJu6kiGoMil7YQgoF9Gz4NFGov/++do:e3KMiEC9G0NFGov/++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709922359, "uuid": "91d54ef5-d972-4b92-af5a-75a6303ae1e3", "value": 2822656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709922359, "uuid": "b5618b50-7c09-44ba-b2b7-7b000faf6ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922359, "uuid": "ed419849-1387-411a-9f76-9fe147343f22", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5594.15321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00218066-dd0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709874981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874981, "uuid": "d67db332-ea68-4e9d-89f4-4484a39411ae", "comment": "Malware payload", "value": "1792537ec7c40746401cdeb254d1fb89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874981, "uuid": "46a65389-4add-4989-971b-2fe5a5dcb439", "comment": "Malware payload", "value": "dae77343003e32061ecf2f96295b38b7b25be2c405735337f7426041899f1be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874981, "uuid": "79e632ca-3291-41b6-b003-71f6cd35f42d", "comment": "Malware payload", "value": "32ba8afb46ecc73f829bb75aed9e99940b013b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709874981, "uuid": "35603c7e-1010-49ee-bdd9-eccc025c9d13", "comment": "Malware payload", "value": "80e32d420867ac95676c2207e55752d453ae7b1013512a8e9a5cd68bb5df8be61cdfdd02f066f2ebc68daf7f6bccb913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874981, "uuid": "b07a94f4-73d6-4d5a-9ae0-f65961c60678", "value": "T108E361072784CCA5E26156B9891A47C182677C0077B0FE9B52D8B6ED0BB3BF1D96B343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874981, "uuid": "8c33c06b-ee81-4ca5-b6df-48a5187164c1", "value": "a61c6a7c70d96521c2bff14915509046", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874981, "uuid": "abec459e-30d3-4341-81a5-d4c7211d6d13", "value": "1536:t12DBwc+PJ7NhSP00d+Bifdwj7w9qBaK:LzNPJ7NhSP0+gjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709874981, "uuid": "98518e84-7830-4271-a908-3981cc1bb915", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709874981, "uuid": "16895092-5465-4adf-9d87-16925a046833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709874981, "uuid": "b7f45ea8-6387-4b82-a026-5c81d77734ad", "value": "SecuriteInfo.com.Win64.SpywareX-gen.8822.4669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd5c990-dd75-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709920582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709920582, "uuid": "0c0c0b3e-37b6-4bfc-992b-18db9a3f7406", "comment": "Malware payload", "value": "bd65c346e48dbd03fbb1a2763dfab270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709920582, "uuid": "490d18fc-ccfc-4ea4-bc7a-70898e91f2d0", "comment": "Malware payload", "value": "db756c811ac925a0f8a30a774f2982b0f1e22c2b007038049c2bbeae5ca7840f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709920582, "uuid": "dedef05e-7fb4-4844-a465-9c720e636018", "comment": "Malware payload", "value": "0b3fdb643a14731607509bdfd28e5bf839751d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709920582, "uuid": "707a7bd5-6b0d-4018-9064-de22275baa6d", "comment": "Malware payload", "value": "4e7d19c9b970d4f156d6a5c373c1ffb6d15ba33eab63319723962125ac6db11dfada5bbb93e55c58cae940d16e2f1171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709920582, "uuid": "ed38498c-4e47-4dde-bb7b-d79968641cfc", "value": "T1E9476B02FB809ADEC664813689EA43853775FC581F275BD76A04B37C2C767C96EA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709920582, "uuid": "ad391a4a-1b8a-4b9b-877f-38d54143cbb8", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709920582, "uuid": "5a01c5ed-be2d-4213-b87e-1cd7df2250ed", "value": "196608:D9YBVxwnn+bONYasqpWH5zjsQ0prg+US2/5Hmni3QM:qJwnbsD5zjsppU1Ai3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709920582, "uuid": "393dc71c-095d-41bd-bebb-166f863b4337", "value": 26718530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709920582, "uuid": "e44c08ca-b842-4f77-8c70-cc5df3b97cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709920582, "uuid": "be65d939-8da1-48c9-bdef-d9f02f6ad4dd", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6df592b-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921351, "uuid": "30e80e00-5cf0-4d62-af45-31314ac086dc", "comment": "Malware payload", "value": "03f7883cde95b36014e7cf6c3a4bdfb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921351, "uuid": "fe654a17-49e3-4aa9-9672-34443fa14d0b", "comment": "Malware payload", "value": "de31140b4c881c073ad1189be1987d0a43cba143973d36751ef82bdc8cab76b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921351, "uuid": "869da70f-bb69-4a1e-9773-c09b8f224fb9", "comment": "Malware payload", "value": "52beeede1bd0018d4735803c019bca771dd1155c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921351, "uuid": "309e2b73-4c08-4f10-84dc-ec76daf4e585", "comment": "Malware payload", "value": "cc06b3ceedc185b5dbf7f8ee07dded6de9fe6804f9dd2ffb2ac6d099c70d430396ca5ab73520835685a215794fb0b71a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921351, "uuid": "fe9b7092-9ca3-483c-aa26-fd85e059b12e", "value": "T19353A65A6D128FACFB5D973147B78E21AA5827D637D1C641E26CDA002E6034E241FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921351, "uuid": "5f957dd2-2ec5-4d3d-9d01-c8c5400b0393", "value": "768:YK11B+oje4WYh4WlNJJFDGk/NgWwGvl+5XmPSL9z+LJ3KaNaRDgVwqMf:3y4t42F7NPc0MqapgO/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921351, "uuid": "191eb5ac-31c7-480a-94c1-01352dc3a490", "value": 63732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921351, "uuid": "dc321bee-dacc-44da-90db-e65fdc0e744f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921351, "uuid": "71e168c0-a3dd-4833-ae9d-d86b2c3e8076", "value": "03f7883cde95b36014e7cf6c3a4bdfb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd8f01b-dd56-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709907615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907615, "uuid": "3f16fb8c-c190-4720-86dd-661fd5080b59", "comment": "Malware payload", "value": "bb27ed093c6e2c730c9474aa79ac2d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907615, "uuid": "afd9a298-228f-4a5d-85e7-438bb49b99c0", "comment": "Malware payload", "value": "de5cf20e4077372593a8c24c31306b7e5b9ba62e3952609bde308300631c8c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907615, "uuid": "3d569cc5-f17a-474c-b443-b867521a3d7d", "comment": "Malware payload", "value": "321a8af5f62eb08923ca0e0ca99de7fde052033a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907615, "uuid": "a5cb58d9-2317-4f65-804a-7584e42fc315", "comment": "Malware payload", "value": "b16dd9c875cdcc9911691a0557904718b87cbe620b3a79f960a6ebefee740c3aed275d9522d4538d0327dbac038437dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907615, "uuid": "098ffac8-aea9-45d7-9e52-c110ecb08a8c", "value": "T127E4236A77A88D23C1AC45F92879314523B0A9B70ED3F7E42DDFB4EA6991F0425D0393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907615, "uuid": "39450362-2785-4f26-ad29-7a2b9d93f1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907615, "uuid": "56e8985d-68c9-4bb6-b887-a9a71a656e07", "value": "12288:dd0FtImAFJFiXpflU5Xnt9K4QRvePodWz4gjbbN0hYE38uH21qDfZDGh:bM61FaXlgXt9K4QIPoAUhYE3JHNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709907615, "uuid": "16b6e8ed-41a7-4649-8f88-f8ebec0d6459", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709907615, "uuid": "b178ea58-0107-4e90-aadd-a4b4e068be61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907615, "uuid": "50966232-af16-44bc-880d-ca844216b6b6", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6fa2c3-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898676, "uuid": "6d5f490c-3458-4fb4-9e1c-cc3eb4c8019a", "comment": "Malware payload (Mirai)", "value": "45db827c54a6d1992eede52a9453b5a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898676, "uuid": "8c724d57-e276-46a8-8c19-3985546423bf", "comment": "Malware payload (Mirai)", "value": "df31a5e5b8b8e15b740b3b77b3183a9e6d96c1fe398be846dec5084aa22d3d95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898676, "uuid": "71e262d7-3e31-4fa4-8f1f-5f71bfe6e254", "comment": "Malware payload (Mirai)", "value": "04f39a7c12bfb504a2039c0430f6e9ac6a23f81c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898676, "uuid": "0e291d79-eb90-416d-a34b-90baed144eb1", "comment": "Malware payload (Mirai)", "value": "5210e8e267c11231e71cdbc0ab586a340d938a94c6d4e166a8e7e15c112aa8488d740ae9bd440cb43a2abead6004a31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898676, "uuid": "443acd2e-f7a3-44b6-974d-7d2e8bb65101", "value": "T190135BB6C46A5E84D3094638A5648F381B63F104E7672EFA0B4EC2A594079FCFA4D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898676, "uuid": "345f1d41-331e-4f97-9413-a4edd2f2df46", "value": "768:yQa/cmC1Deq1AuTLayaowlSfXlcDHxiCKoO5iT2aCX2FOi2ZvB:yQaENWuTWToXlc8OOa2aCX2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898676, "uuid": "10e85106-6525-41de-a805-9faca0e5d2ae", "value": 43312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898676, "uuid": "cccd2b10-5a7e-47f9-bd57-ad9d469532af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898676, "uuid": "b8613725-bee2-4cc8-b773-e383abec44fe", "value": "45db827c54a6d1992eede52a9453b5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c381e54-dd57-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709907643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907643, "uuid": "a5c2ccd8-2eee-4c1a-95d7-a76800022410", "comment": "Malware payload", "value": "aeb6f43b1795970105081de9b7aa8e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907643, "uuid": "3e0efd22-33ef-4d20-8485-796b26878066", "comment": "Malware payload", "value": "e220436b5521f7b6171dc1b1e8e32cecdaf791dc51b85b3767866617c38a3628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907643, "uuid": "ddcc228f-d5a9-4b37-a519-9f8fe526dc43", "comment": "Malware payload", "value": "9916adddc2290d4937ffc0c0d180aea33169f561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907643, "uuid": "9b63c833-0ae6-402e-b704-21932697806c", "comment": "Malware payload", "value": "344ffac6c5266c3409505b3cee40e072c9118f1e05f59e4caea2bd264d6cfce4521c604e810b3aff6740b91394b0e28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907643, "uuid": "13256397-ecee-4e65-b3fd-8a9496f36294", "value": "T1B8E423977A99E717E8BE097CF5B234836071952326D6E3C24CCBE0E569C0F81A1B4683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907643, "uuid": "51601810-1548-44d9-9935-206cc3a6c6b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907643, "uuid": "5c14c63e-0551-4a49-b07e-ad69a1df9126", "value": "12288:yaFtImAFprPERkK7zSFFnMMDRNfMQN+9zSVqhptuGx9d6xBi5dZxLx8RNz:v61FpAp7LQ49zOOptuaOi5TxLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709907643, "uuid": "169482e3-649f-4b26-ad82-679a3f6caa27", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709907643, "uuid": "abdb64e6-c3d4-424a-ab0d-2c84906cd92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907643, "uuid": "b784fc99-ff8e-4c08-b967-64c37dd04eb2", "value": "Payment Advice - Advice Ref[A22D4YdWsbE4] Priority payment Customer Ref2310069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6882336-dd7a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709922988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922988, "uuid": "ee909e0a-5137-44e6-923f-5a1501a12903", "comment": "Malware payload", "value": "6b9217ef9cbd2b29bfc353261566be1a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922988, "uuid": "208b2b2b-2710-4776-982c-ec93224a7319", "comment": "Malware payload", "value": "e2dc1f6e45a7be302736e1b42bb97e6a7877f82e081389b7a8195ea22cf6a10c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922988, "uuid": "45a11708-acb6-4f00-a8a3-54f5406c7680", "comment": "Malware payload", "value": "987d02620b4f57a667771f03ebb4c89ed3bf7cc8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709922988, "uuid": "6e52313a-0021-47af-8aef-f2dd1a55e070", "comment": "Malware payload", "value": "4477f911b3d91d0223b62cdaa72cf54a841a00c6fe6e96ec567496cf9ee889960b2a859bc794e30f21e8f99f8712e59f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922988, "uuid": "47ce2438-a0f1-4dae-9c79-abe84761e59d", "value": "T1894523ABF4173F99E311D5AB59D9183D3C59067FBE407F1B700E6A62EEC264AE02500B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922988, "uuid": "6e3ebb28-fd2b-494b-8dcf-0d694235838e", "value": "24576:egs74So486o/eJKDj79990ZUpa0Xcsnv1XGhKTViKb9AFjSSEn/nBQfoFu:eN7TMeJ6Z9aZUpa0z1XUKTIa9+i2fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709922988, "uuid": "a045769e-59a6-4308-bc3e-95d37af6a1d4", "value": 1210810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709922988, "uuid": "ded95358-7d9a-4d54-847f-bbd82ac4cebb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709922988, "uuid": "5be10656-e26c-4057-9a2e-de93e48112b7", "value": "3b093ad67bab081c686c8e03192739fb09e5d65e521ddf664adba46cef31d0c7.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6391a7-dd48-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709901310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901310, "uuid": "641fb99c-f5f2-4d16-931b-709a95ec088f", "comment": "Malware payload (AgentTesla)", "value": "33de2d61d9a6e9cac344391f531d8bfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901310, "uuid": "a03cee3f-bd2c-4469-a813-7ee05430a226", "comment": "Malware payload (AgentTesla)", "value": "e36fdafced1102b7f666fc6e77c7be573953e5f42c4fc68503b194414ff38592", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901310, "uuid": "dc42f8e1-21a3-46af-abd8-685416fc3a23", "comment": "Malware payload (AgentTesla)", "value": "ac6a84c517358223cd29a95724f4d5281e4e69ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709901310, "uuid": "16e7f2ad-9cc9-4130-b765-5fbb9ef296e7", "comment": "Malware payload (AgentTesla)", "value": "864849a7b9709afdf63f11de9e5137d141011e36cebdd5b2c95195111987bdf0535c6491bfdc754af64426162345c784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901310, "uuid": "3865abfc-8f9f-447d-b7ab-aba59bef6b90", "value": "T14CF4D00923250A22DB66AB34DA77D7001644EEAA8197C70BA3C8757B21376FF1FF1746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901310, "uuid": "8596aea0-08da-4504-b9bb-b251b4194da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901310, "uuid": "59a992e1-22ad-46a7-895c-e40fe18963d7", "value": "12288:DnzFZzAt/PcfoNvaiLIDSNNjTI1UPP+HMucbXisPmm/K:7zFZk9PcfoQiLR1TH+HU7ise", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709901310, "uuid": "e66ee352-bd1d-4dbc-8762-b44d7a96acf5", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709901310, "uuid": "7b91f1ba-b2f7-47ec-871d-8bc1e1f025e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709901310, "uuid": "94ed90c3-1a22-49fe-8234-815f12e0911a", "value": "e36fdafced1102b7f666fc6e77c7be573953e5f42c4fc68503b194414ff38592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44223f9-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908327, "uuid": "42c5e316-8704-46f9-ab16-70f30d4b6818", "comment": "Malware payload", "value": "94fc742fce899d0c370059827b2d86ae", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908327, "uuid": "855261f2-c13e-4227-9f33-e0d116fe26d7", "comment": "Malware payload", "value": "e5c44b0338c36ae76e5d99f19bef5495e736a1f628898a5606e2092272b73d07", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908327, "uuid": "2885eb2c-5628-4ac4-93bf-83e03182ecdc", "comment": "Malware payload", "value": "c748119cfa0c3e67f184f049352ad19580041d7c", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908327, "uuid": "9ba9c4cf-5024-49f8-8537-a3de5ce760b5", "comment": "Malware payload", "value": "735991f5cf62b86dfccf11e797e3e7234b43ea6fce97836e94daacf48777693e6640cc9c9b3e5bfdf4f75992828799f7", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908327, "uuid": "ac986a1d-c053-48f8-ac62-3fa43534c5a4", "value": "T181C08016454FC51E05DB94594A65597CDD41A4C285AEDC5253D14B08BDC1460CD5C645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908327, "uuid": "f89fea4a-abbd-45e7-89e2-57c16d1f8daf", "value": "3:HRAbABGQYmiz8lXCEKEg2vL4uJ6ovUo1YSo/QJ4ovstwWD9W3phAfWMJWPaJ+GKy:HRYFVmiz0XCEfxL4/ovISoIJlvstwWDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908327, "uuid": "9ac59d33-c40a-49f5-b86a-cf7e7274c042", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908327, "uuid": "a1fa0ae3-bc9e-48e5-9cb7-dd3d8e1cfbdb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908327, "uuid": "1fc62fce-6987-420f-aaf0-e8c74b55e4c3", "value": "ChromeSetup.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a40d8a-dd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709892786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892786, "uuid": "878fab03-5b9f-4e9f-8cb2-42eb1fbfa2d0", "comment": "Malware payload (AsyncRAT)", "value": "5abe05b5de23e6fd24628611d31b9a54", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892786, "uuid": "34b12f70-0f80-4aad-8379-7d659bf9109a", "comment": "Malware payload (AsyncRAT)", "value": "e6e82da9743e4575e6d9a89028c9a67f4b6edf3dae4323ba882ed394cace8638", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892786, "uuid": "2cb17910-0b7f-47f2-9cf6-650ab2878986", "comment": "Malware payload (AsyncRAT)", "value": "37c5bc0819a44d2a7c8b7e608f299a3351931417", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709892786, "uuid": "718b90ba-43c8-455c-b3e0-f2583e79f72f", "comment": "Malware payload (AsyncRAT)", "value": "be40167e7f98a955fd4a2753a62af95ad83a1a614a997ae4c6306a62eaf37513e37d32287877ad752fe4468446bcc428", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892786, "uuid": "0434123f-962b-45e3-80b0-c5c3c5be6fea", "value": "T13163023750D0BF57D44577328AE8261EDBBAC1EBC871575E8312B8C1CA6D738E99D088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892786, "uuid": "d655afef-c769-49cf-8d3f-b1f70f98c027", "value": "1536:APg+MBG7fiIIOcD1+gyWaG7FhZL9BLqifBr99V4unqjj:APgJEGIIO+1xPJhN9dqipl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709892786, "uuid": "24fddeac-d2f0-4af8-99a9-15158e7d04f1", "value": 72724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709892786, "uuid": "a8436fe5-2734-4162-a01f-a92de2a7b58c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709892786, "uuid": "707a4045-71e3-4bf9-ae9f-020b4f00f393", "value": "5abe05b5de23e6fd24628611d31b9a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b603ed48-dd24-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709886023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886023, "uuid": "bdf92a68-e060-43fc-8ceb-589734e8c745", "comment": "Malware payload", "value": "0175aef57f90a52a377533247ed41b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886023, "uuid": "991706d7-30a5-46bc-9113-9d1e42f9e69b", "comment": "Malware payload", "value": "e71975a72f93b134476c8183051fee827ea509b4e888e19d551a8ced6087e15c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886023, "uuid": "24357583-b23d-44cf-8b48-303108bc9de6", "comment": "Malware payload", "value": "530e42aca79806a68dd4a11f6a8a453f0b54c414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886023, "uuid": "36a5dfad-8d11-41c8-b135-7bb1ec91849b", "comment": "Malware payload", "value": "c1e7379725efe7664192776eff7c91bc105099713aaea10d363af91dddb12636ba42e5fab11de536759a8020e588b08d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886023, "uuid": "ab49a294-31cf-4a0a-a4d4-11a0fba1d592", "value": "T1BEB55A96FCD118FBC1BDE1318AE65A613B317469477333E36F80066E196AF986D3A310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886023, "uuid": "b3779d85-62eb-4240-a7af-3b433bf8a633", "value": "49152:0KTZyLiECHpggmCX6ubWITwz/OGmqLaz41723r:/YdCHgWq4W72b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709886023, "uuid": "905e7dda-9ee7-487c-95ab-1e690b530cfd", "value": 2412066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709886023, "uuid": "ab7663d7-3fd1-47c1-aea4-b3ae4b27207a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886023, "uuid": "6693ec9c-153a-4c2d-b9e5-0912251768e0", "value": "SecuriteInfo.com.Linux.Siggen.6694.27605.28550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171d8922-dd57-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709907661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907661, "uuid": "667d4aaf-478c-4866-8b65-3face883c811", "comment": "Malware payload (AgentTesla)", "value": "cf6605bb44fbd4a4433500788e2691c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907661, "uuid": "e8983ed7-18f7-4879-8521-983a2756bc64", "comment": "Malware payload (AgentTesla)", "value": "e888272ec903b082245c0a046b182fd02a1f6e8a6f01e347325bc1a81972325e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907661, "uuid": "28be0bd4-68fc-40b0-bd2a-bc19c89db904", "comment": "Malware payload (AgentTesla)", "value": "af76553e6e3c4df4eace9289e2fdf7f88f0bffb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709907661, "uuid": "47cda2d8-53c8-4b5c-945f-220dec40e73c", "comment": "Malware payload (AgentTesla)", "value": "ae38c79ba27e4b7ed4548764167979a3c3f6c9412656eb538203c9e4bdda49be8bbc300b73abe53de10ada50eaf396cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907661, "uuid": "a86cff1e-94a8-47f7-ba41-7312b4b6aa8a", "value": "T1DB340D037E48EB15E5A97E3782EF2D2413B2B0C71733C60B6F49AEA524512426D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907661, "uuid": "cec139db-c11a-41f4-be1a-8d43c1bea499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907661, "uuid": "94169066-e10c-4085-be6d-c9ad787f4a2c", "value": "6144:3ptRtJ9xXQqdDaCiD8L8z6Br0gopc6yyYy:5tRtJ9xX5dDaCiD8LiC6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709907661, "uuid": "819ee951-cd7f-4959-bb98-4809ec3d72fa", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709907661, "uuid": "eeef53ac-9bb0-4ae1-887a-696473d8f3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709907661, "uuid": "1e99d865-158f-4ff4-ad80-a10e9a802413", "value": "AWB_008765499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640ead90-dd27-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709887174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887174, "uuid": "de9bcea5-4deb-4679-b6de-0a134495c261", "comment": "Malware payload (RiseProStealer)", "value": "254005323ac6e401bddf283e17a6cb7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887174, "uuid": "5463f650-5483-48f6-905f-cee195169cb6", "comment": "Malware payload (RiseProStealer)", "value": "e8cbafcf196bb80ccb2249e8f6a18c02d8d67926a298165592c4ec742851749f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887174, "uuid": "c1199e76-e0b5-4a1f-8ef7-ae823418c9e1", "comment": "Malware payload (RiseProStealer)", "value": "2f6aee45f508fa5c96682e8a93f9201f8611bb25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887174, "uuid": "866167fa-7523-49c2-9652-855377cd13fc", "comment": "Malware payload (RiseProStealer)", "value": "bd9fc99ac2e8a025ab8bd1ebbb72566e21d21f64da54dd49f4e9270560f7bedf3c0581cf52123d33c694838b030a0505", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887174, "uuid": "f06a7a22-fe46-470f-b136-af31fb41e223", "value": "T1B2E53372C799EDA4E3169EFED058A1B3F77341578EB9C29127430F5B3821731636A282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887174, "uuid": "4bd5a846-8451-42f2-b0e7-48c2e2118f08", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887174, "uuid": "211ba8b3-07d4-40fa-be17-1d379fd7e7a7", "value": "49152:zHR5sQ4fSAn8bmnf7N1GkIkDtjuk+PPDTT9XJhTgI/tOc/X1nsg9oZkozdFT:D2fSpbmnfIk3QPDTZXbkSCg9ElxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709887174, "uuid": "d301671c-ee72-4edc-8f42-d5f1f0b51007", "value": 3025920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709887174, "uuid": "8e35f1d3-60f8-4137-abdc-c2b07217a028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887174, "uuid": "0bdcffd3-83a0-452e-b8b9-f3c422127537", "value": "254005323ac6e401bddf283e17a6cb7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c225fb-dd66-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709914282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914282, "uuid": "890cc621-4d90-48cf-892c-5017477751e9", "comment": "Malware payload", "value": "cf6023796717a730eef2742f76b26ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914282, "uuid": "da570c9a-4974-4aa5-b092-758007eb114c", "comment": "Malware payload", "value": "eb027074984bed5eaf118cf78f038344885ad9b91aacc065b830cf1929abe25d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914282, "uuid": "64f935f2-4dc3-46e8-be61-4f48e9a5dca9", "comment": "Malware payload", "value": "84c13f12e5688314dd01e23de60b9f4c506161fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709914282, "uuid": "009fb570-b982-4bdc-b2bc-e2271bca5dba", "comment": "Malware payload", "value": "e9b1c6584e22ac695a23f65c7be325d45c9fba646a58d592137393649da38bc52d998995b099f0f40fdeec96583e5442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914282, "uuid": "3985c4ba-830d-451e-875c-9f34897376ed", "value": "T1A7E30F372E990981D84863B90E642B06090D9F9B350B2FFB75873D8DE634DC2CE756A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914282, "uuid": "fcea4676-5942-43db-aee5-a74568776ad9", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914282, "uuid": "c61b4ff9-665e-4f76-97ec-8f5a5605ae27", "value": "768:p+/unhi1zOzZ+/unhi1zOzGG0+/unhi1zOzxM+/unhi1zOz:pti5OzZti5OzGLti5Ozati5Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709914282, "uuid": "c4e63e0b-dc81-46c3-af4d-e9fd65848966", "value": 145414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709914282, "uuid": "f3305981-13a4-40de-98a3-8e0ff92062ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709914282, "uuid": "e21ea227-b5d4-4784-a735-cdfeec1ac285", "value": "whitelist", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3828f491-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898697, "uuid": "c492b318-3993-4868-838c-7cad004f5ac7", "comment": "Malware payload (Mirai)", "value": "5686eb4720d6d8751189c53260192318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898697, "uuid": "cd6889a8-5e3f-4cf4-8941-1f414cee34e7", "comment": "Malware payload (Mirai)", "value": "ebedc56be7b2498d1916958861e1239a9314fd56fa89e284ca9855cdda328ce0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898697, "uuid": "48e8f230-edb3-42a6-b7ec-2c673d5f4beb", "comment": "Malware payload (Mirai)", "value": "cafe30b86bd082b7d51bd483f4ea960ce4afbd84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898697, "uuid": "21cf0ac2-28aa-4f46-8e6d-ad02bb737d46", "comment": "Malware payload (Mirai)", "value": "41ac95fd41f41c140d3af00f3d60044b95aec7bdfecc7a26931c944d70def827cb802cffb56da90df2c81a75f9086e2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898697, "uuid": "2eaa0363-d807-475a-816a-7199cc281c0f", "value": "T1DA030882BCC2991BC2E4237AB66F518E336173A8D1CE761BDE111B1037DA95F0DA3B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898697, "uuid": "b36c6106-a162-4496-ae42-f8ebd446baef", "value": "768:kKFS6+7iU2tdlGs/rhZ0i86baIARK+K34lRKNf6DuBovfKA4NgOi2ZvB:ni7xWd8s/rv86RElual", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898697, "uuid": "85ea912e-5294-4b06-b11e-82b1a476487a", "value": 39032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898697, "uuid": "0d54f271-321f-4da2-bb77-2d673a8e4899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898697, "uuid": "a0d7cd94-62b3-48a5-af19-0da53f6b8647", "value": "5686eb4720d6d8751189c53260192318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f16faea-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898682, "uuid": "72709b59-d251-4ec5-8fd8-8326b7ea914f", "comment": "Malware payload (Mirai)", "value": "71d8f98f308b834ea6e19e73e576a73e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898682, "uuid": "b345ecd9-02f7-44bb-8f33-79e08993bcc3", "comment": "Malware payload (Mirai)", "value": "ec83870fdf8fcf542bb118ad3a84a92681682c9280b7a965c3b3a9c3a30ca6bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898682, "uuid": "23a5f0f5-2e4f-491a-94bf-3edf373896bd", "comment": "Malware payload (Mirai)", "value": "00bd45ce11e6ed154384bf8e6b88e4d819b960ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898682, "uuid": "28637e96-acd5-401a-85d9-b6514c6da5bc", "comment": "Malware payload (Mirai)", "value": "cf46130a8ae0809cc24c6c34a485c296abb5e7a4b9087f52b43914c6d144d1ff2bd48d8a8896011b745d6c258ccbf8ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898682, "uuid": "92770b97-d9d4-445a-8f8c-416b818b6990", "value": "T1D4332982B9D18913C6D4237BF66E42CD332523A8E1DF730B9D222F51379A82F0DA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898682, "uuid": "a379e52e-8919-4505-b027-0bc255c607e5", "value": "768:kxbcrcUqHxARvPNFxYr/Kl9L/9J0eQLHAnB1l7oJsdpNmZWANOaGIRwBhOi2ZvB:k+r76xApPNS/Kj62lEgjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898682, "uuid": "d7528da8-0df7-4728-adb4-5419daa85e5f", "value": 50492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898682, "uuid": "b1eaf5ca-0a2e-44a9-a48e-37e0d54e83c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898682, "uuid": "b158a13a-1ec3-439b-beec-0042f3d4a64f", "value": "71d8f98f308b834ea6e19e73e576a73e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a992e4f1-dceb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709861521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861521, "uuid": "6dc6bbda-692e-4913-bc6a-8fecbdbcae4d", "comment": "Malware payload", "value": "bd71c3f444fdf4187e4b78e697ded481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861521, "uuid": "3fd376d4-5155-432e-9b39-c229419d17c7", "comment": "Malware payload", "value": "ecae9833d81f48acfd05582b2e3d1a94fe633c83e7649e14d0ae6b7a5613f3d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861521, "uuid": "818f8071-036c-4959-9a9f-e8e8ccdf97e3", "comment": "Malware payload", "value": "b592b2fe76c0dc1c09b6f9d3e86a33b4496eff29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709861521, "uuid": "22479afd-6bea-4e45-b236-b181640bca57", "comment": "Malware payload", "value": "7ff3d93d48a071bf8eae9efa95b49ff979d91f20c5238741af27ba74f437be814e272984c3f8e18de8d9f7e28b12238b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861521, "uuid": "8371b335-ad50-4969-99ec-fa32c2658fe0", "value": "T18CD5025AEA657623D1180835D0167FAC5F9FFB492604A14353BA213B0FEB62F17EC827", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861521, "uuid": "954eef61-020c-4de5-8db8-260d891015c3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861521, "uuid": "a690a82f-344d-418a-957d-c3b87554c0b6", "value": "49152:us1DsTsYO1qChCJ28+ntlAobOF43x60OEZvpvGufDHvYs0:5s4Xqwz8+ntdE43xzxvYufTQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709861521, "uuid": "b9803301-b654-4c3b-bb60-1baf886788bc", "value": 2991616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709861521, "uuid": "f0f67cc7-a456-417a-b127-22146d28caea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709861521, "uuid": "2631f5a4-4ba8-4c35-9de8-55bf8de328e5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15599.23623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c899f0-dd9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936427, "uuid": "e8efb0de-d3f8-4fb4-8df5-8b862ba3a220", "comment": "Malware payload", "value": "1b82328e567c06a9238a3880ae28b6df", "object_relation": "md5", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936427, "uuid": "92d38880-ade7-4c09-a208-d551ede5c90c", "comment": "Malware payload", "value": "ee482242855036d345d114144ba6021399876d613e4769b9550c98c0b669929b", "object_relation": "sha256", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936427, "uuid": "1e2b7a8d-4077-4b42-b88b-46b23e015169", "comment": "Malware payload", "value": "98de5efa4c82bd98cca1bedf49175c4413390a65", "object_relation": "sha1", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936427, "uuid": "07c57ffa-bd3b-4907-81c0-253587bef80e", "comment": "Malware payload", "value": "1a9e9a5ecdba7eed66137d5e43d22272a14551b441aed3822185e749986b7770d0a75e13775595d58328ec76894d1a02", "object_relation": "sha3-384", "Tag": [ { "name": "climbing-training-pretty-end.trycloudflare.com", "colour": "#9F0CCE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936427, "uuid": "1cf6c7a7-f57d-4c61-9ba6-1e3393ea3485", "value": "T1DAC6AE60BF945AF9EF8D1E3E905AAB1CC7F042172C32706BFA515F05A9DA146810B36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936427, "uuid": "bb2d638d-e993-4d49-be88-22e89b6147a1", "value": "49152:NzkWzeMko4R2h2rqbMvV179OVSVBRBpzg8IUYSr8:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936427, "uuid": "12c918c5-ff60-4970-90ec-b5cf285b56c6", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936427, "uuid": "e09a399f-55c0-4ae6-8d93-ed76874b8aac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936427, "uuid": "9edefcfa-a1f9-4f98-805c-5562dc092486", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eda488-dd83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709926938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926938, "uuid": "579bb99d-c965-4398-8535-c6944807f1e2", "comment": "Malware payload", "value": "d4fb20c5119cc3dccdeeedf188fbab52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926938, "uuid": "d95ceb1a-d090-42d1-b655-28881d511a83", "comment": "Malware payload", "value": "ef73f10d5163ea12ee4ff5507ebc387591dd1d97fc9a1a143cf58c14793dd371", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926938, "uuid": "399cb859-4f4e-4a2e-8d74-e750d6d4c8b6", "comment": "Malware payload", "value": "0d475f95d34804f32f274abd9b06f684252dc633", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709926938, "uuid": "79365c06-8032-4f1f-a2bb-76c9577a3348", "comment": "Malware payload", "value": "d0153f4e1114581f425419063da6a2979127d9f8f3a3f391f37422decce25bb7dc56e15ab79cef122acc3f5e60d2c446", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926938, "uuid": "2fe9e72e-37bf-4856-8497-1721c0f7114a", "value": "T17AF6FD84779B10D7DD186BD3FF38D86AE18ABC445B459474DC4C2C98308E27ED6B2AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926938, "uuid": "1124be7a-2307-4c18-bd6c-52271815b6f8", "value": "49152:cRIi1xIc+76W5DEU3ZPf9MThqruKRc4lcePND5o+LUEoKL:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709926938, "uuid": "8c136456-14ad-4681-9cbe-390de02ce22d", "value": 15691274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709926938, "uuid": "1b077e6f-7d7e-4845-90c2-49e958647ca7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709926938, "uuid": "3c3fc5ce-e95f-4823-8f4b-ae01c815cb25", "value": "sdfsadsa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de941472-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709917015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917015, "uuid": "175b2e8e-11a1-416f-8afe-1b2449f27fef", "comment": "Malware payload (Formbook)", "value": "aff08aa19df6408b006a7101bc319331", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917015, "uuid": "b6923a2d-ff14-4a23-ad67-38f06c18d823", "comment": "Malware payload (Formbook)", "value": "effef20ffcb63fc0836c4f20efd4d5a9458eb46149303bad43dd4cee0cff2fe3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917015, "uuid": "eda0808a-61fa-4788-adbd-6f94dd34d26e", "comment": "Malware payload (Formbook)", "value": "e0d959257d86235372a0adcff5d77278e8de775c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917015, "uuid": "5f1500a5-7887-43ad-872b-919cde9704a5", "comment": "Malware payload (Formbook)", "value": "5a7d017dce240e7105eb7544d16ed7979f36f372564386e7694d76ae2226108793caeeb7dede9a241f42b8c539d51589", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917015, "uuid": "bd169920-481a-4286-b0b1-5262cf6c7d76", "value": "T177C4232280571A05A587C5D520C3DFEB7C28DB8F86D80526E3C1E932CF645BF7AE5E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917015, "uuid": "e4a04e12-d540-4fa7-9ab0-65534f3b24d4", "value": "12288:XDlObpDi8JH1U76b2EGLch2wBbDoE2mlPChQpHLkTDXaWAUBLfKOhC:A1Di8JH1U7Q2ElR3VtlCaonXaWAUJfKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917015, "uuid": "7737df3f-2d1a-4db4-9cc4-f5cf98e9c225", "value": 596353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917015, "uuid": "3c949352-3bb1-49c1-80e2-cf0cec151761", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917015, "uuid": "f16986f3-a75b-4ac6-aa87-f3ef1fa64148", "value": "\u03a0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1 \u03b1\u03b3\u03bf\u03c1\u03ac\u03c2 000987-006457687465354465.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32300445-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898687, "uuid": "bd8805cf-3e3e-4b1f-9958-b2f5e8ee6e04", "comment": "Malware payload (Mirai)", "value": "235c514c447292be2701a8efe674891a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898687, "uuid": "e3a38a9d-41a2-4ff0-8c2b-e41c48ea914d", "comment": "Malware payload (Mirai)", "value": "f11f71948006e68b3fe2eb1f50d894b861ecf19b0b1033bd07e51ea417bfef4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898687, "uuid": "cd606366-85af-4c67-a67a-4c7ddfdb8074", "comment": "Malware payload (Mirai)", "value": "24b5e1efc9ee353749300a34f4df5f016dcc04f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898687, "uuid": "388e8d93-3706-45e9-9596-55018bb45d53", "comment": "Malware payload (Mirai)", "value": "4b3ffb8d288acd5d70de5d5b8e195cd47fc1e83bec8e4bbbf4e287d34cb0d6a776c1e28d0be07d481988cb1673c63e31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898687, "uuid": "24db6623-935d-4777-9ace-13edaf720ea9", "value": "T18353855D3E628FACFBECC63447B79A216249379637A1C584D19CD6012E7028E341FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898687, "uuid": "91db4f72-4230-45df-b8e7-48837fb3f306", "value": "768:bnVeM1PhzBoDPHStvMsHr95fKllQKbBPG+u0tJXiFE0Lir0FyDltogi2ZvB7:1BhzBoSt0wobBG+u0tMh200to4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898687, "uuid": "20cbdd68-1f5b-46cd-a117-37f96f06bc02", "value": 64236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898687, "uuid": "eddab8aa-30f0-4003-9ac3-f156d57a2669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898687, "uuid": "be14703a-9a7e-4bd7-90bd-1022f840f508", "value": "235c514c447292be2701a8efe674891a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2940b815-dd14-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MyloBot)", "timestamp": 1709878915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878915, "uuid": "f7f81993-aac0-44f2-8133-c157f22e02bd", "comment": "Malware payload (MyloBot)", "value": "6071162642b20b753aa0453beac9f2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mylobot", "colour": "#F2EB91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878915, "uuid": "9105b200-0e49-4e9a-811c-67066b933f0e", "comment": "Malware payload (MyloBot)", "value": "f2861c4e233f053002899cf60d8070b257bc984c049aaee8bb734a3b9d20b4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mylobot", "colour": "#F2EB91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878915, "uuid": "64c229b1-6a78-4e94-8f28-b871785fb28d", "comment": "Malware payload (MyloBot)", "value": "f3273a79468202037b5748116268a374b4caa2a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mylobot", "colour": "#F2EB91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709878915, "uuid": "8d0208d9-1825-454d-8641-575e6b9990e9", "comment": "Malware payload (MyloBot)", "value": "f547e0b37b00670c71cbdeb77550169c27a60d3dc25dd7089c7a41faadfff6000967f69e15738469d70e36abe8ec87e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mylobot", "colour": "#F2EB91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878915, "uuid": "726f3786-22f5-4d86-85a2-562060b25558", "value": "T193C4D000BDC08472C6733C310775E6B24D6DA8312E249E9F57985A75AF34782EA39B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878915, "uuid": "7cea9d8d-4480-436e-95cd-171e3687cd87", "value": "5cd457c58b1572e4fc9b2b3c7e5b3770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878915, "uuid": "72073e11-ba4e-4063-acb1-30e2e1742ce2", "value": "12288:KkbTE1rkt826L4xd1EiEt6empQ+uK+KVUhM+1n3+daYXQnG7kW:Kk818EiYTmp16DUdP4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709878915, "uuid": "ae31cf99-4512-48e8-b68a-03db1cfb2aa1", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709878915, "uuid": "27d3c1be-de8b-46af-86d2-12b33dcf00da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709878915, "uuid": "6c109799-f033-4b70-b955-d7d3f6624cb0", "value": "SecuriteInfo.com.Trojan.Siggen26.13995.11728.18139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0fdb2f-dd9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709936610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936610, "uuid": "44feedbd-3562-4bdc-a749-d6c6df39e5fa", "comment": "Malware payload", "value": "9558909b168ae092421db949bbbb87b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936610, "uuid": "d55d8e2b-4ca6-4514-bf94-1f23413573bd", "comment": "Malware payload", "value": "f28c542f59c664701502f55f8cced8d6b1a5cc3ed847345942c375d4b6cd3147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936610, "uuid": "93abf9e9-3287-4da2-ba13-1f2f51ace8e2", "comment": "Malware payload", "value": "528ace7cc97cb3a7acde729e01d73d6eac616d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709936610, "uuid": "a62aa536-3feb-412c-a8d8-1cfabe3fb0a1", "comment": "Malware payload", "value": "13a7d47ffeb9593e60426902be78b22abb64c2b99f8932822dc1ffd42164019bd704f3cd8c291872a56f4a110bfc03cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936610, "uuid": "fdb7e8e3-a05a-47b6-af72-002ae2c585e3", "value": "T179559D0333A6C0E9CE2790F2CA255623E776743517289ADB75F05A2DEF83EA05B36711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936610, "uuid": "16a4882a-e001-4f86-b4cb-9e8cefa9b348", "value": "a649e6750bcf2911044dec744c57f40f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936610, "uuid": "113cb849-4281-409b-816a-e74a1edb693c", "value": "24576:IdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqP8bqAC:IdofGbSIQ177wZvYjiiRDXASat5RgsLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709936610, "uuid": "fe1e5557-47cd-4f3f-ac57-47fe71e0015a", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709936610, "uuid": "2b850797-3cc3-4ca1-a83c-fa0b75264949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709936610, "uuid": "dfe9357f-8131-465a-bc97-c6c763053843", "value": "SecuriteInfo.com.Trojan.GenericKD.68336658.9759.9322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9160b-dd37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709894085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894085, "uuid": "85187a91-9759-427c-8f66-c13f62cb03b6", "comment": "Malware payload (Stealc)", "value": "f0ab5dd414a8ddb61e835e7a033fa147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894085, "uuid": "adb5188e-eb55-4687-9f43-ad077cb13a9f", "comment": "Malware payload (Stealc)", "value": "f29321330313c1a2cf9a7dcd67044db5cd8514c6758a291a69645316db940020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894085, "uuid": "71a5511c-1541-4679-9074-aac71ebd096d", "comment": "Malware payload (Stealc)", "value": "1a606cd8d7cde35fa0e381f8c3e08da99d815e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709894085, "uuid": "11a68c55-bc2d-4a46-95df-74bcab3aa2eb", "comment": "Malware payload (Stealc)", "value": "3e4c89b8ac3a0d8a2cca9adce5c0c375bf36b350500a065fdb920addb4cce694d759c5ec5166819ce67c2d272a82b434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894085, "uuid": "b0755a8f-3b9d-44a5-b7a4-92c33861d52d", "value": "T1AC84F001F691E4B5F2674D30D966CFF0C6BEB961D932429F33E4676E1E703A08A22356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894085, "uuid": "cec91369-46e0-4708-9672-3da75d6e9659", "value": "cc97bd7b37ffc8623435e9eaccfab9ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894085, "uuid": "cfcfa2b2-f362-423d-af5c-ef85ae8b12a2", "value": "6144:NLNYPBixifMoj+ikOXer0EoZG5uCaN44ajqkomKX:NJYM4h+Vd0P4jf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709894085, "uuid": "1b84de5a-2d38-429c-b3b7-75fcc1d05f00", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709894085, "uuid": "9915db5a-be0f-4554-98cf-9295cf870b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709894085, "uuid": "ead85a41-394d-4b47-9368-c0649fd810d8", "value": "SecuriteInfo.com.Win32.RansomX-gen.32025.5601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a27af7-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921329, "uuid": "b8171129-6ec6-445b-afdf-045f2e867b31", "comment": "Malware payload (Mirai)", "value": "93099cf06f2e2114035086c7d81505d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921329, "uuid": "03b5a296-98b0-4778-bb36-76f5516593d2", "comment": "Malware payload (Mirai)", "value": "f33e9499569e23170a6e789565da07254dc81f7593cdf24e034095bfadea5321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921329, "uuid": "67539859-e1d6-4e13-b26d-9a3ce8363f70", "comment": "Malware payload (Mirai)", "value": "0c2cc97a3d1b2652f4340420610fe77a3ee60b07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921329, "uuid": "45f1c5ef-4526-4046-843f-9b139cba55e4", "comment": "Malware payload (Mirai)", "value": "180d21abcc58c7abb0ca08f6d4128010944395f718ece780f37208e05666868dff133383bbc486ca71f1d64e2f6b5d33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921329, "uuid": "b006e110-c0be-4a94-9fc5-8c10b9fb016b", "value": "T1F1331941B8814623C6D4137BF6AE068D3B2523E8E2DF72179E225F61379682F0D77E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921329, "uuid": "b0efa5e0-9b9b-49e7-8bc9-6e9aa7d38bc8", "value": "768:ubdQnz3FpspG0sOODEQEE4k3ZT57Dt/DNz3pK61NGc1TZ/ZBjbmdJgw:+QnpIGfNyc3ZT575V3k6zBFTgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921329, "uuid": "903650d2-08ab-484b-b3c1-46994400bd5f", "value": 50272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921329, "uuid": "f78028b4-7568-48bc-b49d-b86beb5d921e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921329, "uuid": "e97617c8-418d-4e68-bb76-cbb310d9c0dd", "value": "93099cf06f2e2114035086c7d81505d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43045bc9-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898715, "uuid": "290b2973-8114-4a9a-bf4b-4dce2538632d", "comment": "Malware payload (Mirai)", "value": "d7e3a3dfb1d08586e2dc5270ebaa80a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898715, "uuid": "daea2714-2170-4d94-9d87-cc33b91b780a", "comment": "Malware payload (Mirai)", "value": "f6735d8eeb6753fe18ab8524e130b6f14fb9eaacb578653cf4bcd4107dd2edad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898715, "uuid": "722514a5-9a79-418d-a1da-cad005ae58e2", "comment": "Malware payload (Mirai)", "value": "25a10e4acaaa6c80f6b91210a09318ef2581959b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898715, "uuid": "ad75a460-02e1-490c-aa46-d7c10352528e", "comment": "Malware payload (Mirai)", "value": "eb6a69d4916e18f9d2f8481f598955afc1e721b58a9194703383de01024cb3a72f25f96f3dc27045947817b66fcff4a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898715, "uuid": "c7c20a8e-a26e-44c8-a363-51fcb8e6896a", "value": "T14723078AFC01AE3CF91BE7BE5463890DF520724151930B2B6767FDD3AC321A85D26E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898715, "uuid": "40d38791-8689-4702-aec5-da817fe12d47", "value": "768:aEessI9GVBHN2yzioHuJ8VNGUW2QYnhlNkzcwaJf5w61XN2:d/Z2HN2AioOJ8jK21nlkzCJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898715, "uuid": "922449f5-554a-4627-97dd-ef9c03efe530", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898715, "uuid": "72ca1a6b-b664-4cfd-a139-415278e9d341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898715, "uuid": "e68ba545-fbb1-4f31-9372-b64c204997a5", "value": "d7e3a3dfb1d08586e2dc5270ebaa80a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b3f41f-dd27-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1709887179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887179, "uuid": "211730c8-a28b-408a-90f5-03b339e9eaa7", "comment": "Malware payload (Amadey)", "value": "1183330295d5e7fdcf0cdcdb277e4ebf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887179, "uuid": "4323e71c-aee2-439f-82c9-19bbf1528a3f", "comment": "Malware payload (Amadey)", "value": "f67dd838b2a5fbb4739bd30ca721240f99f2f66e49c352aa600f2d443004c787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887179, "uuid": "af2023ff-5056-4af7-b818-bfcab05abe19", "comment": "Malware payload (Amadey)", "value": "c606713113c7d61332302d9931a80b33075ab724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709887179, "uuid": "6a566682-9f3b-423d-a837-03a774d1378a", "comment": "Malware payload (Amadey)", "value": "41f9ae21c340810a6950d51bea88553e78cc5f94b2bd6f66443b326e07c9d6e15c7bfff6a4c0356ecc5275b2d78fb6da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887179, "uuid": "f6fde687-8b80-4cd2-ad46-1bfccae4c314", "value": "T1B38533865F76077BD49B42FE415BAB2DE9B1A20441ED754B0B68CC3C367F8B0A854E0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887179, "uuid": "712d1b56-5ebd-460a-a97e-d0d131a558ce", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887179, "uuid": "20bbdb72-04fa-40e9-b7cd-3d0ef9c6353c", "value": "49152:11CNWxSMTYaF7Za0RayW7SSXxm6aggChrYJS:11CozTYadoz7SkgoEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709887179, "uuid": "8948d107-3564-4a1b-a15c-341d9969aec8", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709887179, "uuid": "3f66584d-fbe4-4d2a-ab98-66fc0708e5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709887179, "uuid": "62691dbd-7de3-42e4-a6f1-2a26539d8f3d", "value": "1183330295d5e7fdcf0cdcdb277e4ebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21d075d-dd0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709875816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875816, "uuid": "8e1f3330-6236-4966-9b44-de37a53f7210", "comment": "Malware payload", "value": "de2947dcf4c92d06379446a8274029ce", "object_relation": "md5", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875816, "uuid": "74921afd-c4b1-4348-8090-fa6dd6cca323", "comment": "Malware payload", "value": "f82dde5708380cf4900414e069c234bdbb3db712155162c90f3536d191f4030f", "object_relation": "sha256", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875816, "uuid": "5b0439c3-4367-47d2-8afe-99f937e73dd3", "comment": "Malware payload", "value": "88d12cac0b690b1c3cafd24d66131e72e3b75914", "object_relation": "sha1", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709875816, "uuid": "7d9b3066-6d0c-4549-a250-cb262da24467", "comment": "Malware payload", "value": "96a4866c4af573cc89c4531981ed549e0f148fe0ae80e4e4eb423bee71650fe9bf523e12976ee084272563a9f62e2acc", "object_relation": "sha3-384", "Tag": [ { "name": "AllenOvery", "colour": "#948AFD", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875816, "uuid": "4e57996c-4764-4ed7-bfc6-43accd6ac71e", "value": "T1D55633218A65BAA431153A744D61CCF278D1D67670B93A2BD80A1B7DD4C4A0F7B3FAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875816, "uuid": "efc4d118-243e-4c0e-bcea-0ffb65c88fc7", "value": "98304:wibQ/Zo2v0qM96cYtMUhmddN1YlSdzvayKWw3LPl2q9xOuDAU88y08knioLbkpJw:wbhrFMzYt9mdf1YAJCnTl26xOuED/08u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709875816, "uuid": "b2d91c9c-69ee-46d0-beaa-b7d6d2affb7d", "value": 6055083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709875816, "uuid": "5e3121cf-0b58-432c-88a7-7f1a02b030be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709875816, "uuid": "d37be556-a713-4882-95d5-7cd59a5322b0", "value": "756923_DATE_03_07_2024_44292664.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eebb14a-dd42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709898708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898708, "uuid": "4806207e-f3c1-45da-876b-41f7947ce8bc", "comment": "Malware payload (Mirai)", "value": "ae09921e621ef0b86ab9e4d40e219f9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898708, "uuid": "43016c6e-dfa0-4cb3-86f4-10c22a336166", "comment": "Malware payload (Mirai)", "value": "f8343605070cb1093e710317667c40f87b7b2823ae17e628807821b4c8540331", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898708, "uuid": "0bb19996-43f2-4603-a059-ee9f4ea38151", "comment": "Malware payload (Mirai)", "value": "c2f3c1e8f1dc2c37c72180089f4700773d13daf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709898708, "uuid": "a8faa28c-533d-4f12-9f9d-f593d39450a7", "comment": "Malware payload (Mirai)", "value": "2831f29a01bc2c22b054003f32ec48e380634a592143eedd83adc88af3cf2d009ff99ca562e34c4af1318ff24e98aa05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898708, "uuid": "f9712435-d848-436f-9522-6eebb5a60063", "value": "T118431A4ABDC19B16C5C412BEFE1E128D3317676CE3DE72139D206B247B8766B0A3B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898708, "uuid": "a1a5bc84-1162-4065-960c-d96d9b270643", "value": "768:NZnQ7SnT6jZQDE7Hy521yWqqqbCm37mAU8fWmu49vMWpRizFQLyIV4RjaVmJ:NZncu6X7C2sWqZbzSAl37M4izFSy84x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709898708, "uuid": "dca22153-29d6-44b5-9934-6ae42b155d95", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709898708, "uuid": "3c7afa4d-6a6c-4083-814a-7885b9875b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709898708, "uuid": "e5e27771-fbd3-4068-abdf-92ffbcfcd491", "value": "ae09921e621ef0b86ab9e4d40e219f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ac141c-dd24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709886024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886024, "uuid": "ad22cb6e-2f5e-4027-9535-24ad45a4c33d", "comment": "Malware payload (Stealc)", "value": "b6eefc8fa7a4230bcde74f219523a2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886024, "uuid": "5b42ad61-bef4-4c04-9755-bc747e1e51e5", "comment": "Malware payload (Stealc)", "value": "f900d5bebd2241a0f1bf969c7c2ece6b6f53440d97ee3ddcd19566866a2dca18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886024, "uuid": "4c5eb014-a8d4-42a7-af34-f4f9d93b3f6e", "comment": "Malware payload (Stealc)", "value": "ed7e3c20e50c68d54db3f41c1e01d4cb61245910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709886024, "uuid": "acc1f010-fb48-4277-b097-2041d09f5d5c", "comment": "Malware payload (Stealc)", "value": "c0121e74e72e826c269e5a86391892b39b5cf74e9f1e23cfb5bced09ffb46f475a0a927c597f2e536d7fa9fd742481fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886024, "uuid": "bb998975-e5ae-43f7-9416-73583c614cb7", "value": "T13D84E011F2A1D4B1F2929530CA65CEF116FAB852D977929B739D372F2F7038085B2392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886024, "uuid": "f50de5eb-17e1-4c83-ae73-b143091492d5", "value": "cc97bd7b37ffc8623435e9eaccfab9ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886024, "uuid": "2c103fc9-9e17-4d08-9312-e78ee586b497", "value": "12288:QQpEuN8D0bQ/qYJr1w5D4detlUELPKh4xF:auW0U/qqrO5D4QzUEWh4xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709886024, "uuid": "8f78e971-2423-4f4a-b068-ee0875552728", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709886024, "uuid": "56a721f8-4e62-412d-9dea-5c357bbc5646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709886024, "uuid": "6d0418cf-3518-4fea-ad87-6cc9cdc2fc8a", "value": "SecuriteInfo.com.W32.Kryptik.HCOV.tr.14466.16669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa86cb53-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709921357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921357, "uuid": "857ea6c6-0bfc-424f-a40a-e2de38bcb2ac", "comment": "Malware payload", "value": "e3ee59d1a9af7026cb5c3cadd9ea7f4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921357, "uuid": "ddc26c6f-63f4-4f0a-aa8b-e49fe8ad0286", "comment": "Malware payload", "value": "f9881588613d2f7536a6bc3933ba61f3818ef06c941ddbe1ee431d302dbcb861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921357, "uuid": "25d1ef07-8091-4df4-8cd3-b52ce51b7a13", "comment": "Malware payload", "value": "980a16250884970512d703ac95fc058e489b8aac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921357, "uuid": "e416131b-7274-467c-8f30-ce74fae40db5", "comment": "Malware payload", "value": "41d1393b1921e6cb3d27781213497e0507ef7e7fa92f43f956cb67d4180d15753bb23bb2309968c9e6f09f8b01cfc193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921357, "uuid": "b2c86827-605d-405f-85b1-9d8a98bdf195", "value": "T1B1231902B21C0F1BC0A31A74253F5BD097BEBAD022E4F689765F5B9A8975D330186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921357, "uuid": "5cdca863-4450-4f6a-b26e-32202254ed0e", "value": "768:GzjhRggRpAUA+SvQGj9/xp483SK+hh5QZWI8+HAw3:uhFivD/xpDE5uWIjB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921357, "uuid": "9d94e1b4-e541-4805-8fd1-d142a332428c", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921357, "uuid": "887cf87a-039f-44f9-83a2-f1821eabbdfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921357, "uuid": "e135c127-1782-4d8e-a122-415268665b01", "value": "e3ee59d1a9af7026cb5c3cadd9ea7f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d59c0c6-dd7b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709923268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923268, "uuid": "831edb75-88a1-476b-a27e-c445c321fc60", "comment": "Malware payload", "value": "c8e55f28542bc2acf63df83ded92d60e", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maques", "colour": "#EB2F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923268, "uuid": "6980ce84-a7d9-41b8-9bff-d68eeb582959", "comment": "Malware payload", "value": "f9ac429ebf921c1d512cb119b5ca089718a88e65b0599e3ba208bd5fa0a6f407", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maques", "colour": "#EB2F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923268, "uuid": "ba749a6d-ddcf-4849-a48f-922683164cb8", "comment": "Malware payload", "value": "57856c80b162d89ef78c23b9410da8f11769b92b", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maques", "colour": "#EB2F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709923268, "uuid": "aadad6a6-9953-47d1-b186-bc65fc625df2", "comment": "Malware payload", "value": "8703fd3ff625fd1f8e433e7c44c2fc4758442d3484a6655a54a2178bbe374214a876a355134af05fae0d0ca73243461e", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maques", "colour": "#EB2F3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923268, "uuid": "1f5eb6d8-82a1-4930-af4b-db2379668761", "value": "T12EA78C0673E60198E1B7D1388AA79507E7B3B8161730D7DF329C02692F77AE09D7A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923268, "uuid": "939870b1-3e41-4ec0-9ce4-932fe366fc3c", "value": "60119ed42f111b2c92d08284871fdfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923268, "uuid": "bffe4a45-75df-408c-8d70-f247c727e8f0", "value": "393216:dyT3YGojrsBEnP4XrqSFM+FcrONRtgZJ93AEMQu58EISEhoIaE2FShMzTVA+BDE7:dWeBZ6QxhUDE5bO26rsxcMOIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709923268, "uuid": "ec3fffd5-a8b3-4f64-88a6-b19018928e1b", "value": 44394577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709923268, "uuid": "ee79bc36-f586-441e-9090-7ecff8c735c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709923268, "uuid": "2e3ddacc-a188-4719-be89-3e17b65fab7d", "value": "Mauqes_beta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd830554-dd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709917013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917013, "uuid": "4673e380-187a-4439-b85b-5b83c227e769", "comment": "Malware payload", "value": "646ce6ec3effd4b9d7cd93c656cfdbdf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917013, "uuid": "2c61cd5b-5593-412a-8d26-f83f6292d0d2", "comment": "Malware payload", "value": "f9e336279a1e2bf97ef4c8179b3507c4acda345c388695d766ec5f423be22577", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917013, "uuid": "a5e56123-1586-449d-9fe9-079bb4822ab6", "comment": "Malware payload", "value": "3f2affe56ff8af95727a64faf82ff8c99d3607ee", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709917013, "uuid": "841f4267-6722-420f-a55e-9d49321a7b7c", "comment": "Malware payload", "value": "d2929e0793f7b34884e15bded6351ed05a4ebf92ccccbbb9fed434e7000f3c3c3b7fd8a47a3db4b0dab443b632b4ddad", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917013, "uuid": "d885ff9c-08c7-4672-94e2-b39529cfdbac", "value": "T1CC119411562456A212EA31368E73389CE3BA2490E2CB939C1AEFB0DCD296992B5D1505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917013, "uuid": "a0a80112-0564-42e9-a14a-d71739f8a9e0", "value": "24:ZOrUFGSeiHFYTt5r4jxca3zvmBNNDxLdc3:ZS0k5ricZBRL23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709917013, "uuid": "96c6486b-3a68-48c5-b1de-3207629b9c81", "value": 1013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709917013, "uuid": "361b505c-be7f-4c4e-9fec-a4f6ee4ded0e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709917013, "uuid": "f7541935-dfba-4b6e-9d14-7936e6d2f3d2", "value": "Swift_\u03ad\u03bc\u03b2\u03b1\u03c3\u03bc\u03b1.PDF.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6b4c15-dd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709908180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908180, "uuid": "4aeb70ed-119f-4310-9f93-5e39e6ddefaf", "comment": "Malware payload", "value": "2e868ea1b1207b4c88944e6ca968e5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908180, "uuid": "45559835-7fe7-40a1-bd2b-55a14a3df6de", "comment": "Malware payload", "value": "faf65515e7d8ab1be66ac53079f50482740a0cdcb623ec9e65ace573bedceb8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908180, "uuid": "ed207f4d-507e-4340-b14a-e5fe16cc525c", "comment": "Malware payload", "value": "a458ea640c02944ed604af9105ee626d7ccbf450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709908180, "uuid": "956bdc88-c399-4c69-99db-58a003f24b3a", "comment": "Malware payload", "value": "0f112b7293f220e29a5c5a1ac5ccbf541c22c047c387b7d41b7b74901e64913b86e8aa8b2505f6a2baa6d0dcabc84935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908180, "uuid": "48a53632-e855-4e46-a967-68851574d9b5", "value": "T1ADA423A89AC3D47BC08709750657AB7AD3BA0342AB970067BF594F5E3DC83B76C48187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908180, "uuid": "b47dc69f-f290-4742-bfef-a2e246cf0be5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908180, "uuid": "f1508e25-5761-4782-bb59-6f1404b2f860", "value": "12288:l0klQ4GUW7sa0dX50I9h8MWQ6hV2jMB4pky:+43W7sa0dX50I9h16hV2jBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709908180, "uuid": "2692f2af-ff79-4042-83af-82398aa78737", "value": 470320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709908180, "uuid": "e9fef491-b7ee-442c-b77e-7250391744e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709908180, "uuid": "0d6f2fd3-9397-40be-96fa-18cb28c79def", "value": "SecuriteInfo.com.Unwanted-Program.0056626f1.515.26855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e347bfac-dd76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709921318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921318, "uuid": "58d77d9b-1950-4b80-94c0-234ac866a06f", "comment": "Malware payload (Mirai)", "value": "1d31b8e56f362d8865715610dbdc5e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921318, "uuid": "39a8c51c-31a0-4eea-a55b-f8569fc0efdd", "comment": "Malware payload (Mirai)", "value": "ff5f2bbb4129ab15efae7837ee07646d715c36cb073b7c3999ca81dbd3ccbfb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921318, "uuid": "f77400fc-4766-421a-819d-8dca312d925e", "comment": "Malware payload (Mirai)", "value": "21aa04efa7eaf701c8d43ca4e7632591405f0661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709921318, "uuid": "d6975397-6783-41c4-9d8a-9482192d53a6", "comment": "Malware payload (Mirai)", "value": "6fc0b5e0a22801d3fed8723e6eecb46e97c9f56cb2759bb23ce88964f4a5959c7ba136c3f252f856deb8d3e24c6b1ab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921318, "uuid": "591ad613-c64d-4bd9-af3a-0e53b3aed545", "value": "T1E0C32A56EA408B13C0D61776BAEF4245333397A5A3DB730695286FB43F86B9F0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921318, "uuid": "ab819609-7268-4ab7-8b42-f32a078b0851", "value": "3072:su5b3UofoMiHZDYFxLE7Dh5mBzM/9KP+j:su5AofoMiHZcFy7Dh5QzM/9KP+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709921318, "uuid": "5333c6cc-90fd-4a7d-adfa-43fecb7f696f", "value": 124465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709921318, "uuid": "9cedaa19-d18f-4851-aae1-1ef7c95f7135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709921318, "uuid": "8c182c79-2778-4227-b3e6-bfc2855f18c3", "value": "1d31b8e56f362d8865715610dbdc5e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }