{ "Event": { "published": true, "date": "2023-03-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-04", "timestamp": 1677974581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c5b9e399-bd2c-49a2-a527-65d91fa6de5a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94340e9c-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677916807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916807, "uuid": "3098102d-fc18-405e-8237-17a534261cc0", "comment": "Malware payload (Mirai)", "value": "0e220be5c492ef4199b0ffb151329cb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916807, "uuid": "37f0a71b-15cd-4c9d-a99a-62cc2b101ac4", "comment": "Malware payload (Mirai)", "value": "001234985e9f38e8a6452154b8aa51c64922baf6defe717465b758761618be3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916807, "uuid": "b36094b4-0a43-45a9-9a8c-b18e5d433763", "comment": "Malware payload (Mirai)", "value": "3b615fae76283de2b02d9c82c0cc1398fda84fdd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916807, "uuid": "fec42746-cb41-40b2-b4a9-2bff172361ec", "comment": "Malware payload (Mirai)", "value": "27918317c85debaf9793e8a80b2f26a8bc8d0d9fd38a27c30284b904c76858ba9a25c1605b89ff36dd1737b7be37a193", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916807, "uuid": "2b6b8b09-d33b-4120-b694-5419ab3bf97b", "value": "T1A1230271880E9EB124703C76EA99D393B6E12AB1C5673013D6290B3C6F757231E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916807, "uuid": "ca954021-9c0e-45f9-893d-d090c040916e", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3m0r9q3UELbUXfi6nVMQHI4vcGpvv:gECFd+A6YHAxLKLRQZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916807, "uuid": "8bef3cb3-b897-4aa8-b90d-542fa434227c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916807, "uuid": "26f23807-4d2a-4ce1-b0e9-a6bc14417c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916807, "uuid": "616b0ea7-08b0-4276-a5b3-f8dec918a2d0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68855699-ba98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677939926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939926, "uuid": "a9050ead-739f-4aea-a486-bd95126bb154", "comment": "Malware payload (Mirai)", "value": "1d5282c101b5f5dc79b6ed4c722c1379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939926, "uuid": "26156f36-37fd-489d-93b8-13142de9eb4d", "comment": "Malware payload (Mirai)", "value": "00fbcd9881c059f059eecaa6888bd505c6a906566d1d6a42c26f83ffe3efe34e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939926, "uuid": "e6bbd785-622a-4630-8f7f-5342bd7a40a8", "comment": "Malware payload (Mirai)", "value": "99a2edaeabf1d930fae4df7c085cd2addbf3d5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939926, "uuid": "45ddce9a-a027-496d-899f-40ea48deafbd", "comment": "Malware payload (Mirai)", "value": "bd358292be653e5cc5c28038086fdd09832ff674360e448591a1c55a228d578ea9e19525f1ff6cef2ac9d527dec2ae73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939926, "uuid": "69ce70cf-a151-41fb-8cbc-da63b12a1003", "value": "T127A2D054C144939AFD7E9CB22D60F7C12BE12F8A73961DD0294A9E620563579E708FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939926, "uuid": "52255a2e-8b9c-4eb5-b174-caa5001abf0a", "value": "384:OnMJdCSSXr+MT3L3fG9R4LQOpb1LWIwQgmSnglM4uVcqgw05VxJNF:OMJd1SveU5pKQ7C4uVcqgw09p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677939926, "uuid": "84593477-c379-4d5a-920f-6a98590da51b", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677939926, "uuid": "b1d8a3c1-2b66-45ec-a466-271ac316d780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939926, "uuid": "1dad2bb8-f69c-4d12-b8db-76253e49357f", "value": "1d5282c101b5f5dc79b6ed4c722c1379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7f3e17-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677916851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916851, "uuid": "36e516ca-0fd3-4cf7-a18f-e08578a68172", "comment": "Malware payload (AgentTesla)", "value": "c940a870cdbe9ae64510bf01abbfe29b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916851, "uuid": "253c742a-b252-44fb-a84a-ed4117c623d8", "comment": "Malware payload (AgentTesla)", "value": "01d4c768eb131e8f7e2ffef8bc17f9ceb629ffdb3dd4a6364aaf8096bdd16161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916851, "uuid": "459ac259-550f-4a55-99ae-22f725237199", "comment": "Malware payload (AgentTesla)", "value": "0f88a7e7c80f94ebb68b71945ce5e029a753faf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916851, "uuid": "feab92eb-2932-46ff-98d4-8200a1aa1765", "comment": "Malware payload (AgentTesla)", "value": "6df6effffa074e96ffb563e288fa85fa4f89baa1c7a04465711cf3f20a28a240c1a447ce857a9978a474a826e9276fda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916851, "uuid": "e54a37ea-cb7b-4bc4-853b-25be048d16ac", "value": "T12555B82808FC0EF28571F1FD9FD4E753BE8088E6A6049D9AC2874B89555395720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916851, "uuid": "6ab85e18-a13b-4ced-b4c5-39d01b8c3ac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916851, "uuid": "479141d4-a7e1-4698-a4a5-4df9c84ebcd7", "value": "12288:KNzZZMOEAlI3MzSSV93CpeG4f3fjzwwup1qGlIp9AwPvv8FAl8rAnS904gk4x:qtmYdSSGaffjzwJp/Tis9rWxM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916851, "uuid": "a0cd4ec7-7d9a-4bb9-b2a1-1a86fcefae46", "value": 1289216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916851, "uuid": "e1b04ef2-c646-41d2-a253-af65b0280f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916851, "uuid": "640a1e47-0025-42cd-94c6-212bcffc68f3", "value": "c940a870cdbe9ae64510bf01abbfe29b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c29fe4-ba36-11ed-88f6-42010a9c006e", "comment": "Malware payload (Zyklon)", "timestamp": 1677897907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897907, "uuid": "3385df2a-8b90-4fc4-a275-de3ea7fd7fd1", "comment": "Malware payload (Zyklon)", "value": "8fab718228da721d5af292edd4f6c139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897907, "uuid": "8dcf7f22-092f-465f-869e-c8b199be2c12", "comment": "Malware payload (Zyklon)", "value": "02c0037306a81126fe23879e3d5dd9c3e3125df6e69a9ea393bf88bb782439e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897907, "uuid": "d0efe2fb-fb3c-4228-a282-a4ce4deb9b6e", "comment": "Malware payload (Zyklon)", "value": "f1ddbe70c22d5bd555fddb41ca27ae45049e086e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897907, "uuid": "9fe81fb3-0224-46cb-9104-bc3c6fd38ffc", "comment": "Malware payload (Zyklon)", "value": "ceb6e916d0208774ee2c508721d306cb371e064616814ae2413b9bc6377a6e27a3ab8ebaa50d78069d5601d9c9ff87c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897907, "uuid": "faa972da-5d4b-41fe-8a37-5f20b1f0a923", "value": "T1D72523F241A40473CA5E5C799695423E3B921F5870AAD30B7193B2B7FEC02046DE6EDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897907, "uuid": "89570529-2ff9-4522-9063-d737085c1300", "value": "2e8f1861679abfa89736dd591010a087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897907, "uuid": "daca033e-d0a7-4039-8401-f29be908b4a6", "value": "24576:o/ZBfVMBnHXUi8l9gO+cP/U08JOP57aIVANDBcQ0YUVj8J2Ej:o/lmB8lp+cHUc7aIoBcQ0YUF8Ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677897907, "uuid": "60c4b8a4-51fb-4947-81f5-a9e5a11415fc", "value": 1042232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677897907, "uuid": "d8bf4577-8e65-49f1-8b62-3437e05dc93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897907, "uuid": "cc95f8d9-9061-45d9-8da0-8a2e82e034c4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b53c7d-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902121, "uuid": "624d0a36-9461-42c1-8ee6-ad7e2e8a6b09", "comment": "Malware payload (Mirai)", "value": "39eda2448e603f5324f0ae4f6eab6d06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902121, "uuid": "03be8d81-72dc-48f9-85ed-3c2732d9bd4e", "comment": "Malware payload (Mirai)", "value": "03e13da59633e12f1edf6477ca9f90415fe9184e0ad17716a7a66a714207636a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902121, "uuid": "c34f645b-4a85-4816-8b0e-43c72fcdb4a3", "comment": "Malware payload (Mirai)", "value": "af37d3edb4e50654d0b8e3b5023036052b875cb5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902121, "uuid": "8d259523-f542-4b56-a1af-e2f92f2ed52e", "comment": "Malware payload (Mirai)", "value": "00a3c290f77e3a23768be94a98352701da9f8cce5decc8bf3d1ae77d17248d90c50ab305e0e7cbc14b60b9380ef6f83e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902121, "uuid": "5ad905d7-96e3-4ffa-9650-b1d6ff09a6f0", "value": "T1ACE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902121, "uuid": "77e10d96-b4d2-4c71-bdd5-8a09ac477cae", "value": "3072:yJTc2PBSpma7Oabvzj4dlRsh8ZQIldHMXkkTM/9zY:yJTcG2Oabvzj4dLsh8/HMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902121, "uuid": "dd51b7ea-4b9d-4182-a3a2-0cc32a159792", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902121, "uuid": "a0593fca-1b5a-4ec9-ba4f-313bc3a0ae1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902121, "uuid": "31456694-db17-410d-bcef-c108bfb599aa", "value": "arm7-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370ca883-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948863, "uuid": "fe35388f-cce9-4957-874a-d0c37725b98f", "comment": "Malware payload (Mirai)", "value": "9089cac5ba2a1abec8456ff685a595f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948863, "uuid": "8939d8ef-4f09-4506-945e-3bf47ccdb2cf", "comment": "Malware payload (Mirai)", "value": "0813b28ca1a2a16d4b8ba2d9fd8cfa91acaf5ceeb37e9518259cf3ffc626c9f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948863, "uuid": "efda3b24-b94c-4c90-809e-956348edcb1d", "comment": "Malware payload (Mirai)", "value": "9b02e14df9941b36e2abc94726a46add6e0548c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948863, "uuid": "290777a3-4f83-4cba-82e2-1cfd390c54d4", "comment": "Malware payload (Mirai)", "value": "eb8b8c0d81b762eb04e57a765e847b3fff9190a1439515f9a042c5a4dba455d65b4400068b44c50820828a2a52ef0a1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948863, "uuid": "93b7f7f5-5bd4-454f-8941-8ed5a35a76fa", "value": "T1E4334A21AE792E2BC0D1B47A11F74724B2E6175E35E8C71E7C720E4EFF14A8061676B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948863, "uuid": "4327ba1d-ca01-4e0d-9835-636e0bd60644", "value": "768:aRDolNq9LDNsF3E0vwCZ2m2Y4R7VFlYpofRQReO+5e+yA8:aRD2NSLDNsxJvwCZ2ft7VMYRQRsGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948863, "uuid": "3772d923-0cf2-46d7-a1e0-25ec8cdde285", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948863, "uuid": "284192cb-87b6-46b4-8850-8e343c2d78a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948863, "uuid": "68923619-da0f-4ca9-9be3-dc35f4c1b374", "value": "9089cac5ba2a1abec8456ff685a595f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aa4257-ba98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677939945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939945, "uuid": "aa48d961-f2c8-4a5e-8be5-1e9f5df8ba00", "comment": "Malware payload (Mirai)", "value": "1ce19fed82c723fa4bf9963f55b0e264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939945, "uuid": "2f45d0a4-fb6a-4005-8d10-8dcca827b2cc", "comment": "Malware payload (Mirai)", "value": "0965a706426facb4f18debc1fd12bdd12fda465403f58a9295fd980880f7a7e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939945, "uuid": "5523efca-4b63-4802-9b45-3e066c17f936", "comment": "Malware payload (Mirai)", "value": "7b1e1049b6b752d470c500057225fb9c846ce8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939945, "uuid": "24c41f13-de09-4bf4-9c49-9687553362ce", "comment": "Malware payload (Mirai)", "value": "fe1839bb9808f5055413dadfde01c6bf36feceed12b688d1909fb5c916a638f79e231d6e04dafb7d09e6c7b206599299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939945, "uuid": "0a19d736-0cf8-44f4-8c84-fe32ee10d770", "value": "T16B233AD6B801AE7CF85FEABE80134A09F231335151930B2763B7FD936D721988D56E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939945, "uuid": "e67995d4-c6b8-403e-bdcf-8f86f8ddbd6f", "value": "768:x/eILq1E5TRhgK9PGKLnJwp/duhWer3pMoPJT0CupK878:Zlqu5NvdDnmp/shp9MoPJYCuU8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677939945, "uuid": "b9133989-e78f-486c-8d49-579ab09bdd15", "value": 49324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677939945, "uuid": "1d3381b6-4b14-4713-960c-cc87442dc0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939945, "uuid": "b1d6cc4b-d0b3-4e4c-b5f8-522901978e7c", "value": "1ce19fed82c723fa4bf9963f55b0e264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc86443-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677916152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916152, "uuid": "2851c3d3-f8eb-4f49-94ed-61ea5d70549a", "comment": "Malware payload (LummaStealer)", "value": "f84c03d90ed2b38cbf16b34241a1a6f5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916152, "uuid": "99630a96-cb76-4665-aed4-85c2c4c5a9d1", "comment": "Malware payload (LummaStealer)", "value": "0b415a18fbc825d548cd561a13f2dec853d3e0420e8276433f35bc15f94d0673", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916152, "uuid": "66814786-8277-4386-aebf-b42498f31e7b", "comment": "Malware payload (LummaStealer)", "value": "d903164ec5179e59a6ab8479ede421e2790cbc7a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916152, "uuid": "5bc990b7-cfe3-467f-8ad0-a33f76844240", "comment": "Malware payload (LummaStealer)", "value": "f8a0cdc5b134f49b13cda46f0b3be19af630842ae8188575708ff859cb1c31a02adc3b203fec040fe4a11ad40819e066", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916152, "uuid": "ea1c8817-1807-4a1b-8c79-ed7dfacd26a6", "value": "T12437331BA1830E67D60AE2B964D96B239316AFC8905693970750D1E73EB7FFC1F1090E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916152, "uuid": "c5798bf8-f761-47da-af8c-70de02df67e4", "value": "393216:A9ly9gUAeN9zxIgFRdIgoIRkG9tHP6y2/ewKIzDracjTy1Z9RkfWDgK9Sp0m:A9lGgKz3FTIQ99ttInHyUfWDgKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916152, "uuid": "2e533a98-4de7-42f5-b65e-b54c0846a959", "value": 22845230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916152, "uuid": "eb557e27-9902-4683-8751-2dc9bbc62823", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916152, "uuid": "d405c4b2-2691-4a60-970c-c5189700344a", "value": "installerx64bypcworldp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d886c96-bac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677957142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957142, "uuid": "149c74d9-3259-4f2f-9aef-824f84ef265b", "comment": "Malware payload (Mirai)", "value": "114b4ba902f167ea1a07ccc00e1d357b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957142, "uuid": "0618dd78-045b-48bf-bef9-864273d58955", "comment": "Malware payload (Mirai)", "value": "0c2667701c76e23af6a3a11125e14890850da3b607b76235e10145c9e1651424", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957142, "uuid": "9ac505bb-21a9-4f29-9c63-ec3175ce8c6b", "comment": "Malware payload (Mirai)", "value": "7b94dd39513895f47f8bb293624d9aedc7888eae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957142, "uuid": "212a009d-7d0b-4ba7-855e-ef186cc87b58", "comment": "Malware payload (Mirai)", "value": "9e731e3b8baec9ebad6b4c7dab93218bcbabab7b980a3a047517935b7b39c85bd1db35fac4016056303b08b4dfe8af44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957142, "uuid": "5f17ee0b-9e6b-450a-b491-e4060c71354e", "value": "T1AA73B50ABF610FF7EC6FCD3749AA1745298CA51A22E83B757934D818F64B24F05E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957142, "uuid": "4852d724-13af-40eb-8365-e9bdef481eb6", "value": "1536:tfxj5azbN3ArAWCa3MAohd1faI8tlBuZZ72jx1dHNM:t51azbN2JC3MDuOdHNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957142, "uuid": "446926c0-1159-43d0-a014-4862e6ff8cc7", "value": 80620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957142, "uuid": "aff97bbb-18d3-40e1-8381-3413c85ab8b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957142, "uuid": "5ecd36de-8b79-4976-a8eb-c365730d6b9b", "value": "114b4ba902f167ea1a07ccc00e1d357b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612b7839-babd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677955806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "bcef8a0d-66f1-49b7-a1e9-3d11f7295546", "comment": "Malware payload (Gafgyt)", "value": "d9651a8547a2fcfb535a62b08b60d7c0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "36160025-3b78-4c41-9622-4ae3e076951b", "comment": "Malware payload (Gafgyt)", "value": "0c4fd966880f2de6c60deed295a276f628c27b8ab1a53cf42cb7d489445e1ac0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "0a6e3aae-daae-4eb7-801c-ae36b1292be9", "comment": "Malware payload (Gafgyt)", "value": "b1a5e3abbb55fa1a42aa076627521d6dc07abda7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "8c19c2ed-64c1-45a4-a891-5be25dab0135", "comment": "Malware payload (Gafgyt)", "value": "b46b056da5b2516db2ff871085da597925d9011858bb8397e2ed8d6f4e25bec70f5cffd28d398d0673f06292d38cc7f9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "f92c32ba-7635-4844-aa8d-4f497a2becb7", "value": "T16C934C06F8419713C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "df0a04fe-4f3d-499a-9835-bbb07d471c71", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyX5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjj5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677955806, "uuid": "ae1e1177-a362-48cf-b0db-ee81c707e83e", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677955806, "uuid": "047c583e-075d-4328-952b-e58edf2bcebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "5a00eba9-fd56-44d4-968e-092aa942cd98", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6b1971-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922005, "uuid": "f020ec97-d381-4729-9d04-84bc51fef0aa", "comment": "Malware payload (Mirai)", "value": "59a011f87f5b4c06d42e826e33409159", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922005, "uuid": "4f226e12-c082-423c-b06d-7fe0f9ba5fb3", "comment": "Malware payload (Mirai)", "value": "0c5fc3dd06f634b47a096822eec23cc88643437215d9928f74575ebe1ccdd62b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922005, "uuid": "ba9a1a27-e9ee-409d-aae7-4b09413e6e77", "comment": "Malware payload (Mirai)", "value": "a97339fcb8b805a1ce89b6a5ae5dbd1fcae69ea0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922005, "uuid": "052ea950-3c19-49cf-ac83-ff83d933d9cd", "comment": "Malware payload (Mirai)", "value": "f8958f389eced2c34f11b1639275bfa4d97a527ed3a536278fbeba91c18ef5f3008a1a90995413d40000ea20914e81e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922005, "uuid": "b69417d7-f3fb-4136-a13e-80b24d50f96f", "value": "T197730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922005, "uuid": "b9bbb0c9-d4cd-41fb-a944-c5861bb875ef", "value": "1536:2ln25xPBXk1wnnkL7+KE007IhRMqai90DIyiUNbsvHTGcV5GYIW/:7xpXCMkM/GTaFNbsvHqcVERC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922005, "uuid": "1cb12168-4dbb-4094-8f4d-c494ec686619", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922005, "uuid": "febf4b75-c37a-4bed-a89a-bf464c9915c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922005, "uuid": "3a68594c-bf91-4f34-885c-ed3b3de12cd0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfea9a1-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930592, "uuid": "fdb0fcee-873b-4bff-ad17-68e8d73428de", "comment": "Malware payload (Mirai)", "value": "6fca43018f3cae5eebfb30533dc03764", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930592, "uuid": "2faa9f7c-a279-49c5-b265-b51eb42cc754", "comment": "Malware payload (Mirai)", "value": "0d09a5990d4d59fed3dff5d233c061a0077dfb649b6c908f5d840e60a0803026", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930592, "uuid": "c0fcb3a1-f5eb-4132-9166-4777570cdef0", "comment": "Malware payload (Mirai)", "value": "9d6d98d322ce1681c14435679dd29ea389da642a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930592, "uuid": "f57e2180-74ed-4bbe-a234-67192a1e1b26", "comment": "Malware payload (Mirai)", "value": "a33b8a609118a7e71f618c579aacce878f5ef1f56a148f2b3cc4090161a63fbcf1c519f1f8a5989d788006ac14540b1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930592, "uuid": "a9c316a9-4819-4312-8dc4-0116000ae6c0", "value": "T124E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930592, "uuid": "8ec50b59-9753-4047-830d-63546649a02c", "value": "3072:yJTc2PBSpm67Oabvzj4dlRsh8ZQIldKMXkkTM/9zY:yJTcGWOabvzj4dLsh8/KMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930592, "uuid": "9b51b103-4ad2-4b11-867d-df82a516695d", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930592, "uuid": "d34c82a1-278e-460d-8f94-523e68af3ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930592, "uuid": "08f24801-83fc-402a-8aad-ae68b030ed74", "value": "arm7-20230304-1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1363e5af-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677917020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917020, "uuid": "13475092-c61e-47f0-81bd-6329c571d939", "comment": "Malware payload", "value": "149714891877a52d437f130f36eebc02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917020, "uuid": "0d003d5a-572b-4bc0-b289-01058745876b", "comment": "Malware payload", "value": "0d858e8153cefffbec70b8e9c513078280becb71d35c30936d2d4de94e39252b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917020, "uuid": "21f9601e-e584-4f5f-908a-f82a045f559e", "comment": "Malware payload", "value": "758f5b16aebd9e15cee597653e954ff74f3f9ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917020, "uuid": "19d80e1e-7c2d-457f-81b1-5c9bce575fb8", "comment": "Malware payload", "value": "1e2b884f1ecceb0969f2290c4950f647ff35dcc675bb6a27d9ef347d52cd5e65cef8d5937a2d19f719624f2219e8d7d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917020, "uuid": "e3a4b673-7a71-421d-a541-1cb59fc9c8e1", "value": "T17E0512623AC1C072E52364305AFE83A0F678B9355676548BFBC40B7D6F726A2D726313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917020, "uuid": "7a744085-c3ad-461c-b4c8-e20a1e4d7ac7", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917020, "uuid": "248cdbc0-7467-4e61-ba81-7d07a039b8d1", "value": "12288:DuunhwyAcnpqvZ+ScVKra4XgbYWC3215UKUt+n+JRlnxZ/eFK76:6uRxOQSRTXgbs32vjUtiMnP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917020, "uuid": "e6e79eba-cd98-40e8-91df-164ff51f8ceb", "value": 824561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917020, "uuid": "8e07b93b-7830-410a-a859-9c81e6f415bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917020, "uuid": "8c252a03-4825-49ef-9326-22ad758a8862", "value": "149714891877a52d437f130f36eebc02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d5c063-ba35-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677897612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897612, "uuid": "2604ef89-7f08-46d4-b542-41406381e589", "comment": "Malware payload (RedLineStealer)", "value": "8d1306d274a692268d353cb0e51c6b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897612, "uuid": "7aca77c3-2f89-48da-b59a-03cf08c72804", "comment": "Malware payload (RedLineStealer)", "value": "0e01c635f8109c4188ec6f82facee029b9386dab7ab96fe9b28f70e33596f421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897612, "uuid": "e8fd2e9d-1f42-42cd-916f-54efae8a5d23", "comment": "Malware payload (RedLineStealer)", "value": "814cefc1e433ee3e044497f285184f0dd92f4cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897612, "uuid": "dfb4eb42-731d-47ae-a7bf-29095630363e", "comment": "Malware payload (RedLineStealer)", "value": "6221d5c86139981055d0ef7d693d038bc342788d42bd2d0d3f8fb59d059007de459e5947ac95d96a390e5db9545f2767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897612, "uuid": "5cfb9039-d819-4a20-9250-7f4321a915cc", "value": "T1E725231BF6F8C0F1E074437008F646D30A357EA16A78D2562759AC4D1D72AB8A73277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897612, "uuid": "bed89440-7bc3-4b9c-bfbc-1726387f9fbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897612, "uuid": "8f4f2067-61b4-4b18-84a0-2ec53aaa1218", "value": "24576:1yeA+Vr8Za7arjhpRzFvJMVeBm/vfjD5plg:Qhq8cufRtAjDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677897612, "uuid": "5166909a-3c86-423b-976d-9948586cb6ff", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677897612, "uuid": "83832a2f-c07d-4986-9ca1-b6c6855f79b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897612, "uuid": "b10d7801-f355-434a-b5bc-a54868506f9b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7d4d84-baa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1677946191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946191, "uuid": "08f616ef-2aa8-4557-a3cb-d2f8e7174b31", "comment": "Malware payload (PureCrypter)", "value": "f48dd9599d71127b328feb1c3fc4fe88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946191, "uuid": "b58e0348-cb8e-4242-83df-4f60b5ec9f3d", "comment": "Malware payload (PureCrypter)", "value": "0e930ccce56865939711afd72ef06dabb467164bc2c750b86f78bb15e42f485c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946191, "uuid": "f46f7729-7329-477c-a758-1307133469a6", "comment": "Malware payload (PureCrypter)", "value": "e49dd3df08311d065664d6d875dff14972ed3084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946191, "uuid": "902caa30-9c5d-44cb-880e-e03288632140", "comment": "Malware payload (PureCrypter)", "value": "727421733bb3ebf1f078244894d5aa2724c6ebb7d3c7a223a41ef1a8c4d5107e35ee9d6384ead901adb3685132fbb713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946191, "uuid": "267a986c-32ec-446d-b71d-ae6f7e7b6018", "value": "T1EC661225239C91C9D17A9039CA864AABE7B57C429374C7CB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946191, "uuid": "d16c72df-82e0-4b70-ba60-f3c4018b7582", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946191, "uuid": "6d8dad83-d9de-4fe4-ae92-96af70543c11", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKhbC:tV44xgrwo5tLMKRUGrMTC5H3SK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946191, "uuid": "83754c88-67cc-4e35-b787-acaa91ea9f4f", "value": 6906706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946191, "uuid": "6d6d20a2-85e3-41fa-a479-ba878134eaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946191, "uuid": "422bd31e-3e8b-48bd-9e93-5022fb19cac1", "value": "f48dd9599d71127b328feb1c3fc4fe88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34723b52-ba21-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677888729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888729, "uuid": "d7ca7617-70a2-4c8a-91d2-48da0656c7a3", "comment": "Malware payload (RedLineStealer)", "value": "b75ea422c0aa91ff870e46c9d5994aef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888729, "uuid": "8e656858-8bf9-4bba-bd51-480ded6c2d36", "comment": "Malware payload (RedLineStealer)", "value": "0ea897821dd92f57e784db5a55f7d9f3e7cf2f7901e5a3106021cc0231aab055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888729, "uuid": "c2516653-d193-4520-8794-ad45b73e5fca", "comment": "Malware payload (RedLineStealer)", "value": "03529dd7d9053a4d18f20b594866d9296f9b37db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888729, "uuid": "894cbe05-ce9f-47e0-b4dc-2751d7103669", "comment": "Malware payload (RedLineStealer)", "value": "ffc87a195b9a0acd65c123cb3b0915f58349971f16c0e343a7ab27229121ae10a8644defcec088f4089a4916a60b86b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888729, "uuid": "99c7c8f7-56a0-46ba-8063-46e207637a02", "value": "T13EC4024BE7EC8171E9B4677019FB43D31A32BDA056749387278A9C1E0C726A4B23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888729, "uuid": "2b909321-30b5-4819-811f-da0a6570e112", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888729, "uuid": "c41c37ea-4f74-4ca6-b1cf-23f0988ebc25", "value": "6144:Kky+bnr+mp0yN90QE7DPFCVGc74pjdjX79jcQkNY9h/k/DOpyLLgbPd8FLhXL47u:gMrWy90NDPU7G+Eu/DOp+gbF8JjiNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677888729, "uuid": "4965a397-edda-4d14-92e3-9776400239f8", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677888729, "uuid": "40148a4b-955b-4fa4-97ce-5f781abb50ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888729, "uuid": "0b258dff-5a3b-4534-bbb4-f47bddfef2e3", "value": "b75ea422c0aa91ff870e46c9d5994aef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ec1c47-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677970207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "71b208f4-ed46-40ed-aa30-de8dacc270f1", "comment": "Malware payload (Mirai)", "value": "47632a605e11fd2235f6395daa0a377d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "86e390be-53ee-4d4a-853c-8f1c37db0253", "comment": "Malware payload (Mirai)", "value": "0f4dbd99c927f1feed4799cf99882217746bad9d2aeec7d9ee2ab1bca6250400", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "3fe106e6-f3d3-41c5-a0c1-3671db888bb2", "comment": "Malware payload (Mirai)", "value": "ed571c9e50a8351e0390541c308d2f21cd10990d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "abc9da82-b903-4106-948d-bfe1b628bd3e", "comment": "Malware payload (Mirai)", "value": "0b44d5a3feeb1ce2e37b8067ef0f1c4d41e2ca7d2a15f214b86a80c80881fc0ae776b6afa1000c71b5e4b4afd6ddba3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "547c86bf-9a90-428b-84b9-b4b3e02c4eae", "value": "T1B2C2C0A053046FB6D8B14C31E6F48882B767D73CF6FB72766A2851E8939D21A247C583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "e0c942ce-ec04-4609-a817-266bad0bc3e6", "value": "768:HwCo3qL58j9uXgRJ2DO2QFXylw7Ps3Uoz6+:HxAqwuiJ23QAw7Czb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970207, "uuid": "98945c91-bc79-4091-b95d-7fc0202beb99", "value": 28168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970207, "uuid": "3dbc6cce-90c3-4bd7-84a5-a0f5c6f2a6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "2b9f33d6-6033-4cd5-9bcf-2fda04303819", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e28417-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902130, "uuid": "6cd4f0f9-a1a9-42ed-802f-a6191f606b59", "comment": "Malware payload (Mirai)", "value": "a6d865a565f690f7190df054f656b031", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902130, "uuid": "7fa8b389-9027-4d30-808b-074b7755fcb4", "comment": "Malware payload (Mirai)", "value": "0fcb07bfa9f232e679edefb9e8378da8fd635c807e25b03d1bedfa5fc37da23c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902130, "uuid": "f93fce6a-bfc3-4519-a3be-bfde7079984a", "comment": "Malware payload (Mirai)", "value": "383e6eab8a7949b55c5118d47898187693d35864", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902130, "uuid": "43f88af2-6df8-4be3-af51-005f43e817b5", "comment": "Malware payload (Mirai)", "value": "a8df0011c3562a941ed0a93f30771f66dd1deaf9ee15832089137d7e72400f24a768884499373ade3a1aecaff8e41246", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902130, "uuid": "d18e4089-fc43-4e95-8103-f0a45848ad80", "value": "T1CD534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902130, "uuid": "9658768d-8f9c-4472-8bc5-91ddf4f24b22", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQILiKimfFoktCe3fYRMD:WShU3q7cEDlCK/0Dg9i8Fok06fYRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902130, "uuid": "8c40e2f9-ce25-447b-9448-c6fb1091565a", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902130, "uuid": "a5c05e25-0dd8-40c0-9d34-43a69ddc17e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902130, "uuid": "187ced21-95ac-4b26-9f57-720bfea4efe8", "value": "x86_64-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56642ca2-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948486, "uuid": "d0ebfdda-cd52-4fbf-add2-b4e17ac75fcc", "comment": "Malware payload (Mirai)", "value": "fce2bbb277f368c659031970ae0b4017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948486, "uuid": "e19bcb04-7edc-4a2b-94ab-f634b6945480", "comment": "Malware payload (Mirai)", "value": "0fd16ac97c781988319294743fb4acc9896f530010715ffd1b479911b9c3f2cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948486, "uuid": "643e13ce-872a-4114-84a0-38a4d3241ae5", "comment": "Malware payload (Mirai)", "value": "6df738b84f9c8b91545fbb9fb261b989afef1abe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948486, "uuid": "8eb5e761-eb57-4bf7-b989-c89ea641af6a", "comment": "Malware payload (Mirai)", "value": "4997b81ad4aba734d4b096f90dfc68201371a76b0844e46d94826f554458d75d1b05f71dc05a26a68e56aeacf3218e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948486, "uuid": "c4e1ca85-35ec-4acb-95f4-b60de38b8146", "value": "T17CB2C09EE4843549C88E1C3B299E07218E9DA1D1E5CFDFAEA390CDD427F9946B40E079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948486, "uuid": "51b9f1be-94f8-43f9-97fc-c7cc01ef6a53", "value": "768:cGrQlS07dEv0UXqUhvQE+CXHsWj+o8aqn6WZqUWvv:vQlS07FUXqIYSXHsWSo8aqnBq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948486, "uuid": "dde8f043-7374-4ea2-b1f8-fada92ad9a38", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948486, "uuid": "f18c6c93-6edd-4dd2-b0a5-67a1ce6ae2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948486, "uuid": "1742a346-1cb5-40be-bf27-d4b03c42f3ff", "value": "fce2bbb277f368c659031970ae0b4017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae45ccf9-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930595, "uuid": "c71b5151-c5c6-4fc8-8288-64893680f411", "comment": "Malware payload (Mirai)", "value": "7f93b1541da063f45ff202e9429af249", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930595, "uuid": "e35ca3c0-de50-4365-88c6-bef6fea3e7bb", "comment": "Malware payload (Mirai)", "value": "1062c838065ba5c1f57c7980a2fafd97ba563fe0919d8ee27fa5bbe8ce47ebeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930595, "uuid": "a54dc62d-167d-4e99-83f9-3406ea33d21a", "comment": "Malware payload (Mirai)", "value": "025f7d21ca0f36620326ce3feafff4e9e658f22b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930595, "uuid": "2c950d27-5025-4e2e-b092-8ff88b706514", "comment": "Malware payload (Mirai)", "value": "592e97d03c132e63cb8cb5ffa45d851afb5ca7fc38d979931783a0032343ca0e18337c9cce46fe06742a3098255d83bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930595, "uuid": "9a4aa31a-0657-400e-966c-5af45c886790", "value": "T1F1730856B8814B12C5C5127AFA2E128E332357FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930595, "uuid": "1e474df3-a9c4-4962-9c52-dd0a88685adb", "value": "1536:mln25xPBXk1wnnkL7+KE007k3VkyazN0bIqvikNnsvHTGsV5GYIWk:rxpXCMkM/0ja4NnsvHqsVERx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930595, "uuid": "fbbdc08a-eba8-49dc-baa6-2e0e822f9ded", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930595, "uuid": "959a2aa1-ccf8-446e-8a0d-7c4a1d1e29f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930595, "uuid": "4aea5c81-092e-45a3-b4cf-f87d6d280f9f", "value": "arm6-20230304-1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67140ee-bae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677971437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971437, "uuid": "f4170e0e-df14-4a92-8724-304794e79036", "comment": "Malware payload (Mirai)", "value": "91697aa25e91be7cdc13c4c6d7d6aad1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971437, "uuid": "3dd4fa9c-8ca5-4f8a-85b4-787608dd7f7b", "comment": "Malware payload (Mirai)", "value": "11a9f4d035bc0c889748beca1a276db7f83502f1c48abff35636d8f1456337a8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971437, "uuid": "36ee04b4-9357-47d4-ae59-c391d4aed710", "comment": "Malware payload (Mirai)", "value": "cdd5f694cdb39ac2023b41d494ead0111ec5eba8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971437, "uuid": "01cf69fb-5131-44d8-be1e-f6a4f005edaa", "comment": "Malware payload (Mirai)", "value": "c1b9043835dbf1bb5415dcf275eb8dec20325020557c5336d2b9240e3fc5101d6a3f695dd10975ac0851a7751be5174b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971437, "uuid": "d79d2716-ef75-44dc-8912-2b019f47abaa", "value": "T1F1D2E1B9C07BE171D067687409B93F00F8A3B957B32A6F1F049B27BA40079A647B0F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971437, "uuid": "42bbf7fa-5bfd-4cdc-ab6b-8987888e4e63", "value": "768:sYSoXdJZZ2Pu34bknLhEkVe41tPikL/O8Sx0s0:sYJdJZjof41zOnt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677971437, "uuid": "8ac442bd-5745-47a8-993b-2c272c0b4f55", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677971437, "uuid": "d3adcb9f-32c5-4f05-9a03-e4d65c904251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971437, "uuid": "76010d54-601c-43fd-bcd0-00c485546ad7", "value": "91697aa25e91be7cdc13c4c6d7d6aad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90872424-bad3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677965334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965334, "uuid": "186e4b9a-f087-480a-ad08-732761682d8a", "comment": "Malware payload", "value": "5e0085d44b2cd845cc8a964dab23027a", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qaknote", "colour": "#F47211", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965334, "uuid": "8a33a662-4508-489d-a82d-5f9ff35dc79e", "comment": "Malware payload", "value": "123edd3964eaccd437e0ff8405468f93c5fc27c509e39e402d878feac5772123", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qaknote", "colour": "#F47211", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965334, "uuid": "6299d180-e7be-42e9-aefa-341215dedf4f", "comment": "Malware payload", "value": "f4950b85a4f3057f2ee31645c0bebd5ee3eeb3f3", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qaknote", "colour": "#F47211", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965334, "uuid": "53142661-9fb2-47f2-a615-c0ae18f83473", "comment": "Malware payload", "value": "d28fe6033c70255b1cbaf819c0c967365c952c6c5fe25c37f669cd3ac9813504a4fb06572cb5bde01d1b191bace9062c", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qaknote", "colour": "#F47211", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965334, "uuid": "0befa7aa-d41a-4e88-9212-948292f015f2", "value": "T103A4AFA0FB210277EF8333BF9C5549819928910186231A59FBA6134EB74B5D853BDF3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965334, "uuid": "e8667639-8779-4c2b-bdeb-30f9d507a7da", "value": "12288:tgx0do7W7LIV+a54uLLcsHrMnOXu05HeiT8N94me:Oxp7W7sV+a2uLLcsH4nOXu00s8Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677965334, "uuid": "e488257b-5a9d-46ed-b516-075907d5bc8a", "value": 463075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677965334, "uuid": "395d0af7-669b-4605-92b0-ccfa4967c22a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965334, "uuid": "9daa4ba2-7f34-4cd0-85b6-e7f75589293e", "value": "5E0085D44B2CD845CC8A964DAB23027A.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82218648-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677916777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916777, "uuid": "22c7184b-466e-497d-89f1-9e0bb31b6542", "comment": "Malware payload (AgentTesla)", "value": "1b7e047211843140c16878a73e0012df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916777, "uuid": "21e01c32-ccb8-4504-a891-377be251344b", "comment": "Malware payload (AgentTesla)", "value": "1304e305e0dfcf3cd4fd410db0ba1dfdf122ef778a27f4dd4c64df07e2c8adac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916777, "uuid": "813c6048-cf6b-4c1f-b824-fa34d6204309", "comment": "Malware payload (AgentTesla)", "value": "c66608ed90b6deb6a40a776504b05e560f7f9063", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916777, "uuid": "7b91a5b1-e494-4372-a4e9-95e492f1fc04", "comment": "Malware payload (AgentTesla)", "value": "00f5d832ddd0ddd4af52c9df142c9e037264d9101eab83fc49a0b97e11c61593d982b07c9596688b6412c828197d5fbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916777, "uuid": "c54f20de-4b2e-48c3-9f7b-4e4a93391bba", "value": "T11034E013B68B8575C2189B3AC54749182330D74576E7DE0AF88E2B294C83BFFED54A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916777, "uuid": "88ce5d4d-8739-4500-b2fd-aa8cf579892a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916777, "uuid": "d3f8a111-d62e-4d18-a36e-e7a86476d322", "value": "6144:FZQGNvAe+ilDp1ZKZx62YR+FV7jMtPCxtni4srl:F+Gr/lN1ZKZmR+FSwZPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916777, "uuid": "235e8706-24b4-4d31-bc29-b71869de07d2", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916777, "uuid": "51687cf4-d925-4821-8a2d-f2995e058db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916777, "uuid": "608da630-b8fc-46b2-ac9e-774e3b3a5e6f", "value": "DHL INVOICE_AWB#95149508010678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b9d1f2-ba35-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677897455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897455, "uuid": "f168d8c5-f727-4a58-9bce-30994858f969", "comment": "Malware payload (RedLineStealer)", "value": "7b43f515d26c24e86d38cb7013529be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897455, "uuid": "d5dcdeca-07f6-4ce6-8562-6169c8562c63", "comment": "Malware payload (RedLineStealer)", "value": "13288d9b289795e49477db78e121dd47b26013516fb2e65208d48f1498d414ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897455, "uuid": "31ae6937-f6e1-4d77-b240-e22420c351a2", "comment": "Malware payload (RedLineStealer)", "value": "cacad12ff7f004494b7dc5bc8513e5b6a052ac2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897455, "uuid": "d874f5e5-07ac-4b7b-8306-118e2c160d18", "comment": "Malware payload (RedLineStealer)", "value": "95607fbdb5fab0f0c8cc1be8e5f7a377720c82c94c2fa2adebb0ca70446633cfe7355a1790e1bbcafba9b9d672f5dbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897455, "uuid": "96db547e-9f69-49ea-8ea1-d889d0868e21", "value": "T13425224BFAEC9471E5654B7059FA82D31B31BEA166389763238E9C6908736B07331337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897455, "uuid": "067588ce-a40f-4020-bd15-d3326da257ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897455, "uuid": "dc0f5b12-a999-47fc-81c0-759b00b47305", "value": "24576:5ykVobfqqm9T4az/eNZ/9djwu3ln2vIMjCCY4:sk2qqkTpzI/04n2AM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677897455, "uuid": "a36908ee-06e5-4cbf-9faf-a9598bdf7bb0", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677897455, "uuid": "80f1aba1-592b-4bdb-a9d6-447a7e404193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897455, "uuid": "b5e8d620-f428-4e68-8f39-1d7245605cd6", "value": "13288d9b289795e49477db78e121dd47b26013516fb2e65208d48f1498d414ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ebde32-baaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949641, "uuid": "db6e2d45-86fa-4070-b3bd-b76571e0b9a1", "comment": "Malware payload (Mirai)", "value": "876e414e8b22144ff14a8608afd1d4c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949641, "uuid": "00790ce7-e1be-4e58-a4b1-c807ab3e7216", "comment": "Malware payload (Mirai)", "value": "1447b0d19235186b4a56cbf9e9f7624a0bd520740e2b43e5a98e95f2a61f5e9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949641, "uuid": "7aea8c5b-5cd5-4f94-8e51-2a135bcd1250", "comment": "Malware payload (Mirai)", "value": "1e30a894c4ffefbeaca091ea8747ebc31b3d29a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949641, "uuid": "f3d5f9b5-413d-4a2e-b4d5-110e3433939a", "comment": "Malware payload (Mirai)", "value": "0770c147da4e806e7b1d7826fb1bcfc18414b8a1aa927222cbc5bdf84b9fa9f07da05d6b0db23a7c16e6fd3e0f6515e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949641, "uuid": "967d2ef3-b966-4759-ab60-846c8f2667a5", "value": "T19B63D606BF740FF7E8AFCD3749A91705258C650A21A93B757934D828F64B64F09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949641, "uuid": "cb144623-7e90-4004-9d13-9c9f406ba2c6", "value": "1536:9GCKaOKE6w3qhk7ZH4bfjTt3NEzZAxDIN:8ZaOKE6w6ZNEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949641, "uuid": "b3e2abef-0bae-4996-b26b-1f763da9e0da", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949641, "uuid": "4c697c28-a563-4c99-a095-63cd15e00168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949641, "uuid": "b4c45cd0-1d4b-4dcf-a3ad-a7041c9fa294", "value": "876e414e8b22144ff14a8608afd1d4c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1489e4fe-badd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969421, "uuid": "b9d4db16-4998-44b3-8140-ef411d0ebfa0", "comment": "Malware payload", "value": "6aa97f0fa8cb078066a4192a98e8b81a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969421, "uuid": "88d4891e-a3aa-415a-9d50-52ae6de83a31", "comment": "Malware payload", "value": "15c93ace10b30d5dd311c426bd203ee600bdee351542c601d52787537037648f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969421, "uuid": "d478a067-ebc9-41d0-9bd0-f0a04bcf70ba", "comment": "Malware payload", "value": "399280842f096958320fb3ed653ef0bd8ed807c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969421, "uuid": "ab1e5342-e529-4b9a-8840-ee5441745464", "comment": "Malware payload", "value": "cc3fcc17127db35adbe5e71e890599cc7ebddbb656c01fa2d54214527f55fac39a4fdecae5e80ae1b80d632a7573b51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969421, "uuid": "8c002989-81c5-4d71-9c75-62f218f46598", "value": "T1C1F402105BE6DEA7F5BD5F340EA0B12503E07A628A92DB8B3DAA72ED1F737D14500B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969421, "uuid": "f1180c93-5eea-4da4-86d9-3ddf3dfc6e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969421, "uuid": "b2f1bf37-dd37-4205-8f43-a87f98b8d00a", "value": "24576:PPxo9MHv5Pxo9MH1Pxo9MHf3AYadB8Y9dcE4LfPVo9MH:Hxo9MHvBxo9MHlxo9MHiZ+EoVo9MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969421, "uuid": "ccd91652-3dab-4fd8-a7ea-1f1992957360", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969421, "uuid": "779c55c1-828e-4597-842e-63f0633d3e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969421, "uuid": "9122319f-dfa0-416b-945f-58ae75bf8c92", "value": "Adobe Photoshop Keys + Crack Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f01116c-baa1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677943830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677943830, "uuid": "35ab1824-27a1-46c6-8613-f29bf4c03db5", "comment": "Malware payload (RecordBreaker)", "value": "99605ed7f961e53c2d4c0b2510431a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677943830, "uuid": "5c37b526-1021-4c60-9e48-08d864306bcd", "comment": "Malware payload (RecordBreaker)", "value": "172513e34579c0446c9bf926fb61855f49ba820905e932e71e34c222e5d1b489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677943830, "uuid": "4b83ad07-cd73-4381-852d-7f913185135a", "comment": "Malware payload (RecordBreaker)", "value": "61fc148bcd1afc7e4eb0e8d934bf09aa64d5095b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677943830, "uuid": "fd8487fc-4a4f-46ba-88d4-3684ee512430", "comment": "Malware payload (RecordBreaker)", "value": "9852895cdbd917ce6e24dd8ed04852b0d9841a689ff38a1ccaae1d5ab11cc3a39851e09a834f1c8296409a3a1ed8a888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677943830, "uuid": "9b833d9c-b374-4b13-a0d3-6736f1c2cd78", "value": "T1656512E6F5C0C436C0611BBCCD9E9FD0B16AB7241E14288F75ED1B5D4A36DA10EE928E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677943830, "uuid": "33979ce4-cf25-4a01-81ba-b61ec9330e33", "value": "baa5b88b6bb86e914d34b43be035dc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677943830, "uuid": "ead8a3ce-5b84-4f67-b91a-f51ae6312688", "value": "24576:BWmAFubS4dzvikB3UbqeYIAmQHwVVnCNxXmBDGWa7Wqw7LUjF+8tIUqb:124d3B3MXXAmQHaVwxWBDG57IWF5tIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677943830, "uuid": "6b438d33-6728-4753-b582-ead9b96bacae", "value": 1517100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677943830, "uuid": "36367af8-585c-45d2-85fa-5d29bb95a5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677943830, "uuid": "1a7d9ee7-4fe5-478b-ba72-2543cea261a7", "value": "99605ed7f961e53c2d4c0b2510431a46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c82489-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677963363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963363, "uuid": "fbe91b09-fdbe-44e9-bb4a-f7b6306f9f3d", "comment": "Malware payload (DCRat)", "value": "57b646616e627c9d56594b8b094b12b0", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963363, "uuid": "79c3da97-0914-4f75-a890-2e6cb051c3f5", "comment": "Malware payload (DCRat)", "value": "17c13913cb04686d2dc344e31c1bafe35ddb840be0495aa3b1c17b37fdd59f45", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963363, "uuid": "8a904a2b-0339-49fb-b684-80e39b9bb9e9", "comment": "Malware payload (DCRat)", "value": "2b207f71466be74fac1367ffafd692ce85ccff00", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963363, "uuid": "f403e87b-ce6f-4889-a2da-b59417d479b2", "comment": "Malware payload (DCRat)", "value": "e42e7b26928d06eccec62e390867a3538d7378ba85fd96054f9a2a1bba2eb3cc8b9bf3a624e6af402f5a621bdc4baced", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963363, "uuid": "b5500788-c3ff-49e5-a7ea-0fc769d3b211", "value": "T11835593D39B696D6C238FA7346E3E520B6BD80923303D958DDDA1AC84F511827DCE66C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963363, "uuid": "27ffe229-36d4-4087-b7d0-2e65b218e4b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963363, "uuid": "4bece176-4adf-4979-9e66-58e1609e3434", "value": "24576:wGiTsIBMNjnNNOhAe/S0wU2Z9J965+XA9E3Z+QVwSjB8oqlX5MaKzG2ns1K7:wGHfnuSp+Qu9oqMIVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963363, "uuid": "d3951580-208c-4258-87cb-afdfdb249161", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963363, "uuid": "624302b9-22a4-4ba8-9b18-bd78c5eefda9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963363, "uuid": "98cd4a19-4027-4595-a029-f80606abcc16", "value": "57b646616e627c9d56594b8b094b12b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a1b1b8-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677963007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963007, "uuid": "8bff7cc4-a6e5-4eae-bd32-16a63f5c73ec", "comment": "Malware payload (Mirai)", "value": "8f1f19b6cf8926927401819ac252b134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963007, "uuid": "45cadd70-81ef-47f9-85ce-215caaf462a9", "comment": "Malware payload (Mirai)", "value": "1856bcfc58bb7972494974d5c8c2eb82ceaa50dad8e27c4d5fa95f78b2ef9b82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963007, "uuid": "ee74e9f0-6cb5-4bbb-8fcd-2bea1bfbceb3", "comment": "Malware payload (Mirai)", "value": "c07a6c54317bdeb527bd611da0f5d638e314f77d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963007, "uuid": "c42f5719-aa06-4a70-bc3f-94b2ad37fc98", "comment": "Malware payload (Mirai)", "value": "8d329746d341140300811c375cf1d309f2e01dba414102a488270d5215b650bf9b22b3ecb0532120ee6d35ff769a9051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963007, "uuid": "ce7537de-ff4a-4e99-ab18-67d321859229", "value": "T127432855BCD29A16C6D022BBFB2E518D332623A8D1DF3207DD222F11778A81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963007, "uuid": "405cf1e3-ee88-4a4e-b248-a82eca358364", "value": "1536:NsnQVJbzi3B7RIMYp/E4RdPjt5tw7yylsgdH:NsnQGRIdqS7bSyA3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963007, "uuid": "bdc61a27-af93-46be-9d92-5bf9474a0496", "value": 60584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963007, "uuid": "c678aa48-876e-492c-8069-77ea8f9462f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963007, "uuid": "44feaf10-998c-4ab4-a976-83b388b7319b", "value": "8f1f19b6cf8926927401819ac252b134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab97d37-babe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677956493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956493, "uuid": "1cdb7342-0d0e-4cb4-92b7-587ecacd502f", "comment": "Malware payload (Amadey)", "value": "3f8a86f60a3dd1e502bb1cf442f234f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956493, "uuid": "9a774b60-e800-4b7f-b2df-fe03578f3526", "comment": "Malware payload (Amadey)", "value": "18a8ec885d4c4aa31f88395ba44aee285618bea32d697fd6a337ca9ee471205e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956493, "uuid": "62f072df-56ee-4d1b-ba86-6151b9a2fba3", "comment": "Malware payload (Amadey)", "value": "9625fb567aeadc14f1a09f4bc410fa94c2e02a16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956493, "uuid": "0e8abe64-d5ba-448a-bb07-e51a83f98e90", "comment": "Malware payload (Amadey)", "value": "b959874e0abe29f15e1a916e660666e11680d67963b829331764979c9539aa95258519fa19d32d0c3f6b93971c1d4a10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956493, "uuid": "70adc0e0-2977-41f1-adf9-bdecdc2c0f85", "value": "T187251247F7F84066D8B8677119F903D30F367EA05B684393238F7E5909B2235A226B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956493, "uuid": "3806a0a2-f4f2-4f05-8790-2a7b1c82cad5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956493, "uuid": "c7d25923-0f79-448b-a931-3c93f54e84d9", "value": "24576:fyAr+/kk+SMFBZFDjZ7PJnqrWDCrhFoRwDx:qdsvSMnZFpJnqr1rhCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677956493, "uuid": "9e6d7a96-0e29-4414-9bb3-db6f93ca2b1d", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677956493, "uuid": "d07b4b05-25da-495b-aa57-72fb0d2de510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956493, "uuid": "3e8328f1-b3e4-4702-b6c7-6b0f3f3af791", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88482821-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916357, "uuid": "e4508d69-7553-4a86-8cd0-c342d198d77b", "comment": "Malware payload", "value": "f5003bfd9941fa5182399770910912f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916357, "uuid": "139a07fe-4aef-4a69-a5f9-e484853d58b1", "comment": "Malware payload", "value": "199baa3af02a74f7b058f217ac53bc6457fbfa381daa5a7ee615e0d4c19b142d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916357, "uuid": "7235aa30-7664-4acc-a5a6-ba82c0703e2f", "comment": "Malware payload", "value": "b1bac57b16b4f5d61a477bc6be671dfa5df60d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916357, "uuid": "4624e076-304b-4788-9574-bb9ecf8a03f0", "comment": "Malware payload", "value": "c789adbd3324dbe1da84a26fd5bbaab80f02726b7acb0d2e892ab8678479146d097714a2df9a37cb2ee50d2306ff26f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916357, "uuid": "a2a4427b-5c5b-43e7-8f28-994fe2c354a1", "value": "T19D15231BB6ED5475FCA4177008FB02C30A3ABDA1AB74825A3B0EED4D18735A0B635767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916357, "uuid": "b12ca2c9-c4a3-48c6-b0cf-603bac968427", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916357, "uuid": "432844c4-039c-43bc-adc5-8aa91ed6bd5c", "value": "24576:qy4mTg+osgMeBpPdqz/f+NZ/kOCHbHhV5Oh:x4mTgzsgMgZcbfpHbHhV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916357, "uuid": "d0fd701e-ab12-42d1-8721-34894f5bbbfe", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916357, "uuid": "4a9124b7-354d-4273-a111-290dbcde7238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916357, "uuid": "960b70b5-b929-4216-8d2c-840cd79afa7b", "value": "f5003bfd9941fa5182399770910912f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93bad4d-bad3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677965483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965483, "uuid": "95f5c2ba-a7b8-4d07-b75a-e6fe895c9618", "comment": "Malware payload", "value": "0ab80c49fdea4229c022f43f5357e64b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965483, "uuid": "e932986e-3bc5-43ad-8cc8-c8ee84765df8", "comment": "Malware payload", "value": "1b94f978907d62a93d73b8302ed1d6bdbac731cd968a90f612353021e02eaa1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965483, "uuid": "0c9a08bd-f080-4673-beb2-2f2ef747a573", "comment": "Malware payload", "value": "e47d4307081307e721a79ee2a1acf101036292e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965483, "uuid": "da8a00af-c6ef-41c5-879f-705d60dca65d", "comment": "Malware payload", "value": "4dd9e23d127b5cc0402e2f7557491f876a42fc52b1500e87a9a59d470ea4acb73d712cf89af693dea7de0861587ec4f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965483, "uuid": "89cbf373-b6c0-4367-ba91-34303253c1c4", "value": "T15684D191EB89B8B9C09A287E61EF263F13384B054756D5D763A10D2ADE227C45E3D3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965483, "uuid": "d5009768-3e0c-4534-aee6-c31abdeaf131", "value": "c98b4e11712e0ec59ff15e2dfc124872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965483, "uuid": "682b1e8d-4779-4ccd-b73d-1635cb6e3cd4", "value": "6144:dlZfHJBfoMMiKYYXytfltzOWsDGCitOiXfG5iIZEj0:btHJtoMMiYXytflttsDGCitZf6iIOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677965483, "uuid": "abab941c-3fe9-4978-a5de-46ae438d3de9", "value": 372372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677965483, "uuid": "d003a9bc-b314-4abb-95a4-f7e1c1c0b7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965483, "uuid": "85c66c25-5550-43aa-a400-394647e084de", "value": "dysphemistic.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f02ad43-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677917040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917040, "uuid": "c8bd466c-0acf-4252-a5d9-a07c493ebbe3", "comment": "Malware payload (AgentTesla)", "value": "82b53e2367b8e24f487e62146933c57b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917040, "uuid": "20e88b0b-b641-460b-897e-2d193c1867e1", "comment": "Malware payload (AgentTesla)", "value": "1e9b8c2056adf69d35b941a8514df02180ec6b2ff81ce8011023ba33ec2be203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917040, "uuid": "43f4a1cc-fe4d-4f50-b5b2-4c10fc686489", "comment": "Malware payload (AgentTesla)", "value": "9c996572c6f2a34685de3dda4dd3f5e8c63f7d58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917040, "uuid": "0f2239a4-28b8-464c-990f-a58a80ea16b1", "comment": "Malware payload (AgentTesla)", "value": "d8aa917f37ca825968ec2ef78c442aa8670b6ed0a4d1ce25a7ed7a9a7f97b1041f7ef8daaacb5e11b35a3dd17bd9e6cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917040, "uuid": "d4af7130-f4f4-4c9d-a0a0-d70eaa87c82a", "value": "T1D635762808FD0EF285B1F1FDDFD4E753BE8088E6A6049D9A92834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917040, "uuid": "69e17fca-4fe0-441c-a4b7-524c3525077d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917040, "uuid": "19c16ee8-01bf-4cdd-9c5f-385085e2844b", "value": "12288:G1KMnDvW+ccdJe2xoq+viLttbRDYbv2kSUwUrGgaqfbuh:6W+BdJeDq+KLttbp7gPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917040, "uuid": "fc4d44b1-ee18-4d8b-949e-b420992c486d", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917040, "uuid": "74f26f18-17f5-47eb-8bf0-15bec5be79c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917040, "uuid": "7fabf295-9d28-47fb-bf07-c5b3705794ba", "value": "82b53e2367b8e24f487e62146933c57b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48b3a51-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916834, "uuid": "91619465-9d7c-4500-92c7-f78933e7fd94", "comment": "Malware payload", "value": "b0a0f2b74fd12d81b61013574ac342e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916834, "uuid": "5a3a0613-7648-47e2-89f6-49763790f383", "comment": "Malware payload", "value": "1ef3e638465721e9fa1b21d402284caa86ae7dd5e5e0a435508667dfe0090ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916834, "uuid": "f9ae5647-7f2d-4c3c-bbbf-157f6445719a", "comment": "Malware payload", "value": "6ac3c08ecd00e69ad1b1a2a09c5cafa9a458ba8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916834, "uuid": "c2aed9e6-bbfd-4d18-a006-976b574f261e", "comment": "Malware payload", "value": "c04d695fb43abf49f17f8da0cf92657da98a831f6ae3618a4e4f6224105a969917eb8fa33e9ca5ba6926ba1e23604e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916834, "uuid": "38706f23-8caf-4048-97a1-d7951aa53837", "value": "T1D00523050F0D503FF4BBD23BE25AE84A86ECB1E247A56F8055E53FC262925937984E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916834, "uuid": "bc2d3305-4231-43fc-8443-6e0387b91c5a", "value": "12288:/tGm/VHhbsASpX/2nkqLxKT1ZdV4rHenX9QkMua/1e3DxNjd0lS:Ym/35M+nkqL0DvXikGk3dNj6lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916834, "uuid": "bbb35686-5051-4d85-a71f-9910142d884f", "value": 871620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916834, "uuid": "fa158990-a2f1-42ba-9360-9af63045c8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916834, "uuid": "239ba6ad-ae71-494d-8cab-94a1a3648a5e", "value": "b0a0f2b74fd12d81b61013574ac342e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b3eb0-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922001, "uuid": "94c90e5d-3040-4cbd-a5bc-e928db8f063b", "comment": "Malware payload (Mirai)", "value": "6c2906f4f52c48a10419970cc1800962", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922001, "uuid": "7807e162-960b-4676-854b-aeab5737f4ab", "comment": "Malware payload (Mirai)", "value": "1fc4007da87478b9f6b8b3b9bae94a4a5de3905041df1c634ce53eaeb0a3807f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922001, "uuid": "87d54f7a-2825-430e-bef5-556d547219a3", "comment": "Malware payload (Mirai)", "value": "d34e8586ac093a5f256841fdc326b527e5fbabdb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922001, "uuid": "2c624749-de02-42ab-8453-0d1321cadf2d", "comment": "Malware payload (Mirai)", "value": "7ec94e9bf8859a014505791f111555519a2e2a9f7b074845acadae9dfee4088bac3f4168117a6551311e1fc3741f57ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922001, "uuid": "f695c932-8690-4a75-8394-f9fe93ce923b", "value": "T1A683A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922001, "uuid": "c01019a3-85d2-4c60-a928-6dd51b60dbd2", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTYc7ZDYovZ73x/nL8y8K:Rakdn2Eo3ePu5GTYcRYo99Be037Wq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922001, "uuid": "4d216310-7d6d-4390-af8e-f131a3d34887", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922001, "uuid": "c4496e91-fe85-4fce-a1c3-63632f931ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922001, "uuid": "92e54595-c6b4-4fe0-aa4b-9077fc308509", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee879cb-ba1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1677888049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888049, "uuid": "69f81d22-21d4-4482-9d45-911527c92b73", "comment": "Malware payload (Pony)", "value": "51b10c2bc0b214ecdd7511918ce615d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888049, "uuid": "fbe20d8c-c6af-49bd-8fc4-8c55c2e9f8bf", "comment": "Malware payload (Pony)", "value": "2088c6ea8ac26f01d0fb39667f4772674eb8c6e627f5f61399b1e3d1f21d99ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888049, "uuid": "b61a41ff-b5d0-4ec4-828c-c736c14c49ca", "comment": "Malware payload (Pony)", "value": "5099c0a9a8f6aada2845ecc9350d282235e154e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677888049, "uuid": "32bf5458-f058-4a8a-ae65-16cf7e799fd4", "comment": "Malware payload (Pony)", "value": "1f2a944183be80278faf6b9597f118ebfebc794a648909687602943bb635baf56d6754fd2efc2e7aa60d79a445e64fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888049, "uuid": "36f9a5df-8929-4cb0-bf92-901f114a560a", "value": "T163A3F803F9D1E0F1C1A2267537C12771E3FD9E79787A4D4BEF8C584A69B2686BB12002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888049, "uuid": "bc4b065b-bfee-4bca-8982-fd47dd775115", "value": "6112ac1abcf5fa0d96ec0b4b96090842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888049, "uuid": "4305e2c2-88a7-4480-8ffd-7345d749b0f2", "value": "1536:jIJEmHg1ZqTrbRgkfmgYqT4hd1+F53T8DSyvOQdlkTvXkzbkUql/d8uqh9:uLA1YgkV1EaqOQdlLFql/d8uqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677888049, "uuid": "d22b872f-8cfb-449a-8161-175b8be4d41f", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677888049, "uuid": "cff2f711-3ae1-4829-b7b3-f58b23bbad84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677888049, "uuid": "6ce9891b-a046-45ab-9914-013cce4e526b", "value": "51b10c2bc0b214ecdd7511918ce615d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6922d976-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902132, "uuid": "70148b54-df45-415b-aa69-190fde0080a9", "comment": "Malware payload (Mirai)", "value": "e73ccda9a4b48a8455a8206954406eb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902132, "uuid": "daea55a4-8a41-4edb-a71d-cbefa8c7cc4e", "comment": "Malware payload (Mirai)", "value": "20c60f923cb5c45cece95adbe21d88c89bcd0812db2fefc86ccaed0154bd7c2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902132, "uuid": "8a3e75da-908b-426e-9bff-e71dd7c2e4fd", "comment": "Malware payload (Mirai)", "value": "9dc5b57648310a6e9ccc1f91739594448dfbf5ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902132, "uuid": "9cd6ab94-0d46-4ec8-afc1-4ce2e3e0960b", "comment": "Malware payload (Mirai)", "value": "fadd7054eda7a781c43f3a5a1e23c90be4ad694016be83a6d0f8799588e3298ebb87ced7e5c927992b10de103a1ee547", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902132, "uuid": "1584174a-6d8b-4d92-ab15-9ce094dc3247", "value": "T12B631851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902132, "uuid": "8848b314-8b65-4b82-9d63-4e630d45fb1c", "value": "1536:qNSlxYmii8N1U9uO//kWEjMCikg/QA83NRuxAvjWM:qNnK7ktYCikg//29jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902132, "uuid": "7f2e3f17-c202-46e3-a7f8-bd54f1e094da", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902132, "uuid": "ad420b6a-4579-44da-a3f8-b68fe42d9d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902132, "uuid": "d69f9626-d409-4eed-810a-605c9e53b980", "value": "arm-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6082aa9f-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677908989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908989, "uuid": "82b4a2cb-9e81-4853-9527-0322806cf5b8", "comment": "Malware payload (RecordBreaker)", "value": "88a368aec81422e4f094a010b2719e36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908989, "uuid": "9463adb3-247e-4f90-8684-4b7e6aab83a8", "comment": "Malware payload (RecordBreaker)", "value": "23590a4a514310977b05dc9e957ca72d42efad4c960e8c0093ab733104ebfb95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908989, "uuid": "6f50c6af-c7ec-487d-ba4c-1cd42f079975", "comment": "Malware payload (RecordBreaker)", "value": "16c8068656cf550a7545f33c10c73d051a071aa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908989, "uuid": "05a1f46e-e011-4254-936c-a9caef5ff04a", "comment": "Malware payload (RecordBreaker)", "value": "8fed44e5ba51752ec18d0448ceade28829b5ccf22062ba80e3a0dbc1844d131f0d1b55825175bbfaa9c0e95f715f9688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908989, "uuid": "7210a075-8697-4813-83be-09b4bb27f5e9", "value": "T1ABE63371A9A300C5E8D388FE5B2BBDA571B50F6BCE809839B49775C73C37496B132642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908989, "uuid": "c0f98a75-72a1-4391-9f07-5bac8f416592", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908989, "uuid": "6b1b1a0d-44de-4226-83d5-e5081968478f", "value": "393216:hnzxNweUSxWYs+5DZjHk/wbCDHHIBWyGj8L:NAeUSoYfZQh7HIkyGj8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908989, "uuid": "038edd2a-d1f7-4b23-82bf-1b74641636b0", "value": 14735872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908989, "uuid": "72607b2a-3160-47e5-90c0-0b10bb3bae39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908989, "uuid": "76bba61d-4b27-400a-bc70-41af7e0866e3", "value": "88a368aec81422e4f094a010b2719e36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607ffe04-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916291, "uuid": "1ee76839-0856-4088-bca2-bc1ee9a45b20", "comment": "Malware payload", "value": "4220bd7a4388076702fd9d2ad5b3d57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916291, "uuid": "4776024c-9871-43d7-bb34-e71e5cadd7e2", "comment": "Malware payload", "value": "236563e698893dcff9630ab9db89cfc92919b2edae1fd4f56bcec9ec657139c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916291, "uuid": "bbb3b077-2900-418b-ab6f-222cc536cbc8", "comment": "Malware payload", "value": "427507dc7c8af1803cd1597d0a9acd35a57abef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916291, "uuid": "078cce36-683c-4c6a-b3f6-912c32392c03", "comment": "Malware payload", "value": "a445b89e16f3c8f3ac6fed328809b07fb2f67693a224320323c1152a2c1e795354c2a993e4b439aa900e769ad78e56a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916291, "uuid": "0db9d6ce-dd98-42a4-b24e-3dd45f2d7ce2", "value": "T1F0F60217AD68CC68C5A384331092C397D21AE14DAE09DB9F13B11D45FEE09AB5F12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916291, "uuid": "4eacbfa1-5bbc-406a-afdc-61c1bab1c42e", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916291, "uuid": "f47029e5-ad92-4880-b06f-1d2773019ff6", "value": "393216:lhDNFabhV8d9Td1Ukw3k2woJuQFkyRmazVNEJVZOUcryo8mRHVNt:3DNFwVejrw3kZoFVR8qyo8mBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916291, "uuid": "d83e2da4-5e2e-4138-aa85-dddd4b4c0a8d", "value": 16228195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916291, "uuid": "1e24b0b9-bf91-4a65-a6e6-f130d156f8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916291, "uuid": "765d8bbf-e700-4048-963d-f04ad847be06", "value": "4220bd7a4388076702fd9d2ad5b3d57a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558e556-ba3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677900622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677900622, "uuid": "5af7d1fc-d30b-4c8e-a8b0-8c35fa2b6213", "comment": "Malware payload (RedLineStealer)", "value": "563f1138b27e455471bdfff59b19c3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677900622, "uuid": "421c7faa-e989-4451-84d0-3a0251a897c0", "comment": "Malware payload (RedLineStealer)", "value": "23c07eb780fc204fc9a5affdb4247fe72d1fdf10e081bf8095a5e2fd597422c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677900622, "uuid": "12164e65-8fa0-4a85-bd5e-b47193b04517", "comment": "Malware payload (RedLineStealer)", "value": "9a9c3f0c56d20edabf0371e44d22aad8961ae9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677900622, "uuid": "49a48d8a-54e2-49d0-a40c-cdfe5d15e50e", "comment": "Malware payload (RedLineStealer)", "value": "6969181cb889f0987a3ad86dc9a645b42557b5c3572b8ad73bd5d6162daf0147710b6751530d46946b28468f8178513e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677900622, "uuid": "46611003-d551-48f4-b62c-2e2630424779", "value": "T1765623B3A6691184D0F5D83D8637FE90B1F3066D9F80AC78B9EAADC029168F5DE13543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677900622, "uuid": "60e6da7f-e76f-4168-95f9-832e6b7ab031", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677900622, "uuid": "b4055753-e029-4c9c-aff4-540829d2967f", "value": "98304:Un18pSjbDJq5yvqJEM0+2W6rT1JieaitQrJZKIuVZCicyutQL5CvSvNTgYT3:gS0vJ2yRZWWhVaitwZKVrutQsvSvDT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677900622, "uuid": "0e7284c8-00c5-4bd2-b633-c9dfdac20462", "value": 6373888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677900622, "uuid": "b6205cef-bd49-46b3-9893-8d35229471a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677900622, "uuid": "c3130bf4-3293-4ec6-924c-b4220a5cbc21", "value": "563f1138b27e455471bdfff59b19c3f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e0bc75-bae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677971463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971463, "uuid": "e93fbb00-4df6-4aa2-96eb-711830f8c62c", "comment": "Malware payload (Mirai)", "value": "67db9fd02ce7c58a7bd01ce6009f5475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971463, "uuid": "4019b866-50b9-4aed-b890-709a82222583", "comment": "Malware payload (Mirai)", "value": "29c622edef3f16e2dd42bd5aa687a3603e03ac720d6acf20435b0cd03b9753a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971463, "uuid": "16a6b0e1-3653-4dca-abb4-da94d065986f", "comment": "Malware payload (Mirai)", "value": "311d9dc50b4c7e025959b24076076bba585cbc75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971463, "uuid": "87a4dfb6-fdaa-4433-8f63-0667f8d25c7a", "comment": "Malware payload (Mirai)", "value": "8f3aaa40d45657efd8cafcaa9586b3952f0ecda8465bd9c54fa7fd025e596c0fb45124f2a7e9ab0ec44d694256fdd073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971463, "uuid": "46275fcc-0a52-4ed0-b561-2451199ed524", "value": "T1DCC2E0F9E1697FD7E9AF7FA15CF19FC12BE00A52D383DA801641AF32650193A6906F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971463, "uuid": "f85403ba-b19e-4f8b-8de8-3bb8482e6fed", "value": "768:jiQLDqbw2DR5CgwVQGA/MPFxjim4uVcqgw09s:jybwyXClVQGlrim4u+qgw09s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677971463, "uuid": "c0ae647e-ac66-4bb3-8468-34848d18fa34", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677971463, "uuid": "ba1e9847-c2a5-4b42-802a-dada26ae9c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971463, "uuid": "baa616dc-8368-4b63-abea-bf099e3d85d6", "value": "67db9fd02ce7c58a7bd01ce6009f5475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ff000e-bab5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677952245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952245, "uuid": "9f8a1226-bf11-4370-ad61-4027ace53608", "comment": "Malware payload", "value": "3bf2205d06b75bb9a07daf2d9e2bd692", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952245, "uuid": "b5c0e511-005d-4ff0-82af-f030a8124a7b", "comment": "Malware payload", "value": "2bb9b5faf67798435877307f671b52b5c493066717eaecb6f14c64593de3615e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952245, "uuid": "e05c2b52-5236-4376-96af-252ec3c8e9cd", "comment": "Malware payload", "value": "66b5060e9d0eca93d8af06cc64a5119d0172badf", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952245, "uuid": "2b6aa06e-0df1-4b1e-8045-0d341e67e5cb", "comment": "Malware payload", "value": "bbd4bad90e89c1697d0ef07ad5aafe491019ebc43ad0ffa9517bb76568bf4f3beb63a1f017943dfed3cb260c0bbf641e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952245, "uuid": "54739fef-c591-4998-88f4-7a96ae09264d", "value": "T1B6F567F9D1263EC2C5AEE8352EDD73002BD99348BD36D372535046C32FA9436C9562AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952245, "uuid": "c27bf744-170a-48f1-a486-46db4f7f2fd2", "value": "49152:mM4R+2RtFZ5QrsyNCasWmu70DUkQ/jkazQUpjQDTL1UuyacQUMi41GYW/8/56:R2l2NCasWmuLkvb3Dn1MB3Mi4Yo/56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677952245, "uuid": "1955481e-788d-4313-9bc7-5cf13189ade4", "value": 3352150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677952245, "uuid": "93329bf4-e7d1-420a-92c5-14b664687b3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952245, "uuid": "a301d7e7-84b7-421a-9e42-a67fd08218fc", "value": "ID-.2306295362.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5094c580-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908963, "uuid": "9e708906-b156-4785-9c15-9d3d544d58b1", "comment": "Malware payload (Mirai)", "value": "c1cc75ba91b6ed419e6d02eab45cbb4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908963, "uuid": "f555f803-0612-4d25-a121-82d49819e779", "comment": "Malware payload (Mirai)", "value": "2c3479399ac634bbd91388626c2f00ea084e25e692cdc4732dee98ee9aa6174a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908963, "uuid": "181efba1-33b5-467b-9d0a-7687b830b212", "comment": "Malware payload (Mirai)", "value": "5b8456510d3723c0fa3a0d55e7e2111225db724e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908963, "uuid": "7b292f62-8a0e-4bcb-bc72-9808627c7ab0", "comment": "Malware payload (Mirai)", "value": "f4dea3ce748c19f18d97ffd191ae579f253233640e1818d56d2dc1f0a53a5ee678968250649c0a72d4e74b1987da78ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908963, "uuid": "629d67a0-1cf9-40fe-898e-bce0d502ee8a", "value": "T1EB731945BD829E17C6C543BBFB1E028D372163C8D2DE7223DD166F2176CA91B0DAB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908963, "uuid": "50733dca-3e6b-4023-9548-848880eb91b7", "value": "1536:5fnlkydUkb08EnopiPpESbYHVaYWFoBV9XIwijXWcA9wbZnN:Vl3d/0DnopiR00jqBV9OTW5wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908963, "uuid": "eee587d9-85b3-4d6c-80a0-bdbef1dd2246", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908963, "uuid": "c6adce34-92d5-4e36-aa4e-66073beea4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908963, "uuid": "0c6a8367-4c1c-4ca3-a2c6-4b61434f2704", "value": "c1cc75ba91b6ed419e6d02eab45cbb4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7432b9-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677917089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917089, "uuid": "eae540e3-78b3-43d6-ad3c-4f79dbb74271", "comment": "Malware payload (Loki)", "value": "05cfeaeac5246047121b89bec1d73a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917089, "uuid": "293813a8-e032-4883-846b-5ff8e25a2e6e", "comment": "Malware payload (Loki)", "value": "2ce452da51ffdeed905e03d198db2d6931d31bf7ba64d23e59abc6937004aaed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917089, "uuid": "38d208cd-64a4-4773-8bb3-9c2e383f6082", "comment": "Malware payload (Loki)", "value": "360765808ee3382a1b8560f4c6ccd8977ba8b6fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917089, "uuid": "8484bf2b-0d4c-4be8-9de1-8c92a76931f8", "comment": "Malware payload (Loki)", "value": "e31317c00617321798c85c13aff7b9667c52c46d9128d03001cc10adf0bf88f1fdee1524ad5507c6dfc3a14edd02f6eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917089, "uuid": "d6f329ec-7a1f-4a1b-be15-2adaba3f320c", "value": "T1A335872809FC0AF24571F1ED9FE4E753BD8488E6BB049D99C2838B89555385720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917089, "uuid": "65b55195-844f-4a33-8968-4730292fb43b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917089, "uuid": "d16d3735-2dfb-411b-bbd1-9c3d1b6d8498", "value": "12288:O0MOEAlI3MzSSV93CbPU09kL761HdCG361YRZmQO5X1IemxkuXF1IXBUSKsH:OLYdSSmBkPqd6WRbCIemxkuXFaUSK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917089, "uuid": "13527729-d67f-4149-b260-e9365b753c9b", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917089, "uuid": "80ec2321-ceae-4508-8732-6b6a7d05c371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917089, "uuid": "ed9e50e9-e827-4a84-b058-311b815c1400", "value": "05cfeaeac5246047121b89bec1d73a91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfe99a2-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1677920954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920954, "uuid": "0abf8fff-c230-43cd-bd21-9a65451991c7", "comment": "Malware payload (BumbleBee)", "value": "deea9419fa5187f9f454609d4d173c19", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920954, "uuid": "de47295c-6740-4f05-9d07-844044a81e28", "comment": "Malware payload (BumbleBee)", "value": "2d5c9b33ed298f5fb67ce869c74b2f2ec9179a924780da65fcbc1a0e0463c5d0", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920954, "uuid": "8dc8726e-1c07-4318-9674-dc78d2874f2e", "comment": "Malware payload (BumbleBee)", "value": "81557fb9c53bae28c27ef6120c94c30012b408fa", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920954, "uuid": "0139d182-604d-44b4-9395-b7d099d2f173", "comment": "Malware payload (BumbleBee)", "value": "2b4b9c8c3785162f6b6a906c902e83b5a58eb7c05aad740d49fcddee58690137158a45e13dc874d0f5ee63519bffd0b1", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920954, "uuid": "f41d46fb-6cff-4f1c-a376-04b8211aeaba", "value": "T1C0656B19ABA880B5D077C138C5A3898BF7F274544F31ABDB1699561D2F33BE0563E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920954, "uuid": "7ec1f8e7-d1a1-4bef-9589-dd74cae8aa87", "value": "83f847006bcd9e79aedb74fc499583c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920954, "uuid": "700b9d58-e058-497c-8627-996869e6caf1", "value": "24576:GJAx41SXU4LG5Vlcz8PBhNbJgwm9CEl9DAvOBddLfl93pb3:g0bG5Vyz8B9gwm95AAdhfD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920954, "uuid": "e939e57b-deb1-4549-a038-33aa7ae7c7e1", "value": 1504256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920954, "uuid": "c28140c0-a200-4aa2-b289-189de4989053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920954, "uuid": "7cbb357b-3db9-472b-ae69-261102aa48c1", "value": "LoaderDLL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcad1b32-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677923425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923425, "uuid": "e73cd400-7f4b-4929-8502-ff5dded63e36", "comment": "Malware payload (NanoCore)", "value": "8cb647b9ff3830b331db3420b21a7455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923425, "uuid": "9999dcb7-86a6-47e6-9171-9658b6fa5d96", "comment": "Malware payload (NanoCore)", "value": "2f4950b7e5c9e42fed459ca4459dba6d9ed6f92c22734871cd9b6cfce3092d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923425, "uuid": "3d8bae7c-18ad-4c23-892c-8ffb895cdb20", "comment": "Malware payload (NanoCore)", "value": "1a50f20ef34e24421370c23b44d3ad1e5ba564a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923425, "uuid": "1e1a0cf9-f588-4a19-a3d2-a647b3bfe5d5", "comment": "Malware payload (NanoCore)", "value": "0d138263be7bcd5e83e7259264c4cce9c23ea877c06afa7edb77e2e1f808867423d06b23de229472023e9183e2fff3bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923425, "uuid": "706e8571-b3ba-45a1-8110-6660836856c8", "value": "T10114C02A77A94A2FE2DE8679711212139379C2E398D3F3EE18D415B78F667E406070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923425, "uuid": "0255cf13-00e7-456d-952d-4ca1967f69d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923425, "uuid": "242bf030-6646-4f46-a63d-8fd00dbe051b", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIEN6d6+Il1c3rxbivlpfW:QLV6Bta6dtJmakIM5DXT6rxma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923425, "uuid": "17fe0067-c637-492f-9ccf-9ebc73a33bbf", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923425, "uuid": "28aae251-04ac-42dc-a46d-ac3b770e29fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923425, "uuid": "8fde6c47-bdf5-4f53-aa41-49e8b4b570f3", "value": "8cb647b9ff3830b331db3420b21a7455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3088b3-ba37-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677898136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898136, "uuid": "4f9fdc61-d9ab-4324-b632-62668c12d4ed", "comment": "Malware payload (Smoke Loader)", "value": "3baff49880d4a265002447861a7670a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898136, "uuid": "484e8ae3-39eb-4cbe-a6e3-784c557b18c3", "comment": "Malware payload (Smoke Loader)", "value": "2f7759c1049b9942d5b12bc6445be9fab02fb8abc7ef609c1d017782dda302e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898136, "uuid": "e6a2bda8-236c-4da6-ad1b-f5c691c0b28a", "comment": "Malware payload (Smoke Loader)", "value": "6b0d680b7adf84e17b74ba4f54e655cae0f2370e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898136, "uuid": "1bacfe43-2dbe-44e7-bce5-92dd3745a6cd", "comment": "Malware payload (Smoke Loader)", "value": "55ea513da4b96dff53a11ad2b8f1a801213c8856a025fbd0cccc7fbbf241473e2f2ce3a333cba4aa52cdda66d3ff99f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898136, "uuid": "e7ee629e-7d29-4fea-8e5f-6165178fa51b", "value": "T1DE04CF30B3E09536D1721930DA35C6B01A3ABCA3AD38999B33483B5F5D711C49ABE727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898136, "uuid": "ffbe5bde-8411-4d9f-927a-403ce303fcdd", "value": "bb33faca3c22fdf70d184f78a5e234f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898136, "uuid": "2644bc55-ab65-4386-9f00-ca00cf06f778", "value": "3072:XFunGFxI34CJFLQBTxhXxVXJG5td3gud1uu7GvDWYcKsjAXPSQ:snEx24CJ2xhXPs5MSuu7gfPsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677898136, "uuid": "4b19fed9-713d-49ff-ad4b-f780dfb9962e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677898136, "uuid": "145fcbe0-154c-464f-9593-8b3afd30be4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898136, "uuid": "52f23f93-e788-4b50-be6e-93049f3f67f7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1556a8d3-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969852, "uuid": "4dcc745e-7861-4f6c-975d-63f621d053ec", "comment": "Malware payload", "value": "f839a2d47a37955e7e5329c954138e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969852, "uuid": "d3b9f264-0280-4bb3-aaf9-ae647b85381c", "comment": "Malware payload", "value": "315db2890a297febb6ee7665e9e40af3f84aaab150a4868815e5f8850dce190c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969852, "uuid": "21989779-b769-4fe5-9f23-22768989e493", "comment": "Malware payload", "value": "43a06d049f07c730691b219fb2b5ccdf202e2309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969852, "uuid": "5818dd40-7380-44a6-9b62-59ef92c05ead", "comment": "Malware payload", "value": "067cf983e1aa33fa6310f1c289d1a33f806371bc59f6baf7e781fd8765933ec9950426272c36357db5e61d73a591f10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969852, "uuid": "af946f9a-7e8f-48cc-b5ab-c58f3eca103c", "value": "T153045B03F3C704B6F91D0638CC62D158AD237DB929E5142B3DFDDA4E09BD2C2987AA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969852, "uuid": "44e91926-8439-4868-85d5-50f3ccdb5a57", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969852, "uuid": "29d8978f-cfc9-4588-9c6a-3992a1f5b380", "value": "3072:C4eQc5eEIr/XjhCiYFZBPqjOAQxpFQKMS888888888888W88888888888Vk:C4erebjh2ZojO5pqKT888888888888Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969852, "uuid": "22b6a05e-b71b-4bae-aa34-5e6e08e65b08", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969852, "uuid": "c98eaf05-da0e-4ba6-ae53-39affe10919d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969852, "uuid": "27019927-3b34-4402-b197-e1effcaafe02", "value": "Portable Adobe Photoshop CS6 ME_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06556eb7-bacf-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677963384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963384, "uuid": "c29a7e6a-2607-43f9-9e92-e0b48423a791", "comment": "Malware payload (LummaStealer)", "value": "3beca7c27060ec4d5b08447c9485b6e5", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963384, "uuid": "f13b2e33-28e6-4494-a3cd-bfa5b2daf88b", "comment": "Malware payload (LummaStealer)", "value": "35da3c297e61921f3937ac550fcbcbb6e8b8332933112b5b5a5c994c5ae1127d", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963384, "uuid": "43126959-10eb-44c6-b314-f61de910e102", "comment": "Malware payload (LummaStealer)", "value": "bd5f951c3e4439a07fe9ae592521515662a3f897", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963384, "uuid": "1e798780-7ce4-4f69-a88b-d3c0030bfede", "comment": "Malware payload (LummaStealer)", "value": "fc87ed09c99cf21ab2e4c5c4df9c389dac35f78063098f59d9423e6f6c8bc4583d24f81e684f77bd56bfd83ec86bb30f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963384, "uuid": "0c484a76-3261-419c-a3cc-3de45432db7b", "value": "T16166C58A71D46ECEC522A533D6714F24DAE0A766030BD323D52B12E75F4EB7AAF440E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963384, "uuid": "de534069-4d76-4d8b-b8b7-fb17e7d0bfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963384, "uuid": "5cd21b2c-f077-4e68-8560-1eafcff4116d", "value": "98304:WWpMCfGPcv+y18rNBI4FKn9XBD3qt2Rnrtx:WkHAtnQ953qt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963384, "uuid": "bcf552fa-38d5-4379-92d2-71b8274a5a50", "value": 6882816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963384, "uuid": "8f84e9fe-8a9d-4f23-8d4c-f755986db1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963384, "uuid": "24852d20-78ff-490e-943d-7fc876c287f1", "value": "3beca7c27060ec4d5b08447c9485b6e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02c8744-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677916908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916908, "uuid": "eb3c5cf3-770a-4861-b99b-f1f48969ca52", "comment": "Malware payload (AgentTesla)", "value": "48de07b5e61dfbc305db7cb20cf04c58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916908, "uuid": "0aacd55e-332c-4f57-b454-fd32801a1980", "comment": "Malware payload (AgentTesla)", "value": "36075d007622f34891717891ecee08fe809a9521a21bd26cffdcf2f6c88ae707", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916908, "uuid": "d9fc294e-fdb2-4ce8-a3cf-96f47388dfb6", "comment": "Malware payload (AgentTesla)", "value": "f595a24bb674ea1f22db73059c6bccf34f54dd14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916908, "uuid": "b4a05d18-d5d4-4ba5-befe-9acdda9354fc", "comment": "Malware payload (AgentTesla)", "value": "e2757ef50ee9ed187b4f790703293ce07ab35d91a6963ddd13916f4a04f03a85403ffd78d095e781df9b99e3b5250dea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916908, "uuid": "7cb69503-9d59-467f-be5b-3bda81b97a63", "value": "T1D145A82808FC0AF245B1F1FD9FE4E753BD8488E6AB049D99C2834B89555395720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916908, "uuid": "4b634ad3-0034-4d54-ba95-0e820bfe9684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916908, "uuid": "0b8a1400-d6b8-447e-938d-4b83128569a0", "value": "24576:/HY9EkaEl10ZLzaqnILrShVaeqI3OgMru3USS:A9Ea0ZNnorShIeqI3GqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916908, "uuid": "9b6858f9-a9c0-48d6-9dac-c54a180f74f1", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916908, "uuid": "b3687dca-05fd-4f85-997c-1de576bb12ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916908, "uuid": "1040f9c7-524c-4e00-bef3-7a478dda1161", "value": "48de07b5e61dfbc305db7cb20cf04c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2478c0-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677917013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917013, "uuid": "1affb7b8-8254-410d-8308-0f2f48d6e487", "comment": "Malware payload (Vidar)", "value": "5e1162f753296e6db928f960eb2611aa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917013, "uuid": "a17d54f6-60d0-46da-863d-c6bb7a1d9bdf", "comment": "Malware payload (Vidar)", "value": "36b03249d7ae407da7b955d538e660eae8d3562a091393bb81c5b457ebfe83ae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917013, "uuid": "d6799aae-d81e-4e04-a5b8-02e8625d5a97", "comment": "Malware payload (Vidar)", "value": "0a59ae4e5984474ede5d1f1d24c2c87cf209a419", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917013, "uuid": "0d8af4e3-cb9b-47e3-b1c2-6e3006bae77a", "comment": "Malware payload (Vidar)", "value": "9191e574b4ec3dc70afe6574dd730f0b8d93fe7352e1ba9bf758635b67a52a8425f5b8439a8bc43e7f32a68efe1fcb4a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917013, "uuid": "bd9c641e-d492-4927-91b8-60f0b45869d5", "value": "T10F5655D27B84C127C95719354E6793AA6B1DFCD1EA31B0877760F71E5A38AE3AC28301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917013, "uuid": "c8a74ba4-a8e0-4562-ab26-f6ead8817de9", "value": "98304:opYYWkCZCio1gikuxM54j2BhLkltTvxU5tEftkzcy/CEeGfTu3eRY8wn0Kzm:qWhQpbknIXnpmtESzMCuOyx0Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917013, "uuid": "fc71fe36-e769-419c-8f51-b628d34ad708", "value": 6262784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917013, "uuid": "3d7b5a20-c2e3-4910-964f-7e2596e25c68", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917013, "uuid": "cfdfdcd8-979b-41e4-ba5d-e900f8b872e9", "value": "5e1162f753296e6db928f960eb2611aa.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04e9ec4-bada-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1677968421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968421, "uuid": "ef6ae8e1-6421-4cfd-a6bb-3fbec8a33ae7", "comment": "Malware payload (DanaBot)", "value": "0532c57582e893b26a112e48ef15c3ec", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968421, "uuid": "8531070b-69ee-4102-9c6e-22eb1d6db186", "comment": "Malware payload (DanaBot)", "value": "3720f6761683944e9ff72e547aca0d961ae4954b5f9a4bed711231af244b3e17", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968421, "uuid": "84a7d9a4-92b3-4d12-9809-37462c0a0e2d", "comment": "Malware payload (DanaBot)", "value": "8649af1c6725215edddcace5a7f63f26197a77d3", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968421, "uuid": "6cefcc66-7c7f-4704-9f87-c74a891f4319", "comment": "Malware payload (DanaBot)", "value": "02cd863034feee57006c139c6a561bf5900c9c56d397a1cc986bbf8a8a170b6ed40bae76260706ad9b02b8644764cf26", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968421, "uuid": "5d40bc4d-9579-44b8-8aa5-d76c09eede06", "value": "T19156F123F244663EC45E163D5E37AA54983F6761B61AAC1F4BF0484CCF39E80253B66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968421, "uuid": "391b1b51-4d73-4643-bc43-39c256270532", "value": "add6ff6fffd605bfe0635c3afef2d07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968421, "uuid": "9cbcef19-86bd-4d87-b61f-68175f6c3ef2", "value": "98304:XIqBK9rFDqAznNcGb9O4kkwB9yR85OsN+fbynAiomtSJWp:PBeJVNg4Zwvg85mfWnR/EWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677968421, "uuid": "c0925f88-0471-4252-b7da-8abc9405732c", "value": 5956608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677968421, "uuid": "c9aed0c9-ea9c-40f0-938f-805538d34920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968421, "uuid": "28ba6cc1-8470-46e4-87d6-26fe7b6c75b0", "value": "3720F6761683944E9FF72E547ACA0D961AE4954B5F9A4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34326f8-ba51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677909638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909638, "uuid": "cab89840-a507-41cc-a81c-fbd0c3d082d9", "comment": "Malware payload (Mirai)", "value": "bdcd273e89e0856aa4115794b288b153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909638, "uuid": "7ac2c88a-dc33-4d1e-9670-c7de8655f875", "comment": "Malware payload (Mirai)", "value": "3991f0611f425bb43b4fff9f80ec762c52ee79ab61c27ebb24d00c8e3c29629b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909638, "uuid": "4f36a564-a9ef-4c05-95cc-90ffcae23a34", "comment": "Malware payload (Mirai)", "value": "cf85965c41a55c75ead7410c94d7af0af3c53e22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909638, "uuid": "bc8d8f5a-6998-4228-a61c-cdbcaff98538", "comment": "Malware payload (Mirai)", "value": "81211e2e82fc7decfb2219eb937e338ac48e2aae9036dc82044c277a8708d37136cd3151bfece0310093a70376aa21f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909638, "uuid": "57a26cb0-6f90-4171-85e4-076fbd6d66e2", "value": "T1B6734BC2BA00DCBDF80BD73780170906F230B2955F621A376A52BD77ED352D9A957E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909638, "uuid": "ac0a8e51-00aa-4b8a-8c45-244457d58b97", "value": "1536:AfiGgIroJYAmiaoIenUJnlm8nRsfGNZ8KybF8T95Lx0zvDzFRrJd3eTBnHf:ArroK6aoIenUC8nRsfGNu6959aPJd3eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677909638, "uuid": "636a2262-1165-4f48-9b66-ef180e2e2d88", "value": 76056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677909638, "uuid": "903a0d67-9ac1-4b4b-adbe-8b302f3cf6a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909638, "uuid": "aecd48ec-00fd-4acf-b1b8-84dc232f5ae5", "value": "bdcd273e89e0856aa4115794b288b153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8b0b99-ba94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677938406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938406, "uuid": "20f0fe0d-957f-4589-86f0-c6c6e7c00354", "comment": "Malware payload (Mirai)", "value": "a97cba648f47f81741dc2b95e93fd013", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938406, "uuid": "148369b6-add2-485b-b3dc-35bb97a5ccf9", "comment": "Malware payload (Mirai)", "value": "39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938406, "uuid": "7b5cd934-0d3e-4907-a75a-ea25f169888c", "comment": "Malware payload (Mirai)", "value": "4aa8d144f35d4866de88ea1e05a285bba69ef1be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938406, "uuid": "05570af5-4488-4bb3-bf13-805c93443651", "comment": "Malware payload (Mirai)", "value": "5d43387ef9fe1db26932531734b937631d398eaf79ca690d16090b0b04f407d4b1fe97a0b8b7ae20931ec64675232459", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938406, "uuid": "4efe6327-64d9-417b-9bc2-33bdb8c24dfa", "value": "T18DA2D1242BDE4DF1C22206728137C39173535BBDE1CB7528532849A8E3EE58678F94DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938406, "uuid": "6ab845d7-aa35-443a-93b9-2e2a6d246590", "value": "384:LELcyo6qLQjF+yr/iwMbauKb/7LMojG3IrQD6TTDzQJkv4JjxhymdGUop5hG:YLcyrbsciwMbyb/d8QTncA4Ds3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677938406, "uuid": "f55a737b-7234-4b3e-977c-01b14ab7fb07", "value": 23340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677938406, "uuid": "e20d3958-8598-4d6f-ada6-2dea2cde6a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938406, "uuid": "f4a2f7b4-9295-422d-8909-ef61f8f84e23", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2721d0b8-ba60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677915765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915765, "uuid": "5751a8da-e464-4292-acd3-68086c66c713", "comment": "Malware payload", "value": "4a6ff193d5a589ec190e25b69efe3e4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915765, "uuid": "2cfa43ca-785e-4f81-bcc7-f436d69a23ac", "comment": "Malware payload", "value": "3c91f584b49170c80e0b9825df8436ae57500cfd6407b20686eae3f8e70c4506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915765, "uuid": "98a88240-4a1f-44c6-b38b-474b3feac864", "comment": "Malware payload", "value": "1d3a809a6d12b4df4d3a9cec45f0ce87590b3c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915765, "uuid": "078a873f-63b0-4d69-b264-77630df98e98", "comment": "Malware payload", "value": "74a784c1da38aa434f5ef5ca0338e181aacbc6686b3aacdc4cee3cd14d9e1b4b30d7e18e95944f6020e79b7bee898db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915765, "uuid": "d7a8acb8-ee39-49b1-9697-9738c950ea1b", "value": "T146A52333622515C9E1E2C87ECA3BFD9035F202BB8F91FC79669D19C625304E2A356B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915765, "uuid": "8f1af107-64db-4c9f-a4fe-65d91ba394a8", "value": "49152:JN9HFn/qOV0mCs+v6Y+tAK9vWR4aGk48PM80DeNXM6bZ7U2z:X9VjGmi6Y+tlo4mL+C7ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677915765, "uuid": "7a8f5265-5977-4c4d-9054-67d2b254f803", "value": 2118199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677915765, "uuid": "b19451b2-555f-4d53-a255-17493c4a9b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915765, "uuid": "0b1a442c-8986-4462-8079-dc05f42d4433", "value": "4a6ff193d5a589ec190e25b69efe3e4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b881ab9b-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930612, "uuid": "2fad9209-f1aa-4f96-a07d-571a770dd5e9", "comment": "Malware payload (Mirai)", "value": "6d5e61a5e16c288ceb0ce017b02a1267", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930612, "uuid": "00746ade-c880-4ef8-beb4-1f5f1756b4f2", "comment": "Malware payload (Mirai)", "value": "3ea49f84abdb133e3b9ad58222a5251ebe1027ba8481f0f0f32be27b94996f72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930612, "uuid": "cb9095e8-10a5-4b1a-9288-dea32ad90d58", "comment": "Malware payload (Mirai)", "value": "b880c3ba4222e1d17b9e76cbfeb6b698b9a8f6c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930612, "uuid": "9ccec30e-65c6-4001-9c78-8f32885fbb43", "comment": "Malware payload (Mirai)", "value": "9fbb172467cf55b577f2d3b335f7f3e3e7c4695605ea26031be6ede1319b8a8e85b89ba3532bb12d32b639afc3338baf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930612, "uuid": "7c9297ce-1ba1-4ddf-a444-b51f9e7f6400", "value": "T15183A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930612, "uuid": "399c514b-bff6-4529-9d24-ab979bcb934e", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTV7ZDYovZ73x/nL8y8Qs:Rakdn2Eo3ePu5GTVRYo99Be037Wp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930612, "uuid": "08cbe9db-3216-492a-98db-9779d463173b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930612, "uuid": "c45b620c-14ca-4901-adfd-7c27d2d8c944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930612, "uuid": "96fe9c1c-df46-468d-a547-066af4b80feb", "value": "mips-20230304-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12d5fef-bae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677971455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971455, "uuid": "c92d1dd0-40cd-475e-8b91-f7d76ad3653e", "comment": "Malware payload (Mirai)", "value": "3fabfd2962cab82e447e475d8604b5c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971455, "uuid": "2f1f9fa2-f1d0-46fb-a4dd-d3d3ac636cbb", "comment": "Malware payload (Mirai)", "value": "3f653410ccd25e87ea570c08478138c3ae5b86a321d771eeebb2a59623a463e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971455, "uuid": "7524a6e9-18d0-4c3d-a3fa-23f4b7bae232", "comment": "Malware payload (Mirai)", "value": "aacde76c6ab8b8f053ecf2b86d38536b18a05d66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971455, "uuid": "0be8cd86-0079-4395-aa68-e58dcd28b515", "comment": "Malware payload (Mirai)", "value": "7a6f90c32d7e22f8fd81be2355107c90fd3cbd35a1e9967d4b3a9716a788e7b492496898cffa75781dcaed53e879cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971455, "uuid": "884f4b91-cf1a-4028-bb38-fd2a5d52d8a0", "value": "T16CB2E11582BF20F2C6B4093C6C91CAD176E72778C1FA216A343DA578B3D3275327D6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971455, "uuid": "ac049c1d-f433-4b2b-a089-0dd1be04e889", "value": "384:tIa8jLiBdBtrcsOOdFdP7fG1Zd5rSt0cy2c/CclR9h4cwiUPvByyq2NhymdGUopk:tF8j2HBtrJOqVfquby9/CabeiUByf2Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677971455, "uuid": "5264e195-49d8-447b-a697-633caced96cd", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677971455, "uuid": "7b710b1e-c743-47e1-b317-230c95e6faad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971455, "uuid": "3a02d894-12f0-4b13-9c57-e2ec626f1271", "value": "3fabfd2962cab82e447e475d8604b5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9941a784-ba99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677940438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940438, "uuid": "1d5a274d-9eac-473c-8915-aee9ce81b37f", "comment": "Malware payload (Mirai)", "value": "b60e810383a8f56164bdb6ae7e33c5a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940438, "uuid": "f5484037-9549-4ba7-9fb2-0f312939bc82", "comment": "Malware payload (Mirai)", "value": "3fe0049e34ac09885976727444f4387e598e0dcc7329436c810fa62d569dd78c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940438, "uuid": "33dc0e92-2baa-4252-b991-ea7057865cda", "comment": "Malware payload (Mirai)", "value": "d6085fdacc3666ab84a1bae39948e4afae15e65e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940438, "uuid": "e95be29e-a2be-4efa-b14c-ba42bd4b98aa", "comment": "Malware payload (Mirai)", "value": "cc3f5977b36c43a8ebf180039c0057a47ae4c4f4ad9aea591c7e7fa4f241e90eafd8aefed50e799f5c8e6e01a25e8a99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940438, "uuid": "d1f8c1d9-1520-4594-b9cf-e74aeb167bb5", "value": "T16092D058A5CE8B60CCB4AC76E9F14392A75F1EFCC1DE3576271464B8B38600A1BF8586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940438, "uuid": "144faae2-4f97-4e4f-a685-6207631d3ddc", "value": "384:7qfh9q/HXo/9mHZYOHVsU+2BGHTk6+vAPKiY+QlxhymdGUop5hKE:7c9q/HYmHZ5j2zk6+oP58xs3UozYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677940438, "uuid": "a6d683a1-2c47-4e9a-8847-4b8f083f730c", "value": 20460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677940438, "uuid": "fa886c55-94b2-4dad-8c0a-d51f08f56e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940438, "uuid": "e4f2a99f-21b5-473b-8b3a-fe5acf9f5bbc", "value": "b60e810383a8f56164bdb6ae7e33c5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3746fe-bac1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677957755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957755, "uuid": "7bed7b86-294c-4f94-8c9e-293c0197bff0", "comment": "Malware payload (Gafgyt)", "value": "3bfae100f42ccc5b37123998423d1360", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957755, "uuid": "58fd5f32-2ef2-4ffd-9c67-aad3653b1b42", "comment": "Malware payload (Gafgyt)", "value": "40abe0b1bc5425e76f868a880bacc5144bff63b6865ff1eaaba570f960f58efb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957755, "uuid": "8ca44f5d-4f48-4368-a85f-1b8bef2f7a16", "comment": "Malware payload (Gafgyt)", "value": "9081a39648b544259bdcd621ec6b5ff953b1ad12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957755, "uuid": "41320110-63c9-4ad1-afb9-7449bea93fd6", "comment": "Malware payload (Gafgyt)", "value": "a06c1d94045f6ef9011a5c232fcdf20979c1b8e908f7f6efafa93036d43224b5be3dc0041007c313628cb3703a8bce9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957755, "uuid": "00ced63d-1ff7-4664-b72b-f268713662bd", "value": "T1E8E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957755, "uuid": "8dc310d8-3296-4eee-b667-7897cafdc64d", "value": "3072:tdntU2haO5H1XacBoGmh9H5r5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hh5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957755, "uuid": "4e812399-46b5-4bb4-aa0f-b6d9d60d28aa", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957755, "uuid": "cb3dc3c8-dbce-4eda-a800-fd03b366ac17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957755, "uuid": "c0b19f2e-324b-4fb4-b841-1e9f8619e76c", "value": "3bfae100f42ccc5b37123998423d1360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66329c6e-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902127, "uuid": "dfa19d51-95e6-42df-aeaf-a0d26a04470c", "comment": "Malware payload (Mirai)", "value": "8f76b8c6202f49e5fd9d32517d895d9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902127, "uuid": "db42858c-2cb3-4981-95e2-1145b488c902", "comment": "Malware payload (Mirai)", "value": "40f5b069bce6dfd4d227e37a35ece37fff8dfb7dafb5db0d2a19c90cb3c868fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902127, "uuid": "e5fa963c-5887-4ae5-9761-8bb846707b24", "comment": "Malware payload (Mirai)", "value": "185d657381689fa2496bd73f53886a8b156f5c29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902127, "uuid": "3211697e-da20-4b8c-9601-95c3ad57704f", "comment": "Malware payload (Mirai)", "value": "0a9b567434155b33d0e203a677e20db2dd2515422a99f1ef3f0a91be68e17fd13e83f90e4e3bb7ca20eead52f63f1fee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902127, "uuid": "e74d71f5-965e-451d-a1ba-c24f9a073e4f", "value": "T15C03F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902127, "uuid": "0fd40f86-2396-4d2f-934c-44c81937e81e", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTt/NYwW:svbUG5fPlUlDf4Sycv+PUOjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902127, "uuid": "47692490-7ee0-49b8-9ece-ac036352f8fb", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902127, "uuid": "abc7769f-87eb-4b27-973a-21959f961bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902127, "uuid": "3e1b14c1-5242-45d8-bc64-045e7a5dd09b", "value": "arm5-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61389874-babd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677955806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "f6e4a40c-a427-41fa-ade8-7b510d748383", "comment": "Malware payload (Gafgyt)", "value": "e83bc5f45a8064b9ed4c2d31d047e65f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "b207989b-352c-496e-9dd3-7abe31421f8e", "comment": "Malware payload (Gafgyt)", "value": "418e03842663055fd29176184a24ecc1d9b2b524ba3980a31f013b0aaf3af5a2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "82040e24-55fb-4d37-9494-39ea0f145977", "comment": "Malware payload (Gafgyt)", "value": "e1b79e13f6ececce73dcf8e6ffb563be022e30b2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955806, "uuid": "d14416ad-19a2-4ec1-bbc0-7012d98889ce", "comment": "Malware payload (Gafgyt)", "value": "2c08326f1502d6ec603271fe23ca189e754e63aa4610c5f7e2b53a76b3f953ed6f57d0203c6735dee6b03b2312449dde", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "92acc4f2-8314-48fa-9a73-993be2fd8c81", "value": "T129B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "ebcef90c-0399-47d8-8930-566b0d3e00fe", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNO75hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgv5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677955806, "uuid": "c04ae130-9fe0-48f4-9358-cde96583c58f", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677955806, "uuid": "b0e4dda6-257e-4c06-a6e4-7420beb16826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955806, "uuid": "f75ea211-1603-4b65-81f0-5b67fe38fd32", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad45b06c-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922003, "uuid": "79eec78b-8951-4c71-863e-d72ab93ef94c", "comment": "Malware payload (Mirai)", "value": "c73b91a7c03ef9745a04276c6e0aa5d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922003, "uuid": "88ebef5b-24a7-40f5-89ae-a3aeba8904c1", "comment": "Malware payload (Mirai)", "value": "41b8fbb6f39dbcb2ea807413765eb2069904c7e618edef209e5afa8c7cf58ff6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922003, "uuid": "351f8741-8fdf-444c-9550-c51d4c9a03a7", "comment": "Malware payload (Mirai)", "value": "11cbfe1d74293476a4705cb47df2199731a4ce98", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922003, "uuid": "044cc3cb-449a-4662-af11-50bdba124862", "comment": "Malware payload (Mirai)", "value": "d9637cf1bce00ecc7917f779af60683376c42b2acae7678e0ceec73fec311583cd700fa698f071ef2cb60fb4853a32e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922003, "uuid": "0594641a-a26c-4732-a815-69bf100b0e34", "value": "T1D703F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922003, "uuid": "8b230797-2991-4dca-9545-9561ea1a1e24", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTo/NMwWn:AfWb8G5fblUlfbgeaUv+fEHHWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922003, "uuid": "d1c8bf48-150a-42a4-9c76-794d6f879d3a", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922003, "uuid": "63c97415-3fd6-4181-8e5f-069d261092b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922003, "uuid": "c96ddc5b-1b43-43f5-8018-3f7fb5b6cd25", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f294d8-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677923038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923038, "uuid": "23cd8e0d-0dfb-4492-a028-4f0dd91110a0", "comment": "Malware payload (RecordBreaker)", "value": "b5ecaa1dd84ec5f4fa331add2846f093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Racoon", "colour": "#DEB563", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923038, "uuid": "190fbf8f-39b2-41a5-a188-00a31006e3ce", "comment": "Malware payload (RecordBreaker)", "value": "41daf2aaa122e6e418f26ddeaed22d28f6dfdf82faecaf6014aed4b09a33fa34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Racoon", "colour": "#DEB563", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923038, "uuid": "9ae80199-df74-4f10-b950-946f82105cc4", "comment": "Malware payload (RecordBreaker)", "value": "5498b64000710c9c8ff1df4351e3a701833078dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Racoon", "colour": "#DEB563", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923038, "uuid": "bcbf971a-e407-49b8-99f1-2cb5394b9dfe", "comment": "Malware payload (RecordBreaker)", "value": "8bd0e72cd8899f95a91da9645a7784850f18650b64ccac1b50dde07bb284290f0fb037d26ce94d250adae375a43c4ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Racoon", "colour": "#DEB563", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923038, "uuid": "970e660a-5d6f-4d42-a254-632172ecf63b", "value": "T1CD56C18B56D28AA2C27036336336CB5486E5AB102213D27ACE7F53D32F63B7D76421D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923038, "uuid": "a28cbe26-2b93-4039-ad15-1c695d07c043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923038, "uuid": "dfdd9b45-a05c-4ce2-a970-0be0b5975107", "value": "98304:xsdTGtpCT1ML3j7HdSy2hnxQ4iSYpGo3/MsjH:xsdTW3jyn5E/MsjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923038, "uuid": "14a5308a-e8ca-4900-af57-fedca56bd4e8", "value": 6398474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923038, "uuid": "ff687c9a-ca37-45cf-a662-4cfec6d30beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923038, "uuid": "b323ddcc-711b-4df0-982f-8d55fb3d4abc", "value": "setupsoftapp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08bf526-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922008, "uuid": "e9a36704-67b1-4036-a51d-e91837cd95ad", "comment": "Malware payload (Mirai)", "value": "00c4469bc42a5cf86ebb3d3a8c6b12e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922008, "uuid": "8a4225c5-b1dd-4ec3-8d66-23019467c7e7", "comment": "Malware payload (Mirai)", "value": "41e7b2f22de0f3fda8e4b11b410bda7ae5f2ca1aab9505500b085d76d5f70aea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922008, "uuid": "92df0dc3-1fd3-4aa9-ae2a-42c42141c53c", "comment": "Malware payload (Mirai)", "value": "9b85eeb6992c7d913c4a3bb8ffd0441235163ea9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922008, "uuid": "dbe9b799-afcb-4699-86d9-f6bece9ecac3", "comment": "Malware payload (Mirai)", "value": "cab2bdc9312cfcf0ee061de960cbcecc835aa5581ef41e6f33eb2bec168587edeb846ffaf84ae0a3c2719e650b7cc6bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922008, "uuid": "ad4c44b2-e42f-4834-8a2c-f45431be4700", "value": "T11DE33B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922008, "uuid": "98286631-b956-4acd-b1c6-169b99c1f8c6", "value": "3072:CJLce3pC5mP7/abHbz4NpaIJ8VIJ1FBUXkkTM/9cHMY:CJLceT/abHbz4NUIJxHBUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922008, "uuid": "a543e72d-1a56-49cd-9d44-f22c7657630d", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922008, "uuid": "76ebb8b5-8033-41aa-b521-5cf63e56a6ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922008, "uuid": "c2e0cc1b-5ba6-478b-97db-b94b99de3331", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30372678-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948851, "uuid": "6a66d293-46a5-4da5-9a4b-157da97348da", "comment": "Malware payload (Mirai)", "value": "bceff2e469e6e4f4eacd40cf653057e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948851, "uuid": "1c935d86-ce42-449d-baab-e59dc86ab73f", "comment": "Malware payload (Mirai)", "value": "41ff7fcd9667dea4554a44cfd9181313d625e6e8da1dfa21aec2892940d917a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948851, "uuid": "82385018-171c-40a4-8eeb-23c7d78b47f3", "comment": "Malware payload (Mirai)", "value": "2be468a4c50f6fa9bb78a9f6af94a26649aed2df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948851, "uuid": "47ab50e2-3f45-4fd0-9460-13bb0c189be8", "comment": "Malware payload (Mirai)", "value": "30d16425ccdb2000c06501bebec5cb91a5ba752401d9c1d4634b0b0f7a4f0f1b874e2f31088a4650cfa885d2dcba5f31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948851, "uuid": "33a5a0af-2080-482e-9eca-c4cf0bc1b2b4", "value": "T1A8239EA7C4796DD0D1588274A9248EBC1723B405C6A33EFA5E45C67A4047EBCF62E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948851, "uuid": "f0e7b7ee-405d-4cc8-89c3-d4e4b9258571", "value": "768:da7wtkqofIieqUyIP4Fj8gC5mrGCynnk9NCto9KjbmCeYR:da7wtkxbxgAjsmWkPZ90mCeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948851, "uuid": "f43950cb-0f5b-436a-9efe-8d7a062b089c", "value": 47708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948851, "uuid": "6e01e328-b566-4bcf-8e5d-bc2d7adc0ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948851, "uuid": "6920efbe-9282-43e7-b16b-8bc1f732aab8", "value": "bceff2e469e6e4f4eacd40cf653057e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb96f96-bac1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677957736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957736, "uuid": "0ec9cf94-ceab-4353-86f8-70a28b623b14", "comment": "Malware payload (Mirai)", "value": "d8b7a8681e20f270e106215e67d7a69d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957736, "uuid": "2f9447b7-011a-4d90-a6c7-2ce92a565a6d", "comment": "Malware payload (Mirai)", "value": "42af1775edd3f97c38537cfb3dc1adae781f7cee56974ec290ea76dacd790ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957736, "uuid": "21819fe2-375b-430c-8e34-0582c30f6971", "comment": "Malware payload (Mirai)", "value": "23ca99a238d2e8fe4d18353ea7352c4b0c789aae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957736, "uuid": "407c17d2-1761-4438-862e-b5188fdf133d", "comment": "Malware payload (Mirai)", "value": "273517a0774ed1d3e8b2d1e013aa59303d286a82074885d0c3639052dc78fcb3a9e0b17fc4c25a4f1c65696f4ca3d880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957736, "uuid": "0367d860-12af-4ebe-9169-5ecb652facb9", "value": "T1C973B60E2E258FBDFB9C823447B78E21974833D626E1C685E19CE9015E7434E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957736, "uuid": "b734a4b7-6d44-43d9-bd2e-17742801207b", "value": "1536:X0TwrUhXeasTBgZbYNAAINzwm4JSczZfIQSv90GfardHBx:GwrGXLsKb+INL2fSv90GKdHBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957736, "uuid": "dacd4d38-c34c-48ef-8df3-b6b1e27bd4e9", "value": 80620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957736, "uuid": "a6baf313-43ae-472d-9e60-6162d4b5ef36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957736, "uuid": "8dae4cc1-2b88-4ab6-abc6-a4632d753957", "value": "d8b7a8681e20f270e106215e67d7a69d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfd4ce8-ba85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677931722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931722, "uuid": "6b3ea6c1-c85c-40c5-8391-96bcff94fac8", "comment": "Malware payload (RedLineStealer)", "value": "eedf053151f9b9fc48538f9073c201d9", "object_relation": "md5", "Tag": [ { "name": "eedf053151f9b9fc48538f9073c201d9", "colour": "#1C4076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931722, "uuid": "c4c60b5d-8fcd-42c7-b583-222823253525", "comment": "Malware payload (RedLineStealer)", "value": "43e0c399e85ed53d85b1138bdc4d4847b78963372b243abca2cd4a1a0e9ffbb9", "object_relation": "sha256", "Tag": [ { "name": "eedf053151f9b9fc48538f9073c201d9", "colour": "#1C4076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931722, "uuid": "cd836676-fec0-4eb4-abf8-c53a72b047d3", "comment": "Malware payload (RedLineStealer)", "value": "ddadca0a622a55ebb1a314275296f32dd6add41c", "object_relation": "sha1", "Tag": [ { "name": "eedf053151f9b9fc48538f9073c201d9", "colour": "#1C4076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931722, "uuid": "720042c1-f84b-4166-8f8d-84057a928520", "comment": "Malware payload (RedLineStealer)", "value": "dbd49275a47ab550e89a14c8776d5f869d53923a4c4a789f3e3710fca4befda0470f2955c5bc6f1ac70572b0b80581c3", "object_relation": "sha3-384", "Tag": [ { "name": "eedf053151f9b9fc48538f9073c201d9", "colour": "#1C4076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931722, "uuid": "ad343495-6f70-4b55-8fca-e327ae3aa6e3", "value": "T1E684525273A75488F4CB8EF1109F95A91C2C09FE3E1FA8CBE946A408DB51F685BF4709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931722, "uuid": "550d45e8-2b02-4d6b-afbe-66574e5a3cf0", "value": "c253132f7178328db49273b6d5f82841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931722, "uuid": "50c5d790-3c16-4ed0-85a5-47ee9d6e85dc", "value": "3072:5elxXN9Asc2EkPQGyOypvBUdX1FDgYNzopjoPmmXf6PlnBFti/Bn7qLHexO:5wxXN96tkYCLFDgezopUPmXPP/wBn2Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677931722, "uuid": "04fcb4ed-6f36-4421-880d-458c23899071", "value": 377464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677931722, "uuid": "e5a53449-4c01-42f7-a7d4-f713399b31ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931722, "uuid": "b219d322-386e-4c63-ae65-2f1ee7922727", "value": "eedf053151f9b9fc48538f9073c201d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2bbbf9-bae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677971449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971449, "uuid": "bdde1965-bbe5-4a13-8741-510e4892c944", "comment": "Malware payload (Mirai)", "value": "6b27e3eb92a63b70f2c90e862acab8c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971449, "uuid": "56434e7e-06c5-482d-8fd6-0daa84daa10c", "comment": "Malware payload (Mirai)", "value": "44fcf1778685d12a1f5290dbfea8459c3f5d354698af3c0629e94a454047918c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971449, "uuid": "a96c9359-3551-4a30-a1db-16e304c3e215", "comment": "Malware payload (Mirai)", "value": "950247a3c71b346f35fd6d58aee2b6f11f3fd10c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971449, "uuid": "88c47d3a-b426-48be-b99b-496a380ab4af", "comment": "Malware payload (Mirai)", "value": "6fa6d383af5377d11bd07459b1680c39ff19ecc27ae0227d48000276db4334f469810009d707c543058abe5a3535b6ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971449, "uuid": "58df8687-1047-431b-9fd0-f95036617642", "value": "T13C535CC5B4119E7DF9CBE6BE85220D0EB921721150931B27BB6FFC83BD731A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971449, "uuid": "97d7ea24-afec-4a59-a8bc-4ba379142777", "value": "1536:UPKRgsFRTbSX5R5LepSGIPsFXMhO52QUpeqEXy48s:pRwvyM8QxECa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677971449, "uuid": "14461740-2289-4294-8131-05b5b9412134", "value": 66500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677971449, "uuid": "1b21af70-4860-48e0-b38c-ca45ca54d5e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971449, "uuid": "4512e702-bb82-4f97-8f38-6f00eab7d697", "value": "6b27e3eb92a63b70f2c90e862acab8c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ab9a6e-badf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677970471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970471, "uuid": "e1384940-175c-454e-a379-25a3b5c8957f", "comment": "Malware payload", "value": "51dfb4c865ee61b1bcc56f682ccfc479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970471, "uuid": "49c4f96e-bc6f-47fe-a637-35f05cefe8be", "comment": "Malware payload", "value": "4562337bb3bd27617dc9fcddb731bce780f5a4d4b86b198b10820b1572fd0c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970471, "uuid": "c811386f-5948-461e-9d36-22d95e556fde", "comment": "Malware payload", "value": "8299051d235eecd6653cb0bf656727e10689e489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970471, "uuid": "1cb94fb7-c260-4109-b32e-c8d4a83f3618", "comment": "Malware payload", "value": "1b2831b8293b474e21f669869d7d88a3f41c72ec9867987c2c50ec060d2eec53fc7e182216b4b46240d7dcb75a66f6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970471, "uuid": "2a0f6449-5182-4da0-be67-408ee9ca6055", "value": "T134147D213AE6C07BD29315318EDCABF571FAEB494F20488727C08B1D6E359E6D23961D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970471, "uuid": "7f458cce-2487-4397-ace8-698359726a23", "value": "c820d1ff35e147ef8069d75e277fd544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970471, "uuid": "09663cdd-c627-4005-9a21-d1e560f53e7b", "value": "3072:8s8ZnNlu6UAYpiJDqZDXQ8mxpx12AqvG5Y8sSX42U8G2jxa1FguAAAAA+doXAwdZ:89DUM5abYxpx1wOy8LU8G4OKAwUA+xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970471, "uuid": "a6fd8b11-2f9f-40f3-81c7-dac12a80815b", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970471, "uuid": "6ab347a2-22f5-43a2-9315-a8d67d7b1c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970471, "uuid": "f2c4d300-24fa-45fb-a534-ed23f5c11836", "value": "Adobe.Photoshop.CC.18.0.0.53.Portable.x64_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b6fd73-ba92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677937368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937368, "uuid": "84d219af-5500-4e90-9437-975ff9e897c3", "comment": "Malware payload (Mirai)", "value": "d35d14a256673c04f4c7f5cd1296efd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937368, "uuid": "8ca02ae9-e2c7-494d-925b-ce80d4a498f8", "comment": "Malware payload (Mirai)", "value": "45d56fd9510c0e0d9a33c34c8a584d4b1e576d34321d70d6d80b465f9f4547ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937368, "uuid": "b4f03eb4-5e0d-4ff1-9961-689749a743fb", "comment": "Malware payload (Mirai)", "value": "ec31ae568d923e367b5babdc9ec8be7ebf3975fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937368, "uuid": "7fea3ccb-c2c7-4a66-a764-e68ed6d2f678", "comment": "Malware payload (Mirai)", "value": "5029753e3427c7e645b4deb948b8f9e4232396f05874c9573ef053645db0d31f3bda3285d1ee73eccb89c3c4ad87641b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937368, "uuid": "76b2d209-794f-4852-817f-9d5b89036779", "value": "T10A7386092E219F7CFFAE423847B78F259648339A36E1D585D25CEA011E7074E341FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937368, "uuid": "1861d510-c613-4905-9ced-e3117f3af7e0", "value": "1536:PCxBpGYuQsvvfIhMvdaGuT+tp32xIogGrYzgp1J7:kLdu+MMGuYkxIogGrYsLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677937368, "uuid": "ca77c848-6d73-41d7-8233-0583087964a5", "value": 75836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677937368, "uuid": "db276a88-3761-4db9-8772-7b2e37d82a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937368, "uuid": "f78db89f-4f41-48e4-8953-78e2e0feaf9a", "value": "d35d14a256673c04f4c7f5cd1296efd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e061c7-baaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677947544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677947544, "uuid": "fd059899-64f2-4808-941c-21fbb2402dbc", "comment": "Malware payload (Mirai)", "value": "2dd24101ee2b114d2b12a57a0add9467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677947544, "uuid": "913c099f-bd83-4bf3-9554-602bf4f1629b", "comment": "Malware payload (Mirai)", "value": "46d4ad6cfbb49f4e6fd23df87e880e8c4f73b8b7c1dc3984a8c16e4cd45589de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677947544, "uuid": "63333964-a9c6-467d-bd8a-e8599567e726", "comment": "Malware payload (Mirai)", "value": "cb97d9eca6883483de9c248d3fda12790f8a8407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677947544, "uuid": "2298d8d1-d1fe-4b84-8fa7-d5b36bf62933", "comment": "Malware payload (Mirai)", "value": "e8c668a5a3a3e516a25859ddcf48a648b07d60909700997fbbb0838f329aa742df22125bba74ec89d01b6505fe93fa38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677947544, "uuid": "ef309235-7579-4db2-aa3d-f51bb221e01f", "value": "T136B2D0FA1B20447EDA9AC4F586DE4F450D2607A1E002BD4DFDE8D99B9E52094F843ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677947544, "uuid": "9f813822-86da-419d-82e4-6cebae8fc924", "value": "768:A3gp5NYeuxHVOSsTm6GQo+I/sEjEDbqR7bzJgGlzDpbuR1JM:agNuxHoSLD+IJjEyVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677947544, "uuid": "31d01c6c-3e73-47ce-9c1e-4a36f3f5c4ee", "value": 24624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677947544, "uuid": "48c4a511-e524-4b5b-900e-d355487a1052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677947544, "uuid": "9af35781-efbe-4ca5-8269-a9bcc526fc81", "value": "SecuriteInfo.com.Linux.Siggen.9999.755.8986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b678ba-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677908976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908976, "uuid": "69fce8bd-f24d-432a-b593-5ad4e5c2cf32", "comment": "Malware payload", "value": "0abfe119e17fbffb3bd81577d97de405", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908976, "uuid": "891c9f4f-00ff-43b5-a94d-a6ca07593496", "comment": "Malware payload", "value": "46e413bc266891295b80f03d7fc987bde2d18f979a0709942d7d799ef787ba9b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908976, "uuid": "d55ac7f0-85e1-406e-b362-8d4eeaad4051", "comment": "Malware payload", "value": "e52360060779acc30333a739d347caaea733a0f3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908976, "uuid": "0679e670-e0ea-4c94-a48c-4c9f8425617a", "comment": "Malware payload", "value": "627382d33f43e047a65414bc2b9d6d0216ac6a1fad7b1d62dd480d113d7be6556ab63c1780c69363957b6135018f4273", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908976, "uuid": "0dd608b4-bc66-4bc7-923b-fd6db88f3e74", "value": "T15C5207414BDD68F29369F1334229940E097EE63330632AE9758EC6553BFD60E4AFE1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908976, "uuid": "8fef0e2e-287e-4153-831e-dca54bd196f1", "value": "192:VO32H76ckRSeNbFDG+erowsuGd/5iZafNGs6Y/H9BeXx3ZkcptyLuJf+NIQb2:VX6TNbF5OorcEfN44/kkE3f+NPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908976, "uuid": "a62732dc-0714-418d-8434-c059e9f16c7b", "value": 13628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908976, "uuid": "d948ce27-726f-4c8c-a5a5-d3cc934bf2f8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908976, "uuid": "d238dc34-d701-4800-be0b-8cccb23aa105", "value": "0abfe119e17fbffb3bd81577d97de405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c072d917-ba27-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677891541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891541, "uuid": "825bcfff-f2f5-48a1-801e-400580a572a8", "comment": "Malware payload (Mirai)", "value": "8e5ff73b59af89ba020df01825d51c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891541, "uuid": "324dd1fa-8cab-49bc-bfd5-aa0f5e5c423d", "comment": "Malware payload (Mirai)", "value": "48162dc5bc3c39c8c7bfa48a9e01588a6ca584cf411fc6b95c57c72210d147f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891541, "uuid": "bbd6f212-d48b-4abe-8eb9-285431973ecd", "comment": "Malware payload (Mirai)", "value": "96b114e529b356fb14198f33f6a64fdfa418ec47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891541, "uuid": "54b45c82-c958-4e94-9eb6-ece1d3d2088d", "comment": "Malware payload (Mirai)", "value": "c283e8c3df94aaba1e46deaf2e4cf102bed6785776f47329f330f5da84ebfb87a4ee14051ed26ba2e8d1cf8b5cda4e11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891541, "uuid": "077ad5cc-d7ae-4f18-a59a-3ecfc73e8a79", "value": "T162D2E1F4008CF570E7F058B1D9BD6B86B6D3AFE1C1F22674142855F8529341B2ABA3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891541, "uuid": "4db2a485-dc7c-4344-93d1-fdb95975e3bf", "value": "768:N6zsin0pX/rleyZvz1ZXJOKZnjVyxpLYAiRs3UozH:ustGyZ71BJOO8Rm8zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677891541, "uuid": "b92ad555-e8f6-4180-b4e2-7ca29d19826d", "value": 29252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677891541, "uuid": "20033954-5c04-4d21-8033-ba126b8d1b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891541, "uuid": "d76f5e64-eac4-40bb-9244-15a28d20e4f0", "value": "8e5ff73b59af89ba020df01825d51c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ed7662-ba74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677924408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924408, "uuid": "1396a6a5-e039-47cf-893d-3bbd1f06d1e2", "comment": "Malware payload (Vidar)", "value": "701477f861bde9756d5fc3ace9d2f019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924408, "uuid": "0e0fbad9-996f-4166-9b1e-61f0bd3db9fe", "comment": "Malware payload (Vidar)", "value": "48aa1381548b2590a3ae1d740852fdefdf51c46666ee2d86e50aeae66afbda60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924408, "uuid": "27b2df7f-52f5-4b88-af2a-6f901d66bc16", "comment": "Malware payload (Vidar)", "value": "2e0f06df176b574cd8f629f8e0d32fdedc72dd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924408, "uuid": "e259a26d-6c1a-4560-bb6e-ccf69a232aac", "comment": "Malware payload (Vidar)", "value": "c026e2f38534f6e7b09dc653f62847b3160600bb79c807b526e6d19d02f52e5c196bdd4b4ccba1a584deccbd1e4640b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924408, "uuid": "13d5425d-5da6-44d2-93d4-1ac680efa6da", "value": "T152A4D01273A65464F45B8AF090BF8265A9BC49B57F6F58CFE74A0049C742FA813F930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924408, "uuid": "a183947b-f628-4ec5-8153-e4f93c88c654", "value": "c253132f7178328db49273b6d5f82841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924408, "uuid": "ee3be714-63f3-45f9-9e5b-7402a4d52ab7", "value": "12288:cpdcHSyxPmq2i7PFMzPV2v207z4TSxf4sugsRBN3dMon:MdPypmH1VU20X4RmwMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677924408, "uuid": "1469c485-5a80-4c3f-9ae4-b377ebdf50eb", "value": 491640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677924408, "uuid": "916e3057-3b1b-4e20-b743-b7f4367e71dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924408, "uuid": "5367b562-e91f-48eb-9194-7320443b3c0b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9ee93f-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1677920952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920952, "uuid": "bd116e2f-c11d-41b1-b834-a003aafbab14", "comment": "Malware payload (BumbleBee)", "value": "d5917b4035dabf4e1df81fd79c4d2313", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920952, "uuid": "3ef1ceaf-ff27-4bf1-ae26-553567d1064a", "comment": "Malware payload (BumbleBee)", "value": "4a5d5e6537044cdbf8de9960d79c85b15997784ba1b74659dbfcb248ccc94f59", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920952, "uuid": "68f8835a-1dc2-4896-96c0-464fce2ebe06", "comment": "Malware payload (BumbleBee)", "value": "458057cfa84c793a18f436b38d996c8e766516d2", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920952, "uuid": "08ad58c5-7d5d-43b7-a832-110ed669e1d1", "comment": "Malware payload (BumbleBee)", "value": "209f0e4635ceec0c507dd8606871529f47a73cd2843c15a58249e67fcb18dde94a310b26b888307615f604371fc84ba9", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920952, "uuid": "ce72b22c-162f-414c-8e84-f05810718f88", "value": "T120656B19AAACC0B5D077C138C5A38987E7F274544F31ABDB16A9561D2F33BE0563E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920952, "uuid": "75f60cf7-e915-4671-9cc1-fb63fe0a80e5", "value": "431e6e792a56b1691f9196798083e783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920952, "uuid": "ff3ff403-7a91-4494-a81b-ccf7062d250a", "value": "24576:UJAx41SXU4LG5Vlcz8PBhNbJgwm9CEl9DAvOBddLfl93pb3:20bG5Vyz8B9gwm95AAdhfD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920952, "uuid": "e34df405-74dd-4db1-a9d1-7ffdae0b07bc", "value": 1479696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920952, "uuid": "7bd9f8f2-d9ab-4313-99ae-40bd3ca57e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920952, "uuid": "0d646daa-87b8-4de9-8a8d-aa84af014f7c", "value": "BumbleBeeLoader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec88afb-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677916342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916342, "uuid": "2288c943-b356-462e-80ed-d6370d157166", "comment": "Malware payload (Smoke Loader)", "value": "23ab7d03d01006cc9eebea2de38925dd", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916342, "uuid": "70679174-58a4-43b6-ac60-0ffc7d3b14fd", "comment": "Malware payload (Smoke Loader)", "value": "4b7e12886fb5db1b87075e3e995d60522a7f902cbca00a6f298194d7a3c443c6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916342, "uuid": "a68652b4-37c8-4b85-a812-3f48b413e131", "comment": "Malware payload (Smoke Loader)", "value": "52c36dfe969bbec89362fd9488992584e8098576", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916342, "uuid": "81f70a1d-4f14-43b6-9338-c3a0e5970aee", "comment": "Malware payload (Smoke Loader)", "value": "884e1e9e577126e85fa8ead9d9024af1dde90b5f4432035669802f602672b6a12821bce27cacf7e736f5f645c4dd3b19", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916342, "uuid": "ab0db780-c9fa-43eb-95b6-27ba09225726", "value": "T10824BEF172E0D831C0731A31D871C6E51A3ABCA36978459B77583B2E1EB02D0967E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916342, "uuid": "a96263de-4470-4edc-90c6-51c6a692bc05", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916342, "uuid": "2b6ef9ab-4c73-4e08-bdb4-e1f1b23798b8", "value": "3072:T4C+7+kYUqS0eblv3CL1gmdyXel1nXJBF8WCY+dMGb3jAXPSQ:cf7UUZ0eb9I1j0el5X3FDCRjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916342, "uuid": "53673bd4-09ed-4ab0-9d3e-df96d549da0a", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916342, "uuid": "0f0b05fd-a340-4822-b901-fa34357dd01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916342, "uuid": "bee61bb8-d282-4efe-b20b-73ddbde292c3", "value": "23ab7d03d01006cc9eebea2de38925dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16544b5c-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969853, "uuid": "fbba1b08-4945-4b08-8d07-04f72911cefd", "comment": "Malware payload", "value": "1ae3c7c9b6ccb563a9f36e7212633f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969853, "uuid": "38fc0cdd-5073-49e2-8ff2-966826c294c1", "comment": "Malware payload", "value": "4d7197c26f7e892d7a71fcd35b87955409a1be229d0363363bbcba41fc1260aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969853, "uuid": "986b7032-6e09-4269-9475-e063e3c5ade3", "comment": "Malware payload", "value": "3e6059360f1ad250672924205d6a41471280925d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969853, "uuid": "9830da94-a5c2-45cd-95b3-b9b0590bb5a6", "comment": "Malware payload", "value": "9c5246ab0e39e7fedc39eb7f8c3e826f7b9dc1c291c2b3882a4158552e85bf78a082d79f304a77e8734de7475be3ebc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969853, "uuid": "6dbbb4da-d562-42f6-9720-55fa72f514a1", "value": "T113A42F42C2B20267F14796F2F4E384C74FA5BD4E159C0D16B8C23929C52B419B69BFEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969853, "uuid": "1754ba3b-f2ca-4059-b146-140ffcd78e96", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969853, "uuid": "9f374c06-83c1-420a-9f17-daa396c66138", "value": "6144:vZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6:RANwRo+mv8QD4+0V16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969853, "uuid": "d38970bb-ffd6-4130-8f03-d1b71a3270c7", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969853, "uuid": "9e514878-1a6f-448f-9343-e06e5f86cec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969853, "uuid": "d8c9a0a0-4280-4d7e-8b05-c575986d49c2", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e9f1b6-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677963351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963351, "uuid": "793de35e-2834-4691-8b53-80ad52956877", "comment": "Malware payload (DCRat)", "value": "b431827a5003a02e771be393aef8dd44", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963351, "uuid": "67fba5a3-4c71-4682-82af-01afc0807700", "comment": "Malware payload (DCRat)", "value": "505305c24cced11623e247100c1ac6beb3e738470d56a4d2eee116b6b884cbff", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963351, "uuid": "f27030df-071e-4454-8304-a62a30a09ac8", "comment": "Malware payload (DCRat)", "value": "3f085eef1dfdc4373737ce163574d25bbc3be282", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963351, "uuid": "d05b972a-6494-4b70-8e99-0141b9dd418b", "comment": "Malware payload (DCRat)", "value": "5f31e78a32379e90dc70921481ad51b2a6d62b2fc1e09aee74c4a9945784ae138929e5fbae23344bf58e779345192358", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963351, "uuid": "dd41c552-6448-4978-8aed-6a6fa3496fa1", "value": "T110A51210B9D78073E263113146E4EBB19B3E7A104B6658EF6BD50F7D4F345C09A33AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963351, "uuid": "c543788d-9f94-4838-a0f3-12894a0cf667", "value": "0ed70d493c31fe7e849b88ee21606c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963351, "uuid": "41a5219e-45ae-4f73-ac4e-f29938bac693", "value": "24576:PpjOLg3zLTIi2dJpo/HxuONl7m5EKWOo+xwsbHatdKU6pioCFP:hq8UhJpofVK6KWOo4wsTaSozFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963351, "uuid": "975bdd3d-7e9a-4e11-909f-2126f732dd7e", "value": 2075136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963351, "uuid": "2552a6b9-1099-426d-bac4-1765b9ed7765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963351, "uuid": "a3b05532-6f06-4113-973f-6b6e51635729", "value": "b431827a5003a02e771be393aef8dd44.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54134838-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908968, "uuid": "bd494c12-fc28-4cd8-8ff8-1d9de2b6ffba", "comment": "Malware payload (Mirai)", "value": "8d523e5e401948af34e1d5bb8e3aaf89", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908968, "uuid": "06e4b1aa-3de9-44b2-9501-0abb0cf6c260", "comment": "Malware payload (Mirai)", "value": "50d4422c015e9f31fa78b264fcd88f25d95c526d7407ff069f15e5c5ee3b4365", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908968, "uuid": "cef9a888-da7a-4cc2-b75f-7af84de83b61", "comment": "Malware payload (Mirai)", "value": "0f476ff86abd6937eea0efac03cecc6bef88fe22", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908968, "uuid": "2faf8ee0-11bf-452c-9278-2f4d096a7897", "comment": "Malware payload (Mirai)", "value": "2e794e380fe0a456264ef34e1c5e388df1e17e04c20716bb47d9727b24e23570cdd40e05b6b36de6689d70ce3646a63e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908968, "uuid": "b286f1ec-48aa-4aa8-a023-079e5912985e", "value": "T149635B136A4484FCC44AC2B55B7F6637F623B0BE1234B6AD77D97E27AD0ED201E4A085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908968, "uuid": "17016d48-d8d8-4d41-bdfd-c41cc8b60f7b", "value": "1536:YRdcqWBQ/1fU6q9yWRzGvQ37UgV3qkgrSg/wSl9R1OCeTBnY:YbcqW6/Hq9DRzGIrDV3qpSg/d9R1OCeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908968, "uuid": "0b09c589-e01f-477e-abfb-18bf0facd2d2", "value": 72416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908968, "uuid": "b65e088b-8acd-4dec-8f2a-540c9f154084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908968, "uuid": "2179cf1e-3daa-4ea5-abef-4d984ad8bca1", "value": "8d523e5e401948af34e1d5bb8e3aaf89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4c4c42-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677916389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916389, "uuid": "2832a2d8-99e4-4792-856c-dc756577da7c", "comment": "Malware payload (DCRat)", "value": "3550755b36a4944a5dfdcf54c092628e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916389, "uuid": "8bcd82ba-3a7a-426a-9553-375cb85dd388", "comment": "Malware payload (DCRat)", "value": "520beb909a622e4a50bcbae7a43194deda3478a4fe2c4e4c81d939761076e23f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916389, "uuid": "db663579-bb4e-428b-bb5a-a4cf3812f926", "comment": "Malware payload (DCRat)", "value": "d4d1538ac728e6a81e5f938b17d30d1377ab4352", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916389, "uuid": "38c65ef9-c694-45a8-bb18-b0ca278e4e92", "comment": "Malware payload (DCRat)", "value": "b429672c5131b2da1e05f78e24d9c458642bdacb846c67ec646d79541e8e8012aae8aa7fd14d9a1bd38a526a1a13b145", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916389, "uuid": "aa95d19e-681a-4375-aae0-7ca61bf0c10c", "value": "T159D4CF685188BD92E442763193C4BE2C1492BAF1D79F78437FC94B1951AFEC1E868F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916389, "uuid": "bb696ace-7c88-43aa-8100-8cd6beff0937", "value": "866f0f37208396dfb73ab13939909aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916389, "uuid": "a95d6f52-f821-433d-b95d-2426b1139c4a", "value": "12288:zGdN/gKE0nbPbwFyyst+OMFWvBvWiv8i1w4buNNAXK7wAT/jNiaTMsoT:zcxgMnbPsF3st+OMFWvBvWiv8iK46NiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916389, "uuid": "a0f5cc4e-3672-470a-95ca-c9e3e7279d75", "value": 634248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916389, "uuid": "48e7ed20-f7c1-484d-8611-b0115c705432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916389, "uuid": "dfd59c1f-0ae3-4963-94f3-5d4d470fff73", "value": "3550755b36a4944a5dfdcf54c092628e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7171b68-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677970204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "1d5b9d26-803c-4027-a162-90cbfc697d74", "comment": "Malware payload (Mirai)", "value": "3436566f4f701c23aef15a6e8a71c51e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "b8f1a10e-800a-45a6-85ce-e50f8b867ab3", "comment": "Malware payload (Mirai)", "value": "54856f0e521c4fc68623f4a6c5e6c5ebf6e3a01ded5bb2a76edc4f5a84b5a748", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "58ac450d-fa5d-41c9-b1b5-7129a53a79db", "comment": "Malware payload (Mirai)", "value": "bb22097dd9a459ba06c754c3e96f68b454962067", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "cd1ce407-f1bd-4293-9a70-fab0f0b58b23", "comment": "Malware payload (Mirai)", "value": "5cc90088bdea85e54385c54f36d4b0601a65fe155d03b9847c4ed2d7316c32505436aa88c818a33ef3238878ac57fb45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "45e10061-71d1-4238-847e-fe6769b9d1ec", "value": "T110E36E46FA818F13C4D517BABA9F4249332297A4D3EB33068D185FB43F86B9E0D63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "6706d004-f7c6-46df-b534-d9bf7c61f54d", "value": "3072:9vfgc5vV/7LayCKfNskUbeH8FjlC+tDGcEsoq6WvYM/9cd0WT:FfgyvV/7GaNz4e8FjlC6Ghq6WAM/9rWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970204, "uuid": "f4c1236e-c043-4dae-bfa7-153a9a8f0793", "value": 147644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970204, "uuid": "056162d1-296b-4c7d-9eb3-d82aba9b2ee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "eae5dbbb-29fd-4119-b975-65c394167fa3", "value": "cutie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0165ad8-ba51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677909606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909606, "uuid": "4347de52-dd4f-4380-a7da-078df3442a65", "comment": "Malware payload (Mirai)", "value": "e62b47d91fccd299195bf32aa60532d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909606, "uuid": "4271a0aa-32bf-4446-bfea-ff0aef31b6fa", "comment": "Malware payload (Mirai)", "value": "5488605cbef23c56f1ff9e7f19bff16f1d13dc31f4d53753969348e841e5ca36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909606, "uuid": "b4fa9a80-d06d-47de-9ef0-19c80253d5c8", "comment": "Malware payload (Mirai)", "value": "b81d64047e2c79d15a073a9a6c02052aabe9a8a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909606, "uuid": "f49dc743-40c1-495f-85da-fe21191c02e8", "comment": "Malware payload (Mirai)", "value": "aff9a779fb37b94b53f29b947bd929e7495b4f5e85c9610459e52eafedaffeee203a946e8dbff720bbf9c5d46672ef4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909606, "uuid": "43b0903e-7633-40b6-9e75-b47c31cb8f61", "value": "T142E32B46BA409B17C1D227B7FA9F414633229B58D3DB7302891C5FF83F8AA5E4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909606, "uuid": "c3055b4a-ac4c-4943-924a-d4cb8ceb3118", "value": "3072:lsFhzCfOb9DvaYJi7E82gbJpBEO3hmPRZClxEQm6vJabK+uQM/95Mv8Ye2:O30O9DvaYJi7EmbP4RZClxEj6SK+lM/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677909606, "uuid": "194397c2-56b3-4444-8eb5-70c817a79465", "value": 148988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677909606, "uuid": "db34f662-3546-4faf-8554-de3c7ea088d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909606, "uuid": "2551519d-2f32-4685-ac5d-52acfee5919e", "value": "rift.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293907f4-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677963013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963013, "uuid": "d98baf42-2f21-4db0-9294-fd8c16110920", "comment": "Malware payload (Mirai)", "value": "dac9d00480cb14e540f78bfbc2bcc8a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963013, "uuid": "b3fe7544-9279-44ea-b128-26d1a5d3ccd9", "comment": "Malware payload (Mirai)", "value": "549dba34a0b006ca7a9a8226459b3cda481f47669aac0086703d61f2b582d034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963013, "uuid": "0e35f006-c012-423a-b57c-194a1fe18ad8", "comment": "Malware payload (Mirai)", "value": "c35136fdedc1b071b2133b2410e83ee6f432567c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963013, "uuid": "83e92abd-282b-42a3-8ae9-9213600d2825", "comment": "Malware payload (Mirai)", "value": "618d63cfbf32a3cbc11388347b842a9953470f2054217bfeec3a98047b0b87aee70af38082ba44de57b6c6753ce51033", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963013, "uuid": "4709748e-cce4-487f-9b45-d4802cb196bd", "value": "T1A073941ABF610FF7EC6FCD3749AA1745288C651A22E83B757934D818F64B24F05E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963013, "uuid": "33eacc22-e20a-411d-a6dd-a2caeabda317", "value": "1536:nxIYSamaD3AXN93160S0S6pJppzROZWfPDaCdHQ:nyTamaDytXdOSdHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963013, "uuid": "11c6afb2-0274-4b14-9a3c-8692148b6741", "value": 80396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963013, "uuid": "f6c88488-92a3-44d4-a025-f956ba4365b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963013, "uuid": "15aff2cf-cbde-4664-b68a-a9e263836e1b", "value": "dac9d00480cb14e540f78bfbc2bcc8a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60c4b55-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930608, "uuid": "d2bef7f2-748e-4c48-8fbe-c45f41b3a255", "comment": "Malware payload (Mirai)", "value": "0b374b626aaea94367cedb7779299260", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930608, "uuid": "7702aefa-5e99-4168-9276-91cd5069f8f6", "comment": "Malware payload (Mirai)", "value": "5547725f48c00ef4b5f7605ce2c32529aeb440174a3f6def5fba46e639dc735b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930608, "uuid": "de9da713-f3a6-41e7-aeef-eb065ef72478", "comment": "Malware payload (Mirai)", "value": "f84684463ef314600b011b0aeef10d1b78b109c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930608, "uuid": "e8e146b7-0be6-48e5-a837-5b135e950336", "comment": "Malware payload (Mirai)", "value": "3a28c40f9823043db846c89e101f6ddd5cb98a7ed7bbdb5f35dc3fa87b092e0b6493a2012ff29b237b4e1c57083d9317", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930608, "uuid": "5a9fb289-870e-4cd5-bca6-215550cf6a20", "value": "T128632951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930608, "uuid": "a5585250-aa06-4bda-942f-9d533bb6116e", "value": "1536:qNSlxYmii8N1U9uO//kWEjFHikg/QA83NRuxAvjWp:qNnK7kthHikg//29jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930608, "uuid": "2ac21e86-ab44-4711-b857-80fec791c044", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930608, "uuid": "cf7e1c35-84b3-411b-b41a-ff65aefcc7bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930608, "uuid": "913d159b-dd73-4585-a843-4a569816da01", "value": "arm-20230304-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1247e44-bae5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677973120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677973120, "uuid": "80d6937b-3e73-40b9-bdfb-1b12231619be", "comment": "Malware payload", "value": "de6df3eab6ee093961146e95553f4a51", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "stub", "colour": "#3A0E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677973120, "uuid": "00a34dc1-da37-4cf7-8dfa-fb761f1d8508", "comment": "Malware payload", "value": "55586218781fae74e5ffd44f37c1c3e9a95239b702ec4f14305c5f1471947518", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "stub", "colour": "#3A0E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677973120, "uuid": "a592cc6e-1982-4ced-a384-8b6be39cd46a", "comment": "Malware payload", "value": "d699ef8e4570d88b6f7e63bc6b74e14c7cb1310c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "stub", "colour": "#3A0E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677973120, "uuid": "f2627bd0-ab39-42fa-86a2-ae4143108170", "comment": "Malware payload", "value": "0a8f3eb8e45d3636a745408d5cf08de31e87ce581f76b8a93d7e08bb7a97c061327774ec9b811d104537fa9e9b6f783a", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "stub", "colour": "#3A0E48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677973120, "uuid": "933a2d8b-2b04-42ab-ae5a-e2400d1e8d48", "value": "T14A35BF0E33A65D16C5FD8FF2A870D14406ECF90E97A3AB164844FABC2D47390D9AE593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677973120, "uuid": "af19b940-c7c4-4f11-8045-855cfbf58479", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677973120, "uuid": "c4d1965f-8f8c-4983-ac0b-b81106ae3877", "value": "24576:TLI60KD4sTvib/EoAxVj3gCu5Um3e3bnk:z45a1j63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677973120, "uuid": "18ade66d-19a7-4ee6-a3f3-4027b829dec5", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677973120, "uuid": "e89210be-7119-499b-a7c3-1c5ba2f37342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677973120, "uuid": "1163f061-50bd-4dd1-85df-f712878d2094", "value": "stub.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d59454-ba5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677914124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914124, "uuid": "ede92119-0479-4cdb-8d26-32f9ef2805a8", "comment": "Malware payload (Amadey)", "value": "2cf7028f2e221b5c48ce27381282d7ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914124, "uuid": "56c75b5d-c47f-42c3-b357-a2512de37ea4", "comment": "Malware payload (Amadey)", "value": "5636145ced6e73f725835d37f75395017a69a860236a01195dc4b11bdc2be021", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914124, "uuid": "33ff9535-1559-4f54-aed9-673e61c578df", "comment": "Malware payload (Amadey)", "value": "b24556b48cc4cf9641448d87d9c1ee7f9af86c5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914124, "uuid": "f9d17b0c-b8e3-44ba-86c3-79d2cd1c49fb", "comment": "Malware payload (Amadey)", "value": "251be08f6c1cb01160f6d51bb6b36d1e2f488eab41a5808e79cf11f79b9aac4d504dd4b5d1bac958042a1ad2157d1b73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914124, "uuid": "46777097-0012-4f95-96e6-7696e6b5676b", "value": "T113357C1BA26601BCD4BB9178CA274A46E775744603309BEB17D05AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914124, "uuid": "773b5cd3-38eb-4bf6-bf15-f328fef00239", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914124, "uuid": "ec8794b4-21d5-4916-bdfa-2a314d84849f", "value": "24576:JMq/RX0hoa8wrC+azFbtZhUYFauTZyRMlH:Jioa8wrCHz3ZhUYRAuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677914124, "uuid": "47b0b875-60f6-450e-978c-24e7fbf375b5", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677914124, "uuid": "3abd24f0-7b79-4ba8-838b-7c7f87414c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914124, "uuid": "99c21e88-96fd-4157-a513-3eebb468e8b5", "value": "2cf7028f2e221b5c48ce27381282d7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44214e38-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908942, "uuid": "8f061329-a3fb-4c6c-8871-7ae2e3923759", "comment": "Malware payload (Mirai)", "value": "a5e355364db37406371be2f86c8719c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908942, "uuid": "8fd053cb-3cac-475c-b6dc-1761d4c3fd83", "comment": "Malware payload (Mirai)", "value": "584edafd5734941b51610a8459a4a73a5ca651f06711136d519861e4ba8c4722", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908942, "uuid": "4dde4409-dfdb-4a8a-bd9b-5bdc0d302d7c", "comment": "Malware payload (Mirai)", "value": "796fc5ccc5c89fb8cbf0362f7a4ba68dbb91d115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908942, "uuid": "ec68393f-14e9-4bbd-a46e-11ba3d19bf3d", "comment": "Malware payload (Mirai)", "value": "75521ee2f968719cdb94e851a40fe9179e35186812af64032a310863362b3d23de1bee1e95647d8833f0097a08a85ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908942, "uuid": "e4585d47-aeba-4a84-b6af-b089736f9f3a", "value": "T15D732A45BE829E17C6C543BBFA1E028D372563D8D2DE3223CE166F2177CA51B0DAB161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908942, "uuid": "1a592bca-1fe8-41c8-a51f-027c2806ea9e", "value": "1536:C7fnlcydUky08Ezop8NpEcb2dsCaYGT6kbd0wIuvYHgyv2wbZnN:CLlfdG0Dzop8LMd6v7bd0h/2wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908942, "uuid": "56d2c631-c4ed-49e3-9d2b-03d692dd4c73", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908942, "uuid": "5f252ee1-d328-4710-ba3e-766e9653b2b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908942, "uuid": "ca64a509-8755-4eb7-bef1-52b8594be854", "value": "a5e355364db37406371be2f86c8719c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b83282-ba66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677918283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677918283, "uuid": "dc999e82-0bd7-4a4d-86cc-dd2678248a08", "comment": "Malware payload (RecordBreaker)", "value": "b7198742cf96274453aaeda5e5c2f34a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677918283, "uuid": "7fdcf24d-aae0-4983-8b3d-b1b902138323", "comment": "Malware payload (RecordBreaker)", "value": "5a5d64bb6b478e02a7bed40b6796af0c0d4d96dc8b95bca2a29c8fa01c1ae855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677918283, "uuid": "3b6f8e27-ee01-4751-9d06-a4eef0764366", "comment": "Malware payload (RecordBreaker)", "value": "b029b5774243728fa258fdc1b4b6fbff1f61093f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677918283, "uuid": "14391e75-ca1f-44dd-a385-78dddbab93a2", "comment": "Malware payload (RecordBreaker)", "value": "31575665456f41b309a767b6e538051585dea390e452779d8c64f806b329c3d2e320920c960a0d385654ba3c1f9eb285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677918283, "uuid": "52d840b0-bba9-45f3-b8dc-64b62e9f9439", "value": "T1EDC63323B91A4887F1B59C332613BD9472BCA74E4A467C7975E93DE41833DC0BE26E42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677918283, "uuid": "0efb3eb7-3c95-4490-8c82-2a7b3b4c1a2c", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677918283, "uuid": "2be187b4-264a-4c4b-8e90-889d143ea2ed", "value": "196608:F34/clSvDF4tO36XBqlRUrmMaC4JfjqWnkebhMCjk1NxiIA0Ov8CfOem:F34ElSvDu5XBqla8CW7nkH1E/fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677918283, "uuid": "abad6e63-115f-4e01-a6af-82de5eb6df75", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677918283, "uuid": "94cade48-893b-4d95-9cb1-5c019e0f6019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677918283, "uuid": "b43b7e0e-9182-4049-8e6f-0db10cc2dcc5", "value": "File_SeTup_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c902a82-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948604, "uuid": "8bc9deed-c116-4107-95f5-e4e0e3966e01", "comment": "Malware payload (Mirai)", "value": "17b7619f077a543bb2f18b6be5237f7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948604, "uuid": "5d383af1-bd5a-4777-924d-d7076dad4359", "comment": "Malware payload (Mirai)", "value": "5a9a18fd627c5cfe7e80d75d03cb1355a4fa7ceaf66ba326a04f9613a144a4e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948604, "uuid": "9e2449d8-0645-48be-9349-e8778a0b51d7", "comment": "Malware payload (Mirai)", "value": "247aeff595e219d1b811732763ca8839007591eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948604, "uuid": "769b9dc0-d16a-4c9d-ad52-7336cac6728d", "comment": "Malware payload (Mirai)", "value": "397cd8e7bd52bbb50eb411ce3256991b86f28d933c6644b30ede9764ff9687d9ea59bc44a829c209bb8e35082afba83f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948604, "uuid": "b101cb36-9f80-4108-9bff-11ccbe4f30d0", "value": "T1EB334BC0968BE9F5ED154678207BAB335B72F43B1129EA8BD3DDA533AC42611D20738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948604, "uuid": "74ea08dd-5890-4b67-b12e-9cce63edba02", "value": "1536:/YVBunFXAHW0eLqDb5j7dxjgp7Sl/UkSP8:/YrwFXAHreqb5XQFS5FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948604, "uuid": "e80cc6f4-9b23-4371-9f36-1198f81353f5", "value": 54332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948604, "uuid": "4b16a73b-0a22-40b8-ae36-565e0ce3c4a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948604, "uuid": "32e7fc9b-5686-4a8b-bdf1-3d85b5a349ac", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba4b693-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948495, "uuid": "a133bf0c-b70d-4a1d-a45e-8228aa130804", "comment": "Malware payload (Mirai)", "value": "5190a3a9f0ee8bf5258bfda25f6c4a3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948495, "uuid": "e6abd824-ed69-4b65-ab92-a0cc51f777b4", "comment": "Malware payload (Mirai)", "value": "5d548811e45c1d3526b74eebb04774b0b4da0d57e7b26453d3a7427e28034c6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948495, "uuid": "f73c5c62-24f5-45e0-9f4d-6c537aad29e9", "comment": "Malware payload (Mirai)", "value": "5ded671747910767e92649fe582215e43dda716a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948495, "uuid": "7393f5be-e937-44dc-b001-891076dd2953", "comment": "Malware payload (Mirai)", "value": "80fb783814da83ff922b9b5a0d3acfed4983acc92ed3da1fa71e709cdcaff5aa54cb7e85427f8ba200d09a398e5135c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948495, "uuid": "67de3547-1755-45b1-8905-56316dab94b4", "value": "T167330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948495, "uuid": "82be93a3-26a1-4a24-8e0a-ba4852b86696", "value": "768:gduPBFnHooqR8qOCKq2bH4/te+TK806MMUVjzkfQXObHud2oGB:r/hqaJLeteqK806MHdkfQX6HuCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948495, "uuid": "e4da7402-12f7-4e3e-9f51-5d7d153f0ba4", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948495, "uuid": "1cd42548-2983-4880-9271-ec71b9fab1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948495, "uuid": "b2e9bd63-afd4-4801-a4b0-fdb1042d7cc8", "value": "5190a3a9f0ee8bf5258bfda25f6c4a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea059e97-ba86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677932413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932413, "uuid": "bb364417-8fc0-4126-843d-be3d1f8c4311", "comment": "Malware payload (RedLineStealer)", "value": "955ac7abbaa127042ea6e57d33a223de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932413, "uuid": "a56c6cef-55a0-483d-8641-dc37da9e3315", "comment": "Malware payload (RedLineStealer)", "value": "5ee37f2e711c0d7ecf98f65707629ad377884fe2927d829d963e7ac2de42404d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932413, "uuid": "d376eae7-2d15-4270-9480-b62bfe34d28d", "comment": "Malware payload (RedLineStealer)", "value": "43990adcb2cad72bc5491346141a9c70938645f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932413, "uuid": "16bf3376-cc07-4796-9ba7-7f0dc473482f", "comment": "Malware payload (RedLineStealer)", "value": "f11bfd69184b3710b2e4cb155a556a710c335d2ac88bb42bb9ed5bf47ab5835eb31d4cc373fffbfc704ecabb21dbbc40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932413, "uuid": "c0f342df-804d-4598-8450-23ddc840c7ab", "value": "T16E556A467881C471D46204351ED486A24E2BB07DB7AD5FD72FA83A6F0B2F1C0B5F1AB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932413, "uuid": "4e1a7a1b-5da8-489f-83c9-ce13b5ac940f", "value": "b863869b90f14623282c66acf7c7857a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932413, "uuid": "7cb34636-7a74-4c80-a4cd-0c51cbe793ba", "value": "12288:B/itGGf4KU1bXENDCsE2bucqxzB2jL8gRQ5et+hGli:4tb8bXENDCsE2bucqxzB238gR2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677932413, "uuid": "a20aebaa-bfde-4cf9-845d-132430fe152b", "value": 1309696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677932413, "uuid": "775fc4ae-2f36-406b-b86a-1f8a801425b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932413, "uuid": "5d22368b-3d81-4b16-b60b-9a6f5a809277", "value": "955ac7abbaa127042ea6e57d33a223de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64bc8f8-bac1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677957747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957747, "uuid": "abfcf970-4d56-4fd8-ad85-bf5609333d79", "comment": "Malware payload (Gafgyt)", "value": "09557bbf17205dc3d20b22009a51db2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957747, "uuid": "1a484096-0483-47bf-a3ba-77fddbdcdead", "comment": "Malware payload (Gafgyt)", "value": "5f0eacff19f315596404156d90279625241fd02a8fd837401e95e75d4496f6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957747, "uuid": "1ab5d289-7ca1-4476-b4e8-384c92612c91", "comment": "Malware payload (Gafgyt)", "value": "d71095a6226aee7873dcd060c1b7071ceb85953b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957747, "uuid": "da0a2e77-eae8-41b2-8bb3-3ac5b59fc0fe", "comment": "Malware payload (Gafgyt)", "value": "e03e85bd974ec91fb77da9f7a3aa9eadfc1114f1c8d5151bf39f5be2fc4a0bcfa053d3b71159bdf0b91b26c98f4e3041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957747, "uuid": "751c01ce-182c-48ef-a81c-505c5a69c294", "value": "T113A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957747, "uuid": "a95f5123-72b8-44f2-8486-393ba81d9a1a", "value": "1536:xfRuqNM5h7t/RiRt4ngphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRHphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957747, "uuid": "1b59948d-7bc9-4aa6-bf0c-71ef9f713c90", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957747, "uuid": "2c126660-f8c3-485c-b996-9c8cb9838992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957747, "uuid": "af013a21-c339-4041-a1dd-366cfeadcecc", "value": "09557bbf17205dc3d20b22009a51db2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661dcbe8-ba73-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677924031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924031, "uuid": "1554da86-43be-43ba-8d89-494dbc935ea4", "comment": "Malware payload (njrat)", "value": "8d0782217bc639f153d6bfb2a11bf61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924031, "uuid": "1767c7b1-5663-4e2f-a312-a36e3a54882e", "comment": "Malware payload (njrat)", "value": "5fc24af49135266571b585ded69894aeb84a7ef4c1108f005e719f4711cb6a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924031, "uuid": "abdb056d-46b9-4af4-8cf7-7dc5b9036ed0", "comment": "Malware payload (njrat)", "value": "53741d3a84743077df6861cda05e153ca2722833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924031, "uuid": "8d266ebd-0da5-426c-b32c-06bc48bcef5b", "comment": "Malware payload (njrat)", "value": "78b3c8c1786983a6f55b701a5ab02ba0ed82da83113b7b32024150fd345261778e802f94399ecba71f345457798adbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924031, "uuid": "bf4f8ea6-3413-4b80-9396-d8c79b40e133", "value": "T10CC2082C37B68232D1EE067E5562DA5043B5D44BF223FB0E4CE998ED4B5B7C90A41EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924031, "uuid": "06bcf0df-ac9a-4bf0-a867-0bd7471437f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924031, "uuid": "f1b8faee-57fa-4dab-a42f-aa8a1d39452f", "value": "384:3LNxgLXeA03/lfHWtfequqP9BR3MIAQk93vmhm7UMKmIEecKdbXTzm9bVhcaI6P1:7/ku/sOIA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677924031, "uuid": "025cc178-df47-4837-9c4f-b0a99ee28f06", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677924031, "uuid": "d0a34f62-6b60-457f-b15a-db7c077bfeed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924031, "uuid": "4e6ec41b-6ce9-4e38-a55a-da9ca3bcae28", "value": "8d0782217bc639f153d6bfb2a11bf61e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be824e48-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1677916878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916878, "uuid": "975f7512-c1f8-4b8f-a3d7-7e5eb1913679", "comment": "Malware payload (zgRAT)", "value": "9192e64181b18d3b4360eeeda153280d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916878, "uuid": "4b1c0785-0274-4df9-bd40-58118f0c2b16", "comment": "Malware payload (zgRAT)", "value": "600a67fd5cd4296edff5d830aa6ada02a9a7d328f74e1cdfd3c0d15642c2bc0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916878, "uuid": "494472e7-0a61-468e-93bf-d9be52c57a4a", "comment": "Malware payload (zgRAT)", "value": "33a0002c72ee3e3a53d6152ed8b0345f16bfe5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916878, "uuid": "dc86eadd-01de-4108-8b3f-5c4ff4979727", "comment": "Malware payload (zgRAT)", "value": "33999840c22d6e52c48aa31dd11bead3e9e0fbbecaee59bc0a735cb87412017fef9e28dda04391cf957303077d4bd094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916878, "uuid": "cb9d5970-5dc9-47e7-b7b8-4fa7fe3e5ef3", "value": "T1A2F5BFF09F92EE41D3FF1E7090DC1A805DACAB4782698749BC885552E9E1740EFCC6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916878, "uuid": "fc9b66c1-8ab1-4746-9dbf-30d082c18178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916878, "uuid": "38a08161-51a5-4803-a517-2c899d2d53b6", "value": "49152:ylbxfQlsx29e93RQUVAIGfTmhDQQKsqI0cfUjDc:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916878, "uuid": "05b303c3-3b3b-409a-948e-2a6258d6428f", "value": 3514280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916878, "uuid": "17e834ae-95c2-44f1-a44a-cc00d8791a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916878, "uuid": "9b1f8f10-745b-4968-9e97-0524df6f17d2", "value": "9192e64181b18d3b4360eeeda153280d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f6d5bc-ba92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677937377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937377, "uuid": "9b5928f1-aefe-4c21-835e-56768490eb92", "comment": "Malware payload (Mirai)", "value": "42ae3a20caf317c0f6e3912df56aa4d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937377, "uuid": "968c26e2-1a67-4927-8609-955e51bed7b6", "comment": "Malware payload (Mirai)", "value": "617a84ebecf8a522cd40ed81f072fe7c1095125e8781cc825046272ad56135c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937377, "uuid": "9eb94abc-16d3-4a23-a2a1-db9a5bd13864", "comment": "Malware payload (Mirai)", "value": "d3c583e47efe12f48b0e0df3305e9fe9d57eb5e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937377, "uuid": "f770f31d-4e90-4e54-994b-c2c2cfb0d719", "comment": "Malware payload (Mirai)", "value": "3bde10baedbdc53d3868892d738a29500081851f83e4cde34a1d9ccc9b9b353143b47b7358f870d0905bb22cdbd7e834", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937377, "uuid": "5211536e-f9a0-4181-b888-53e2b79023bf", "value": "T131234AC49A43EAF5ED120A7420B7FB335B37F07A1159FA87D3659532AC42711A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937377, "uuid": "3929c24f-117f-45a6-8a91-362bd3049e17", "value": "768:cY/QjSN+MGBs8WWE3/NRHgzqduOxPntFEwaKXg+ZdG:cY/QjSN+MGBzXE3l3duOltRaKXhZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677937377, "uuid": "9abed9df-4fdc-44c1-9e61-f8c53c95670d", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677937377, "uuid": "6d0a1d7c-23c1-4b56-9864-03455fc4291d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937377, "uuid": "96f10ef0-87c3-4805-ab43-7797bbfa451a", "value": "42ae3a20caf317c0f6e3912df56aa4d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4732830a-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677923120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923120, "uuid": "979eddaa-0439-4c6e-b33d-8502f36a83a3", "comment": "Malware payload (RedLineStealer)", "value": "2c812d7e940a975208c5edc7a725876d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923120, "uuid": "cf634fb5-68c4-4c71-8dda-e5b664ea7083", "comment": "Malware payload (RedLineStealer)", "value": "62bfcd6ad96951af9bd54bc9f99fce2f8cd3fa58549c8c794cc567c2321220c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923120, "uuid": "a4ccb3dc-3c23-4067-a233-073b8a6370bd", "comment": "Malware payload (RedLineStealer)", "value": "00b992fed26c4f8ed8ef6cc0f8236fefdf6b75aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923120, "uuid": "4fda790c-06f9-45a0-9310-9eeb756c1422", "comment": "Malware payload (RedLineStealer)", "value": "ded6cf466aadecfacfab92396f56fc90b64772635b8215740fd97a69fd273ae7662635fcfecc409c819164f8e6bba6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923120, "uuid": "f1ef13e6-ce05-419e-86ba-a94f199155bd", "value": "T1A104BE1476B2E436E1722D314935D2A12B3ABDA29E36D59F33507B2F5EF02C05A36723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923120, "uuid": "669b929f-cc7f-44e5-86c0-9de4e08bcd4d", "value": "803aa1e15a1117e9632bc3833b3fb2c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923120, "uuid": "f0c65d16-676f-498a-8453-ffb6779c0a32", "value": "3072:jdVNti/6xKr5vbakpmF9nSmzL/GTkDzJef3198SJI0KH:fvm6M1vm9PnSGckvIfFLC0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923120, "uuid": "f4699f50-488f-41d5-96b4-2d805e5b96e9", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923120, "uuid": "cf34e241-c355-4b9e-880d-efff21c1bfe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923120, "uuid": "9c698aa2-a0bb-4d9c-83bc-ebee5131f951", "value": "2c812d7e940a975208c5edc7a725876d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274523f4-badc-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677969023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969023, "uuid": "7d7b6b55-7f90-467d-9b82-532f69f53ceb", "comment": "Malware payload (njrat)", "value": "41adda822773fb4ddf76c5fb297c41e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969023, "uuid": "8a923050-60f1-45bb-8285-39db78615033", "comment": "Malware payload (njrat)", "value": "6318e30d76a4d1b8b4c61d72208d2a3e7aab6790439c8d918236cef35efaa327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969023, "uuid": "8b60cdc4-dfd3-4eef-99d2-b080445ff088", "comment": "Malware payload (njrat)", "value": "4c66ceca8e87c1acaf02145387fd31528eb0a9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969023, "uuid": "7572185d-cadd-44b2-86d1-5b499521f7bf", "comment": "Malware payload (njrat)", "value": "f93e4f3d5430387f352b49148feecddc2ade647843bc9738a12fe490190f19e670ec8ceb846a7cf091f51ac4b3ab97f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969023, "uuid": "fd1de750-300a-43cb-81a7-6120d081a560", "value": "T1DA03198D7BE0866CC5FD067706B2D412077AE44F6E23D90D8EE574AA37336C18B51BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969023, "uuid": "e3d5aa00-2401-4dc3-a23d-bc150ed88064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969023, "uuid": "9b12a88d-5343-4f23-a8f6-05500a2d106b", "value": "768:4WfYl2KhhIwdpszJnq1MdrM+rMRa8NuZ/t2:4WCIwd+dnqqG+gRJNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969023, "uuid": "1e28dcfd-db03-40fa-9a2d-c7ac579a9800", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969023, "uuid": "f6e90284-a84e-4ec1-b35d-6a553671c504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969023, "uuid": "d58f8502-2e6f-465d-ac68-25c296dde8d7", "value": "6318E30D76A4D1B8B4C61D72208D2A3E7AAB6790439C8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49667b3a-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908950, "uuid": "088b1d17-5e9d-488a-9590-58e1baf72b45", "comment": "Malware payload (Mirai)", "value": "edd661f3b312191f66b51503b6109917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908950, "uuid": "d0eea102-b04c-4a80-97b6-54a72e34346b", "comment": "Malware payload (Mirai)", "value": "6424699797b9459f868bf60b47179d4963d450264817d68b394a1697a3180a7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908950, "uuid": "fcd441a8-8764-48a0-a76b-4301bce0479c", "comment": "Malware payload (Mirai)", "value": "5fd26c6aa171f81f07fda0b92276b2f7f795e05b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908950, "uuid": "6fb842bf-9009-4193-bc09-eddd4db05a68", "comment": "Malware payload (Mirai)", "value": "0652d049d98ad2b0f871462a9d847dabd2878834e64846b6f761f5f2f1571bc7331680d77210a9056aaaed047b97af42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908950, "uuid": "42b558d2-bd6f-4d34-9662-21b628ef71ad", "value": "T1FD931956B9829E11C5C5027BFE0E018E331367ACD3DEB213DD246F21B7CA56B0A7B466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908950, "uuid": "bea8acbb-e872-4fde-9c46-85a23cda57a6", "value": "1536:/pnhBPTAzkeOyQbLQdpvlyeFCVSkuRaw6MoiMdiCwJDso9vnJCQR57YMRwbZnJ:PBSketQbLsptCVS7axwZsYvnJCQRhjw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908950, "uuid": "9ec534a4-8ea3-4a73-98e6-8c96f5c445f7", "value": 91416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908950, "uuid": "37b5e165-a326-4bda-8d1a-85118c4475bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908950, "uuid": "9083b493-89ef-47d1-94ee-93247ac37680", "value": "edd661f3b312191f66b51503b6109917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be02c3e-ba85-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677931772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931772, "uuid": "489898ae-816e-455d-8859-5020db2c6e65", "comment": "Malware payload", "value": "89e0a08493b2905d2474b34965f2a510", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "Smartassembly", "colour": "#1B19C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931772, "uuid": "c8a6f1c4-df63-41ae-81d5-e794d43cc391", "comment": "Malware payload", "value": "65bea8ecbc22a05fe6cdd7108d9859e22de0a6796c7597ff299e4baf0dde04ad", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "Smartassembly", "colour": "#1B19C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931772, "uuid": "41eef971-e705-4eac-bd40-f27d8bb09a11", "comment": "Malware payload", "value": "1df60aa57b0322e31f9c7f2f4934c4a0c3406ca5", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "Smartassembly", "colour": "#1B19C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931772, "uuid": "0da3230a-58a4-4ffc-8e4f-a99d98e852ba", "comment": "Malware payload", "value": "9db624b419c6b553863e6ae6feb914c8474c986586a8d8e2b56824a78be75fc116ac682d308b797d4505e3d0f0e4fb90", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "Smartassembly", "colour": "#1B19C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931772, "uuid": "f0ad4ec2-2518-4f2d-b48f-ef7c3f14dee3", "value": "T134D3BF16BA4EED23C6AC877848F3F3645338E8354B17D38FEA449AD81D317D8689614B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931772, "uuid": "dd72d0b8-c8ab-4a16-8c67-93194d9bf95d", "value": "3072:rMpM2bz/dAMhdF2jBCmLdjafBzk8aa5H2v:Ybz/LLvmpjEBzea5H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677931772, "uuid": "3bc8df90-fa8b-43b4-9d18-d696a624ca6f", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677931772, "uuid": "84995cb7-d7e6-41d4-91c5-2be3022b06cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931772, "uuid": "abf3b4a0-f172-4017-9cf8-d5a08f5f4745", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21453ea7-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1677917044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917044, "uuid": "a3c3bab4-65f8-46dc-a244-360b468e4377", "comment": "Malware payload (Phorpiex)", "value": "605d8e8adf3e43e606d45869bc279803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917044, "uuid": "840517e9-6d92-46a3-8a97-3daab0e19f4d", "comment": "Malware payload (Phorpiex)", "value": "66ecd78d60b6b570cc14e088899af8afaad696bc11775c845777aebf7d97234c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917044, "uuid": "0f83c408-e0f3-4f69-9b05-01837ee40088", "comment": "Malware payload (Phorpiex)", "value": "39a7dbe4554585fa73f6e581f0b7ccdd5ce26b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917044, "uuid": "8f97ac9f-c8df-4386-b872-0488e5b83d40", "comment": "Malware payload (Phorpiex)", "value": "a38cab0a5b902882f22769af3b7c1383f8995b3006ec843f6a3558fc4c059a4d72ecb86a03aa4147a7a4563aac998d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917044, "uuid": "46edc903-5b5d-41b0-81cd-d9edee8429b0", "value": "T120E1A60B6B5402E3E754C67542B7AA49E6BE512323247ACFD1E78A489D0B313B4437BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917044, "uuid": "058fd111-93e1-451d-90f2-f36256bf5647", "value": "d65758d31215fa0cf1abf175e24d35cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917044, "uuid": "9a8b3ee6-ff03-4e44-bc57-d5e2956c7c07", "value": "96:S5UrVm8uw0G3U6RYHKcBPtboynuYUL8PCtbOoX:4MVm8ybkMP1oynfUL8ebJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917044, "uuid": "fe9f775c-a4c3-4c3a-b1d3-d90993552b60", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917044, "uuid": "5c041eb5-006b-404a-ac32-b1b9eb5bd677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917044, "uuid": "2eb37df8-0d84-4db3-9dba-b3d992ccb841", "value": "605d8e8adf3e43e606d45869bc279803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a460b1-bac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677957128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957128, "uuid": "9d91a6e6-ba9b-4cb0-a0cd-784d9e4b66d3", "comment": "Malware payload (Gafgyt)", "value": "595d21d03f4f45ec14d8560ca18b9719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957128, "uuid": "79202644-0d93-4e55-9124-c7177e972c51", "comment": "Malware payload (Gafgyt)", "value": "6a08ac7fc4891bac110ba648cc1fbe810ae9fd08bb5a584ee1a7996362a923c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957128, "uuid": "e63b4309-b141-436e-bea3-40fcd9c832d8", "comment": "Malware payload (Gafgyt)", "value": "4207c094b3a17e9ff6362bf0d97cc2c65ba459e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957128, "uuid": "52750a84-4020-481e-872d-eca225cac5aa", "comment": "Malware payload (Gafgyt)", "value": "1ba673d7eb602faeeed6ccfe993568770cc99a1ae4b5275e576d31c7f35e130e70a16371b1bd66091100fec80f490d72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957128, "uuid": "205efd30-9b6f-4f1c-9184-2d7cda5eafe9", "value": "T179C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957128, "uuid": "86ff1ca5-3f7c-4877-b3d4-ba3dab659ac1", "value": "3072:idwracAAviNmLpMQ1xv5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxv5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957128, "uuid": "815eab8f-6ee5-406f-9f85-4abb0b0ae2f6", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957128, "uuid": "a2562d47-f4a0-4250-ab9d-db0543b79374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957128, "uuid": "9f8f3e0a-73ca-4dc8-89c6-3ea9826aa689", "value": "595d21d03f4f45ec14d8560ca18b9719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bb5a98-bae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677971470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971470, "uuid": "61875e5e-4c96-43b5-8bf2-4467ef015dd3", "comment": "Malware payload (Mirai)", "value": "e2d6a82e66967ac61bfd678de73157fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971470, "uuid": "a5aa6a2d-9770-4ccd-9a45-ef9443e9fab1", "comment": "Malware payload (Mirai)", "value": "6b3eeb4b39cce92e144b1478cbf77ecc59bc1e5f0a34bb20186d0fd7d03c4666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971470, "uuid": "9e42708c-b6ea-4e97-a5d4-947e3e73ab26", "comment": "Malware payload (Mirai)", "value": "d2e5e3431293843aa86b462be4074be5388b0270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677971470, "uuid": "5bddce65-d025-4f0c-9c48-503ec7959316", "comment": "Malware payload (Mirai)", "value": "d595614d4187acd0d75693246894bda48ff14cff14e88c87f238287fc8f8d45262053cf2a4a54b06a851b07b74ebdb0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971470, "uuid": "4680f62c-4712-4f09-b7f2-839e68211ed9", "value": "T1E3539EA5C5ACAE58C61441B8B954CD388723F408A5E72EFBD646C796900BEFCF1187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971470, "uuid": "59ec6776-f080-4afb-862f-bb552a7a4eb9", "value": "1536:PXaA1Nnzd/mUUV7tiYmG6+ZSjs7Iofs3wXxrlzN0Z783Cz:PXv1NzdeUUPw9gGMxf+whr5N0Z7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677971470, "uuid": "2d97f8ea-2914-48b7-b13d-784cceb4afdd", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677971470, "uuid": "65339728-970b-442a-b037-bfcc4479741e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677971470, "uuid": "5203b369-3f13-4c7d-becd-4739550762c8", "value": "e2d6a82e66967ac61bfd678de73157fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c961d6-bac8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677960620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960620, "uuid": "ac9202f9-3acb-4b01-97b9-0db7b246ac8d", "comment": "Malware payload (RedLineStealer)", "value": "41dda9e4d7134396306cbd01cbd60b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960620, "uuid": "3ee88e9e-230a-4e1e-ba4e-bb179912949a", "comment": "Malware payload (RedLineStealer)", "value": "6b50c49860e67ff6ae7d1d229cca779aa7e1ba3fa9a2cfea975d798bffdb6576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960620, "uuid": "ff406989-be8a-423a-9f80-a8bb7d96475d", "comment": "Malware payload (RedLineStealer)", "value": "3870a024dd2ae5321bf10bb3a09fd7eec7ae628b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960620, "uuid": "c1be5777-51a2-46c7-848a-a23f1b90d8a7", "comment": "Malware payload (RedLineStealer)", "value": "598171c654c1c05c13a275116fe813cfe2d382522602b7f613d29256a3d29b174923533d39fa8ec5e582a34e673b1630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960620, "uuid": "91efeed6-171f-46a3-a2c9-949c2b4d4210", "value": "T13BD4905FBEB28AD2F3180733D3DE8C0043A55DA769D6EA0B258937C548327A9917FC16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960620, "uuid": "608caf24-0590-4427-b7d8-aa923bf761dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960620, "uuid": "d1acbf91-5eaa-4404-b4c7-74c16833d8a6", "value": "6144:snyAwpL7RyBKGxf7mmP5KFwQNSfRJ5PaDXYPbDITIYdlIZElUUi1s1hASvRkA:snyAwpLNyBKGxaYr+cRvqXYzsTBOUiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677960620, "uuid": "30a27d51-b69d-4d7c-ac57-474986b41309", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677960620, "uuid": "5ec0eb70-e9ec-4557-a6af-179f5d005141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960620, "uuid": "479ef4fe-912c-4137-a288-303233a8c284", "value": "41dda9e4d7134396306cbd01cbd60b30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a36371e-ba2e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677894322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894322, "uuid": "8d7cd84b-3a8c-44b5-a51a-f94210d94d35", "comment": "Malware payload (RedLineStealer)", "value": "5dc36fb5b7e93a0be0f04c7c63ea169e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894322, "uuid": "8c928d10-6aa9-4c3a-a51e-843805082153", "comment": "Malware payload (RedLineStealer)", "value": "6c30b849a72e0a88e8ca3e4fa46c2cb0b1ed0fce2f7cb7125b945d4aa03162ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894322, "uuid": "c629d5a8-7862-45c6-b232-8f439c90c0ac", "comment": "Malware payload (RedLineStealer)", "value": "6b8d3961aa92198fe158a84c3c30c772add88018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894322, "uuid": "2a9e957b-88d2-4e33-bac0-ddade98d8d91", "comment": "Malware payload (RedLineStealer)", "value": "43d77de832b857f2ca236d2780deaa1a033df6e4247bb4981d499c06f810c92d9b02b7b5ebb41ad8cfd2ed0f6120ea60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894322, "uuid": "ba371066-7a32-40cb-a8d7-2f2ae00f3797", "value": "T173744CD4A96D8973FEE461355093AC1C6A297F93B82E729F328FF5941537E08C6C2E04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894322, "uuid": "6ebbcea7-5f77-4f94-9656-721921a89244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894322, "uuid": "d38d7b2a-3296-43b3-8b06-74fbed910fda", "value": "1536:3vZi55zWaaDfjvo9m3oCpDaFF2U9nXvb8NrfJbu3zAgYMe0wuei+snYcclOtL6:3xqZWDPaEosarNn/b87es5MehywJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677894322, "uuid": "045ed9af-3bab-49e7-aa81-4d8f6d0a4313", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677894322, "uuid": "fa3360b5-45ad-47be-9d79-d33ca822200e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894322, "uuid": "93f7453c-9f2d-4db6-96d2-7530f7430134", "value": "5dc36fb5b7e93a0be0f04c7c63ea169e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a256c778-baa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677945607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945607, "uuid": "2b2439bd-c9c7-4651-8b70-dddf1498bf0b", "comment": "Malware payload (Mirai)", "value": "f4568a3b37eef877e6d8154c06304ca4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945607, "uuid": "5322703b-aec5-4985-975f-80a50e992a19", "comment": "Malware payload (Mirai)", "value": "6f0a85cb42d88dd59c098810d0836bf6158ad3cdc511728460e82565373cdc51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945607, "uuid": "cf56e965-5382-455a-b63d-89840a365099", "comment": "Malware payload (Mirai)", "value": "715939d3a103166b22cdfe42b6fecad1404f5d87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945607, "uuid": "07e3c631-a0d6-4c6f-a3be-8e750f2fd847", "comment": "Malware payload (Mirai)", "value": "c88f6b0e5e759a92a3cfae8f1c783006355e24f4534f9f0d0e2ffe81a05d77835d4ab95b87f8b9b1c371a3c774138ec8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945607, "uuid": "9e3cfd63-ac24-40b9-931a-85ff4e153b76", "value": "T1C923E171152DE63209B3BDB6CA3D5CC776DC4EF480D9E0A043665170A2C59B26BA6EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945607, "uuid": "f4278728-1fdc-476a-9e14-c8269cf83400", "value": "768:d2r2PAGVxeSZJsb8Vtx7TMgT9q3UELJqqlpf/zAaD4stZGByRv:0kob81nnSLJnlpHzDD4DSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677945607, "uuid": "76ac3e22-d066-437f-a790-b66a96210ffd", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677945607, "uuid": "1e40c1e7-f942-4457-8294-af9f978f2893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945607, "uuid": "b0474324-a88e-4d87-99c8-7991e7d4f348", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3738a3af-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1677920946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920946, "uuid": "f44cb641-e92e-43f7-b8cd-1b9dbe5be58d", "comment": "Malware payload (Quakbot)", "value": "d691f44e52b98b73f9adc5d19881e666", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920946, "uuid": "91b255b9-5edd-423e-8b83-e24fc3f38641", "comment": "Malware payload (Quakbot)", "value": "6fb690fbeb572f4f8f0810dd4d79cff1ca9dbd2caa051611e98d0047f3f2aa56", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920946, "uuid": "d547e1e3-68f2-42bd-bb1e-42c87461c073", "comment": "Malware payload (Quakbot)", "value": "efae06e2cd11ed3a3e62af621ae723d55c95ff6f", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920946, "uuid": "11309ed0-5db8-4284-a92e-cbf0c6a7edb7", "comment": "Malware payload (Quakbot)", "value": "a35a5a7cdec834ad81eb96d430b57336e26fe7d3abdc9140dd8336ea2e122daad161fe851f0dd91e46b5630793bfe8d7", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920946, "uuid": "abe6ca3b-df3c-4397-892a-75cb51c73eb6", "value": "T19331AB0107F61308E3B38F36A83AB3518772B825FD4163AE436451498C70B18E978B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920946, "uuid": "c8d2bc62-c58a-49a5-ae16-0becbe21e310", "value": "24:816e25BF0jbKIW9CubXUWkp+/CWVUGgO4TXD/Fom:8g/iyZPUzTXjFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920946, "uuid": "e64031ea-6bc2-4106-a9e9-f45253b52726", "value": 1512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920946, "uuid": "1afbae5d-bbec-493a-bc67-f2a26eeeea26", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920946, "uuid": "2930193f-761f-48bb-929a-6cdd095797d8", "value": "requested information.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36ae6b7-ba5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1677913907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677913907, "uuid": "55ed0875-1fb1-430c-b11c-51e44d9f5fab", "comment": "Malware payload (ArkeiStealer)", "value": "63c8c66405bd96fa529429495fe99710", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677913907, "uuid": "2db21be5-cf18-4428-8e0f-d043901a0a0d", "comment": "Malware payload (ArkeiStealer)", "value": "720a55a4a626fa83be8c819cdcdf0c6f5ddeb51b15801f206f97874d0af47748", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677913907, "uuid": "5e3bd73e-a6cd-4e5a-b1b5-09d7471680b8", "comment": "Malware payload (ArkeiStealer)", "value": "da05b7516df1487c4ee6376d34215a6aac2f2521", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677913907, "uuid": "496a0b50-4fbe-4c2b-b92a-50e920fb5822", "comment": "Malware payload (ArkeiStealer)", "value": "2980848da392d84d89caea14209ba0f01746227ce61622c644a960b86c3a9de6acf443e45b4a63e3c2b495d3acf85732", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677913907, "uuid": "6146fd19-718c-4861-9d50-a2c93dc2a15c", "value": "T1F8F3F176DC7C5F2FCCB9483C64E937B1813EAE94664D5D13218DD86A81A91F08B026DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677913907, "uuid": "7be214d5-7c41-4a8e-8992-d8fc7b6bd920", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677913907, "uuid": "8731ec35-8f07-4028-8d14-09e1a73b6e8a", "value": "3072:UJ2KmrjrgJU1dMAc20+2PBesdCWsFLZecoBoen1TJSp8Bb8EG:R5gJU1mAv0hJeSsFLocodJ8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677913907, "uuid": "535c5f2c-c4db-40e5-ad9c-45991907aba6", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677913907, "uuid": "251dceb2-9484-4dd4-9bee-82c297128dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677913907, "uuid": "a82a3560-4904-4307-aed3-867526aa445d", "value": "Builded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4b1443-ba37-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677898356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898356, "uuid": "f8de73b8-b71e-4aa6-8730-c45cc980f1d8", "comment": "Malware payload (RedLineStealer)", "value": "2805e6e47d2d2222ec1074d5653f2fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898356, "uuid": "3dd27854-8832-4798-80f3-3b06fb72d2c7", "comment": "Malware payload (RedLineStealer)", "value": "7428ebf96293f4cf749ab1eca55e8847106ec873bf9cfd5167672e8a47d65c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898356, "uuid": "90b5232a-8eda-4630-8fef-8fe38a58d670", "comment": "Malware payload (RedLineStealer)", "value": "e659ab2bd0ec65009ae162baa4f790da7f27205b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677898356, "uuid": "a77ffc14-bee5-4967-81dc-d3928f7dc81d", "comment": "Malware payload (RedLineStealer)", "value": "c4b08b88b59518aef8356a04685f765caa959a4855382dff08de7ed1b2fab406f08c99a65bfc55572a6f7fd13445405c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898356, "uuid": "fb5eab19-7be6-46d9-a867-2d7e072b4476", "value": "T13325234BEBF81072DDB497745CF602A31A37BEE19F3846DA124BAC951873160E1353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898356, "uuid": "4e8ec4d2-a3fc-444f-b580-74331f9a97ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898356, "uuid": "c438d66e-80a0-4bf9-bf0a-57865ec41e67", "value": "24576:iyOKVijzFlClYzTCIDA4yRMGAS8ozNl65G8NJm:JOKmjDURUozNlUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677898356, "uuid": "88836980-38d8-43a1-b089-9d3cbaf06fbf", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677898356, "uuid": "57cf1e96-7669-4411-9f56-cfa969aa2759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677898356, "uuid": "ce4751e3-5f75-4d89-b54f-d47fd7059486", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c3be5d-ba99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677940425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940425, "uuid": "0604cac8-89a3-42e5-9e0b-48f9eb4cede0", "comment": "Malware payload (Mirai)", "value": "2e235350b922cf14cd93d902380cd6f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940425, "uuid": "f0141d8d-3e14-4657-94f9-fd7300a7c775", "comment": "Malware payload (Mirai)", "value": "743d96e434077581b15b203854e12a1084b46ef8be2a7b66dae415800d480884", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940425, "uuid": "07e6ee7d-87a1-4697-a8b7-621263726082", "comment": "Malware payload (Mirai)", "value": "9e2db06bf109e77d215d0a77926fe1ad09ef63de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940425, "uuid": "d626132f-608e-4121-854c-3e71f151157a", "comment": "Malware payload (Mirai)", "value": "41200f5f0d37d37ba81a672414cd0c74cd36c6c54820f73f65c85a7b60225e774e6554870a1b4188050d1dfddb1c3220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940425, "uuid": "6178a389-89db-4cc8-9103-379ad3def5f8", "value": "T1B5137DB6C43AAE98D1588678F8244A781F63E50187672FFD4B4985A68047EFCF60D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940425, "uuid": "42638085-af9e-4cc1-9c68-98e98001c5d6", "value": "768:Ia8T8wtor9Xs95YEeBMcSBxYumPTRnbyR/qDTCZoCpwCf:Ia48wtwejjPpmPdmR/qDThuwCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677940425, "uuid": "10ca1e9f-9a9a-4dca-b7e9-7c31e04bb5b4", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677940425, "uuid": "81f1131f-7899-4048-a494-3da619743913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940425, "uuid": "e58a5f1d-2960-49d8-8a29-f87a8efd8f52", "value": "2e235350b922cf14cd93d902380cd6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b1821e-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677917185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917185, "uuid": "90029a0c-837d-41af-87e9-61f9476c3d21", "comment": "Malware payload (RecordBreaker)", "value": "86a50be342b45dd5aa47c7a5cc4db6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917185, "uuid": "97bb4045-19f4-46e5-8608-ff4db6dc2caa", "comment": "Malware payload (RecordBreaker)", "value": "7596a0c598ca8fa3d00bed3a98bcd65d177fdbf276392515ec7788078feee448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917185, "uuid": "a46d757f-f27c-47aa-a131-ad39a23a9b05", "comment": "Malware payload (RecordBreaker)", "value": "cc5e3d1f8702660cc837f72497e67613753dc658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917185, "uuid": "e85c3034-16bb-48c7-85ec-501d95978729", "comment": "Malware payload (RecordBreaker)", "value": "07dd6dec92e65f90fa25d21432ac207c5e005148a561f44a4404071452620cdad3ac897f65ce0e8acd7a7e56b7fb4dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917185, "uuid": "655c8343-f0fc-4497-9988-beff5c7fc16d", "value": "T10DE623F271F1C867E2B34932396A7D6070FB27822281495D7453BAD87AB3F40251DE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917185, "uuid": "92ba9596-9406-49ad-b95c-ab167c5da499", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917185, "uuid": "39c58ea2-60d2-4694-9065-a3e23b9426fa", "value": "196608:h2qgM5Vcac5YCRV6PVrLVsghnSO4UpjiyfSYV3eiIuRoefLlbwshVCJHnnP:sqg8WacCCRaJLSUiSiHeIuR3LtwgVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917185, "uuid": "90ac15ca-5e84-42f0-8e96-0833015e77d3", "value": 14420992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917185, "uuid": "1da89bb4-823f-4db2-bbe1-4ade746c19be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917185, "uuid": "d8f77e0c-f7fe-41ef-a0f8-075721003f8b", "value": "n\u0435w\u0440h\u043et\u043esh\u043e\u0440_\u0430\u0440\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44a7860-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916968, "uuid": "463e6593-2247-40d1-b444-741529f71f7d", "comment": "Malware payload", "value": "b51e76b0db544b8ed7de25c20b135ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916968, "uuid": "9cfa0af3-26e7-432e-a89b-2e980b04dcfa", "comment": "Malware payload", "value": "76740ca39c3100502cf72faf2fdfff19ef8ef90490e6e9181e646d2320a78e86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916968, "uuid": "612ad1bc-d501-4bd6-9631-896f009605cd", "comment": "Malware payload", "value": "a2e61587ad958b974574a888653f1aeae0e75b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916968, "uuid": "cacc8c19-7828-4614-a56c-bf5c08993c02", "comment": "Malware payload", "value": "d93f621b188629bc7b6480fcb658dac92b9cf901915db1eb9391cf5ecd3908b29bcc76d6b37bf6253e510ac81cecc5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916968, "uuid": "f49548f0-b851-4e84-a83b-19bff28a65a3", "value": "T15D341201A3E4D473D8F39B300E795737ACA2AA23546463AF531027793A33256DE1F7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916968, "uuid": "a20790d4-9d7f-4cb1-965c-8fe80df39a22", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916968, "uuid": "08264998-0613-4efa-bacc-11fb333ec0e6", "value": "6144:TYa6Zzl33NJppDAw+wuJ5vqkAdjTFmaUWxhG6+Usviz:TYTpNJppcwcJ5ykXaz0jK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916968, "uuid": "f403213a-4fe1-4675-9169-05b07639d3be", "value": 248791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916968, "uuid": "5cfdc3d3-f24b-4d56-9a09-91eaf04a7ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916968, "uuid": "efd5c4c0-73d8-4ecd-8430-029a0edec2ce", "value": "b51e76b0db544b8ed7de25c20b135ce6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd14fbf-baaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949656, "uuid": "8a1c011d-c66e-4f5d-8feb-47b12beb8c96", "comment": "Malware payload (Mirai)", "value": "351d6473124cc2feedacaaa176934a3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949656, "uuid": "e827c0c6-ea8f-4fb1-8f2a-dcecde0ecd5a", "comment": "Malware payload (Mirai)", "value": "7687714f9d9c96fa42f16df93e807c2d01562ef021a22fe5414091a9453aa143", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949656, "uuid": "469bdb7e-bd71-48fa-9f91-0c02014ac926", "comment": "Malware payload (Mirai)", "value": "63ed63beac3be40c2a0bad896e3507700a6eb687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949656, "uuid": "58a6b239-9105-4305-a0bc-eda36d4fe40c", "comment": "Malware payload (Mirai)", "value": "0f02258be1b8413ca266ba37b048a442c520d7f54515141ee189d0ba6f74f3e17b220ae74755ef7e570897a46cf324f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949656, "uuid": "2335638e-4bf5-451c-993f-2e0552485761", "value": "T12F334A0272280907E4575EB0793F1BE093BFE99021E4F688680FDB5A8676E371187F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949656, "uuid": "a07da0eb-2e58-4f2e-963a-adf95e69f163", "value": "768:6nlmPc+x9MRtrfZ60l55DqkyL7HgWJdmZzi+UeyIP:fPrDMl6onHyL7HJAZzi+PyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949656, "uuid": "9aeecefd-961a-4260-8fc3-3877d0ab6247", "value": 51056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949656, "uuid": "7292d391-6165-4c50-a0b7-345a5b6d0c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949656, "uuid": "e7ed1e26-25bb-4b19-b317-5a5a76fad5d2", "value": "351d6473124cc2feedacaaa176934a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff5e52-ba5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677915657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915657, "uuid": "029f50b7-bc34-4ac3-a2b4-44d4858607cf", "comment": "Malware payload (SnakeKeylogger)", "value": "0c416fe6c6e3bf4f5c9ac7c6087b9f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915657, "uuid": "55cdbc2b-ce72-4451-860d-eac95d984b4c", "comment": "Malware payload (SnakeKeylogger)", "value": "77a709b9c25370a8706e88779bae17ee74e76fc2c61aacc9ad1d45db05e1da2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915657, "uuid": "81e68805-d18b-4c49-9b4e-4bffc75c2e9c", "comment": "Malware payload (SnakeKeylogger)", "value": "793729d2f6b6a1582138a6cb28e09eabea7c4b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915657, "uuid": "5892b6ab-6a16-461e-bd04-8260c5c49601", "comment": "Malware payload (SnakeKeylogger)", "value": "a6b77b13ae1f284cb9e967c61a0f57e5371eb35954a44c731724a930c942043026df4f50340e996ca088e397001f9e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915657, "uuid": "d9351f96-8198-4745-844e-a4b1c10a8515", "value": "T10145982809FC0AF245B1F1FD9FE4E753BE8488E6A7049D99C2834B89555385720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915657, "uuid": "35b72cf7-f85f-442b-a5d1-4068323950a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915657, "uuid": "ba60ff7a-139a-44fe-8542-f4165727e957", "value": "12288:2NMOEAla5KrZ6c63B2YU/xSLdlSDub8g8KsTRp27ZT+v8/yUX1k0+w/3MzSSV93:26Y8PIYU5SJltbZ8B+Uv8yo1k05SSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677915657, "uuid": "9dd512f4-3993-4670-ab68-469893d47e32", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677915657, "uuid": "ac16c6fd-8b00-4578-b306-269d8e9ef4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915657, "uuid": "59a93764-a8f9-4966-b16b-3490911bfcb2", "value": "EDQM 0080527850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ecdd43-bac7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loda)", "timestamp": 1677960322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960322, "uuid": "ba5be809-c6fd-443b-943a-b7f65b98567c", "comment": "Malware payload (Loda)", "value": "a364b35d4dbdcf328367df843a6286c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960322, "uuid": "92638580-eca6-4175-9fcd-a6d98f43c5f3", "comment": "Malware payload (Loda)", "value": "78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960322, "uuid": "e700e28f-fcc4-49bc-ba87-7a02d2f1bdf6", "comment": "Malware payload (Loda)", "value": "31a54c5118109afa7d5c7c465bb4d3b25c947284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677960322, "uuid": "4b6ae7d6-4973-44ad-84d8-0a88f6896155", "comment": "Malware payload (Loda)", "value": "4056fa714ce73dfad92b295a8b22d6e9f6ccba6737ad923733125de69d265efcff57c51661392cd489b7be28c16d8dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960322, "uuid": "a05e0a92-626c-40ba-978a-480fb22058ee", "value": "T12DD63312BBDD8176C2B25273BD79F711AF3A79260225F09B2FC40939AE60112572E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960322, "uuid": "98e13b0b-d027-45a2-bd96-839a6e82786d", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960322, "uuid": "0da3a21c-492c-47ce-9933-1f878f12aea2", "value": "196608:Lg+Aalc1yGZIh6L5iYl/dsy+7d3tFELLs1cAm6f971YAmX1ZK1vauo9Dn:Lgsl5hef1k7ptmQbm6fnmlZsoRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677960322, "uuid": "3ef7e70c-d3f5-4832-9e51-6e44222acb00", "value": 13576628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677960322, "uuid": "e328664c-a8ae-4623-b07d-593ff968a5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677960322, "uuid": "4db0fd07-8ccd-47be-b33b-3565fe225e84", "value": "a364b35d4dbdcf328367df843a6286c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010a5bde-ba3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677899810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899810, "uuid": "c6336d71-98c0-4bee-a796-7b7053b158bf", "comment": "Malware payload (Mirai)", "value": "cd919805703c0e78a7bbd1b39d6b1942", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899810, "uuid": "a3217aa8-4237-4e14-99a7-23d0fc1ed338", "comment": "Malware payload (Mirai)", "value": "7909403bc2c36b405861fd4a105b7dc861ed8d7d240975a51264210b87800ad4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899810, "uuid": "67409eb3-5484-4fd4-89d4-e8734de14ee2", "comment": "Malware payload (Mirai)", "value": "93176cf02e373c594f5d46f00c206fbf7dbc0745", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899810, "uuid": "3b623f86-f14b-4e92-bb23-21bcc5260c93", "comment": "Malware payload (Mirai)", "value": "9c7c54d4291233132c9fdf1ccb25faee2a6e069049ba739941f621c0bdd893e000ef50d5331fce5c3ac7bd9955196be6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899810, "uuid": "cfb5c9b9-7cd1-4999-ace9-01e5deb0c8fc", "value": "T1BCD2E134C41DCAB2D2BC6532DF2B4FD3212F2BB469AD30E7166502A52E81537097F6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899810, "uuid": "d4fc2351-2f3b-4b27-af84-f8dcc3096eae", "value": "768:7oB1Eqy2TAwdZALN3yQAFRpwdh0vc7tvs3UozI:7oB1EvmdZA4/aUvetizI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677899810, "uuid": "85668f0a-9e21-408e-a734-e10924b1101d", "value": 29040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677899810, "uuid": "7e5753df-4964-4121-8173-f7d5205114c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899810, "uuid": "0e118511-fd2f-4ca0-8dbd-790b6af7c00c", "value": "bok.arm4-20230304-0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925d2552-ba4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677906496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906496, "uuid": "988ca08a-a21f-4855-9617-88acf0ab7eba", "comment": "Malware payload (AgentTesla)", "value": "a086b1062656053ee82dafd92eb00252", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906496, "uuid": "35f57ca1-9e33-47cc-974b-04a5d9a742cc", "comment": "Malware payload (AgentTesla)", "value": "80ff48a7d79ab0be1645decf79d42e3b9d5e5a00e2dec724f9af5d8f2669d48e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906496, "uuid": "c4c2aa6d-1ff8-4a3d-914b-2ccb2da51ca1", "comment": "Malware payload (AgentTesla)", "value": "ecd541abbd001215adfeadaf7296844850941417", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906496, "uuid": "2b91c78c-0acc-462f-b955-89da10c24a80", "comment": "Malware payload (AgentTesla)", "value": "12a9a920cbb8eef63c43516f05b615a6577a2fcaf9021e3e1941cd76f211420b1e4e90ef4ad790c8a509ac09959b19e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906496, "uuid": "3b35229d-250d-4057-8fe9-c642733961fc", "value": "T19562C4511BCD88F29369E17782294449157DF52E3A935AF8B8CDD2823BFC20C1AFA1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906496, "uuid": "e778ac1a-420e-4048-9b50-ba69c6e58940", "value": "384:tu/WVwoX2zKDrntnSfn+DfLt3oJ75AKSIrGDBHk:tu/ywWukJS/+3t3urvMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677906496, "uuid": "0c3da1d4-a6cc-441e-a31b-3b8d285ff322", "value": 14649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677906496, "uuid": "9c5334b0-ce4b-4664-b746-dcc20d424d53", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906496, "uuid": "a8108f2e-7e82-48eb-84be-16201db6c86a", "value": "a086b1062656053ee82dafd92eb00252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4be432e-ba3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677899789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899789, "uuid": "e0dbd2e8-2860-4877-8a80-5f4236976a2e", "comment": "Malware payload", "value": "4c5b0e5ef61c699c1522ce45eb0171e2", "object_relation": "md5", "Tag": [ { "name": "193-168-141-107", "colour": "#95CB45", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899789, "uuid": "d7a8d4c7-1fc9-4c22-9d12-0dc1735f465f", "comment": "Malware payload", "value": "82633f6fec78560d657f6eda76d11a57c5747030847b3bc14766cec7d33d42be", "object_relation": "sha256", "Tag": [ { "name": "193-168-141-107", "colour": "#95CB45", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899789, "uuid": "c62a201c-28b6-4b77-8bf1-14b0b51a1b92", "comment": "Malware payload", "value": "aa033e9f102bc8d98360e6079da3c8b4d7e2d3c8", "object_relation": "sha1", "Tag": [ { "name": "193-168-141-107", "colour": "#95CB45", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899789, "uuid": "ec0c3852-4369-4efe-885c-83690d3d6511", "comment": "Malware payload", "value": "9acb53985b77abd399ee86119388e5e9830c1be3b8028189be4efffc14e22793006806e780993d2174503c4c29f03068", "object_relation": "sha3-384", "Tag": [ { "name": "193-168-141-107", "colour": "#95CB45", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899789, "uuid": "9a8bea22-2c1d-4003-b2d0-363e79aeb0c4", "value": "T111A4961353A6A613CACAB7F072CB772ED210FE113DF55CE7EA50D1844EE074A5A26B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899789, "uuid": "cc4e265a-ea57-4f5d-ab5e-ea67f75a5d90", "value": "6144:D7C1u5ZE2bf87/zJ2t9tGI1QrE2InYSiZ5zJl42XatfI:Dms8HSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677899789, "uuid": "cbb7ddf9-afc6-4894-b5ce-8ed3b572b4af", "value": 459248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677899789, "uuid": "ef62127d-1369-48f7-9688-df92e64413ca", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899789, "uuid": "ee2cea41-430d-49b6-a9dd-d0eeb86f306c", "value": "Installer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90941cc-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677921996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921996, "uuid": "86b6047f-3e38-43df-ad72-6926fb31c6d5", "comment": "Malware payload (Mirai)", "value": "da46b6fa6e9a7c3a89cff415aa74bc82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921996, "uuid": "4d5422e1-0b44-41e6-ad24-bbe1aa1df44b", "comment": "Malware payload (Mirai)", "value": "836e29f1ffb8b3b2ca4d165708370cf12f0b7d52fc7cc65391f612ece1aaffc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921996, "uuid": "75befd11-8e6d-4ec7-af32-add090f616d9", "comment": "Malware payload (Mirai)", "value": "9fd99e4db31cbdcf597c1781458e8a227557a2c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921996, "uuid": "c65d1b08-c5dd-4f85-a212-c309277cf5c1", "comment": "Malware payload (Mirai)", "value": "623052e19d2019f828881cb7f091630774872e688b1dbba30f6ff2308d5763805a7017c425fcdf03c27ea552f4968959", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921996, "uuid": "d5213351-aa91-4b29-8b36-3fddb5ababcb", "value": "T16F436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921996, "uuid": "32ffdbc9-4c56-4dd3-a7be-7dbef03670b6", "value": "1536:JeESt/basV2rcZhG6ySN7naflSR9zWOIaEjrqMMs:JeESt/basVTgS7nafQRVtXEST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677921996, "uuid": "676b918d-56ff-4256-995f-209ebc82e5a8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677921996, "uuid": "8c950f44-3a7c-41bb-b6c9-48deba8547a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921996, "uuid": "294d2c1e-0c75-4408-8d8f-1260c71c0689", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d79e00e-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948605, "uuid": "c46a0f33-50ac-4262-aedf-f5a4f36295ab", "comment": "Malware payload (Mirai)", "value": "fdbeefbc8081aa596105851c83f723de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948605, "uuid": "90b97148-3854-485e-8f8b-0bad8aaa85b1", "comment": "Malware payload (Mirai)", "value": "8375772c1013dfdf563ea28b05dd4ea913cc2584b205a7ca13ab03aeee9fccd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948605, "uuid": "7f412791-3636-46fe-bfd2-b49463aa085e", "comment": "Malware payload (Mirai)", "value": "b44e3591fb898cefdb285665e2364c5bea436ef3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948605, "uuid": "191fb0f4-1fe3-402f-9ea7-ed11fe6b7610", "comment": "Malware payload (Mirai)", "value": "fc993c29d6a222301b5fec962e1c1390c59023a3accddf0b46eb2998bd0a4cd37c831f1499d9ffffbe31569d12916bf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948605, "uuid": "8859f948-e64d-40db-9db8-bb1c3ece167a", "value": "T1D4D33C46FB818A13C4D517B6BAEF414933239764D3DB330699189FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948605, "uuid": "c83738a3-89c9-4ed4-a6ca-c51b00df3084", "value": "3072:YWlsiaG9MeJH001AlhYWN3rQcUnHcxCN0+M/9tkMsm6W:RlsiweJUaAlhYWNbQACNVM/9tkMsm6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948605, "uuid": "e6773518-f449-4591-9068-be3e5f7461c7", "value": 136686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948605, "uuid": "e2cd5db5-845c-468a-8a6e-b17c85b660fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948605, "uuid": "caac27b6-ddf5-43f9-8a11-fb013f93c275", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b4fe0e-badb-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1677968720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968720, "uuid": "adcefc5e-da8f-41bc-97aa-f9295a0757db", "comment": "Malware payload (QuasarRAT)", "value": "2e8dde7817c9438c831c39d470507dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968720, "uuid": "7d52ea29-6b61-4904-a5cd-b82e03bbd1cb", "comment": "Malware payload (QuasarRAT)", "value": "8386ce0e691153f7de97e4903b8b9955beca49b1abfd1f3b5613a77f4073f4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968720, "uuid": "47911bbe-5eb3-4ab0-b6f5-2c6ac5d55a6e", "comment": "Malware payload (QuasarRAT)", "value": "34bc8c79ddf3960c9a6a6604e9d8293b685a2fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677968720, "uuid": "e494d042-0999-4616-910d-31a4f24b3b63", "comment": "Malware payload (QuasarRAT)", "value": "8881ace2d2034d29025406146bce963edcede43a9aeed23e343aa6b23566d6895fac7dfda4130bc33151ac92585552c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968720, "uuid": "93b828a4-79b1-48f7-8d34-bf7c8e4908cc", "value": "T154B46D4063F8852BE1AF577AE871042597F4F407B2ABEF4F4A40A1F92D66706AD80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968720, "uuid": "df1c6c8a-73d4-4383-be50-2e2851b4443e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968720, "uuid": "f6fe81f7-dee7-4bea-9569-d64a568eae00", "value": "6144:RTEgdc0YWX7IxUpGREWVwGzubzjKlh/EKpxwQHocE0Db8F9v+xPo8hf3cTR3e:RTEgdfY3xUKwfb0Rxwk44O8hf3cde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677968720, "uuid": "5932db68-c424-4c00-944b-b47ca1615a18", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677968720, "uuid": "900fb953-a4b7-4c63-b526-04c616a8ce9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677968720, "uuid": "7204f52e-30c7-4cd0-893b-4519788ec94b", "value": "8386CE0E691153F7DE97E4903B8B9955BECA49B1ABFD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a631e1-ba34-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677896829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896829, "uuid": "c59692d6-1cb2-4c89-9a38-0440833b9c3b", "comment": "Malware payload (Mirai)", "value": "f1422210a1d020e9a2bad6e0436f5b03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896829, "uuid": "5cfe2ab9-7b4c-4109-8d81-50ba446c490d", "comment": "Malware payload (Mirai)", "value": "8533b4606bc1c049de0b20c63f25c3fb2237ad29c061112c6ffc2efb733c3111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896829, "uuid": "70aa0828-0d4f-41e8-a6ec-a3b83d043b33", "comment": "Malware payload (Mirai)", "value": "c5d3148863c0c8791b2656c630a028c47212a976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896829, "uuid": "b6b8983a-df3e-406c-ae72-a15972069588", "comment": "Malware payload (Mirai)", "value": "713c7c701d2b84940d9b852f23e781895a94e4b9960732081b21f23fc311df65236713ebaf78a55f2c7b1f8f30248061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896829, "uuid": "20cc4db9-ecc7-4ec7-9928-f470f207e79f", "value": "T188D2E0C8674E49C5E3D2603C27D407513C621BAAF2838C173596B7C3DE9A29233A71F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896829, "uuid": "145b5f52-ed12-4de5-9668-a0603db4d19a", "value": "768:fauqnAxWZW/Uvxy9HrXrbSCZ+ssxLj6DrEu+OefTlzFVfgUYwJgGlzDpbuR1Jq:fauqnPW/Uvk3bSCZ+LJ+DAu+fTJFdr//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677896829, "uuid": "ade933e7-b95a-4d11-bb45-cfca1a1af900", "value": 30084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677896829, "uuid": "75730094-173b-4f3e-ae33-83a25d2b9d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896829, "uuid": "5aa320dc-08cb-4f35-9b7e-0fc47a669b60", "value": "SecuriteInfo.com.Linux.Siggen.9999.32607.593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d066348-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908957, "uuid": "01824d3a-0b85-44a3-957d-a0c5548bfa6d", "comment": "Malware payload (Mirai)", "value": "1657d45db2cc1c38919c2b43e8b8e50a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908957, "uuid": "e39f3e71-6a26-44af-9b16-7ce923302960", "comment": "Malware payload (Mirai)", "value": "85afbcf3fbce5b6acb8ecfc755f87312461960740463ec019975ca5ce041aa4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908957, "uuid": "397a94f5-8f21-41ac-8e63-7e7929158f5f", "comment": "Malware payload (Mirai)", "value": "d9abfd4d3e9a3a17395c651db7fe510ea8ab47a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908957, "uuid": "cb331b3e-f4d3-448d-bdbd-0ca98778b1b2", "comment": "Malware payload (Mirai)", "value": "727379d56b2b11693aa9205cf1756fe9eb3839066d77ab2c5b15ede00a108fee74cdd2baffa1e6e6355077cd19dc458c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908957, "uuid": "c51b058f-f60d-49c5-991d-2b2b6417f918", "value": "T1B6A3074AFD829F10D4D522BAFE0E018D331367ACE3EE7112DD116B2577CAA1B0EAB551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908957, "uuid": "3be417fc-5da1-43a6-ba74-5040462b9c52", "value": "3072:cvyvBDjOLK24C8WQmQaTYIS0UtWGhYr91XSwbZnI:iyvNjOT4C8KQaTYIS0UUGhKiwRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908957, "uuid": "d2f6fa91-1598-4ef1-b76d-bae2514d5392", "value": 104588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908957, "uuid": "310cb5b2-8e13-4a24-8fe2-4ae4d88faafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908957, "uuid": "a5e92716-fa7a-4874-ac72-5a5b19cadc57", "value": "1657d45db2cc1c38919c2b43e8b8e50a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3459f5e-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922013, "uuid": "1cff9632-cdd9-4406-978b-b626b2dee1aa", "comment": "Malware payload (Mirai)", "value": "3c775ecfbc355122daaceede4e92839e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922013, "uuid": "180fe440-44e0-4cb1-a0c9-96519cf77e7a", "comment": "Malware payload (Mirai)", "value": "85ce08d29e5003be3c3f405f133e21a2c4ac002d76da8fc5cdde9adbf87e1266", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922013, "uuid": "f69566db-dc82-4bb2-84e3-c0b4eb875be0", "comment": "Malware payload (Mirai)", "value": "b594f70ae84cc5c46428c632388eb5dc48daffe6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922013, "uuid": "c20d4955-f36e-4c7c-99d7-832380c715c1", "comment": "Malware payload (Mirai)", "value": "d1dc0bf72c4dd1748403fdda17a233275805b8b7449f95e92d50b5fed18168fa2ae6e1f70bd5fda15ae1f0e30e4d69ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922013, "uuid": "b0683118-95db-4cb8-b7c3-23321d2dfdf6", "value": "T1E5534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922013, "uuid": "53d781f6-94d8-4536-9f10-2b66f2c21d65", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQfLiKimfFoktCe3fYRMF:WShU3q7cEDlCK/0DX9i8Fok06fYRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922013, "uuid": "ee7d9045-e13a-4cdd-b634-163ab08c3f5d", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922013, "uuid": "981ec168-4cf3-4ff5-86c6-b39b282fc6dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922013, "uuid": "a8b45bac-2c4a-4b42-8eab-27bfbd501db8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb8aa57-ba94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677938405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938405, "uuid": "36d3e1f4-6f2b-41ab-804e-d060d62519d1", "comment": "Malware payload (Mirai)", "value": "a3769fe2e6bc71d05ab75f297fbca88f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938405, "uuid": "0627a447-8f2c-4fe7-9c3e-3fe856833142", "comment": "Malware payload (Mirai)", "value": "862028cecf24cc2c74d3ebc987a8899f1db6b7faffa51e42d9e8a43a8fcd0282", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938405, "uuid": "01301d3c-02eb-4e97-a38c-13f46085b7a7", "comment": "Malware payload (Mirai)", "value": "4af3c22fd3c6cbce3141080f53d4425cc55e6ecc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938405, "uuid": "18c72d72-3349-4554-b0ac-e90624e78b73", "comment": "Malware payload (Mirai)", "value": "652f64052b34f29daed428b16b7e7a3ec1739a4182fb55e803e1e426919abc0a1b0c9ddfda140bdec37a58efe5bcfe46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938405, "uuid": "10376149-654b-451a-8371-5a78b17ac5a3", "value": "T11AA2E1B8739AA533DCF8B63596CC664B112217C0DF4F5625B0BB05C774C11CE8576698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938405, "uuid": "2b299fa9-eb7a-4839-9adc-2bb9eaba4e07", "value": "384:Maq9ip8ZK8mJ9Tn1gNqEjdZHR1VhdTGxw48xymgu6b8uU54R+tKaOLftxK1U09v8:69ip8NmJ9b1gLbVhhGxnmgLb8uB4tKao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677938405, "uuid": "73cd3892-8bf7-48a2-8e8f-d91229d651b3", "value": 22652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677938405, "uuid": "e715c83b-c1ad-4921-bed3-14a38ae8b5c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938405, "uuid": "72c7eeb0-66d7-45a3-b3fb-d69942a7b433", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f09cee-ba94-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677938125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938125, "uuid": "fe8f8655-b3d5-4952-928e-a4924e9640be", "comment": "Malware payload (DCRat)", "value": "95ab394be5e00fe35edfac9cb2c4473e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938125, "uuid": "c58d4824-b936-4c4a-95a5-6e5dd8b54da3", "comment": "Malware payload (DCRat)", "value": "8700fceec376da68a9fa73b1e17ea8292f520c7011b8005b7057b016dba1b43a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938125, "uuid": "bdf7c74f-9953-4393-847b-f82226a6a3d5", "comment": "Malware payload (DCRat)", "value": "e927a274aad606c50d7b13d5829b4884014ab6a3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938125, "uuid": "a5e17062-0c16-44af-bcf1-ba2f97f248ff", "comment": "Malware payload (DCRat)", "value": "1ef71e90ff707a2f8f953e75d5f0cdc931eefa8a74d9b1065e83bfc2d3b8f2e6f9f8d57bac93631e82f804139a4dbef6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938125, "uuid": "4e9cf5ef-0da9-435c-a268-8e61ea7d3fec", "value": "T1D7B5CF017E84CA12F0185633C2FF854847F4AD91AAA6E32B7DBA336D55163A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938125, "uuid": "4a2487bc-96ff-4bd9-a1e2-487b4645ff36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938125, "uuid": "bb13706f-17e8-485d-82c1-0e7a3b766511", "value": "49152:PHkAzgeLwGSIRjV6qgLI0fLNAiHZaCN24L+JyWb:PH9ce4OoIqucZ1NFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677938125, "uuid": "090eee02-bedf-4451-bd38-fe73a1f3c36a", "value": 2444288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677938125, "uuid": "4891031e-13b2-4db5-a7da-b3fbce76d788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938125, "uuid": "134981f4-972c-496b-875a-7896d1f3a8c6", "value": "95ab394be5e00fe35edfac9cb2c4473e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41fcf24-baae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949610, "uuid": "2b2fe4e2-a317-40cf-91fe-2caf2029e106", "comment": "Malware payload (Mirai)", "value": "721e184d75e37dd5fb8739bbf4c17d98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949610, "uuid": "b768a9c5-577e-4adb-a70a-5d398fbc4725", "comment": "Malware payload (Mirai)", "value": "888ae654efcf89626251c64ee7ec16bbefe7862cd294a09b7aba5b4280695a3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949610, "uuid": "ff0bf27f-c7a5-4d48-b4cf-3062d02bcc48", "comment": "Malware payload (Mirai)", "value": "beae88b23d7933d47ab940f048baafa0ef1903e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949610, "uuid": "ac746160-3ed8-4341-9f26-eb85e1be5587", "comment": "Malware payload (Mirai)", "value": "de91df4fb1515be435c03f5d95ecc1ede9710a6f4f25c85081e578565b77d381c2238d035f04d3252a788f24458b0727", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949610, "uuid": "7b77b06f-5d92-441d-9a14-703d223609fa", "value": "T171331895B8819A17C6D413BBFA2E41CC372663F8E2EF32079D211F15778A82F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949610, "uuid": "54b20b34-a6ac-47e1-9a36-5716d6956b45", "value": "768:IjEShTLJb/yer47bWC1aHKRMTAJoeo9IZRTcSPvt5YI/NPWB4zSrzJV:lSdLcbWlqRM2ov4RTcavt5YIIBDFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949610, "uuid": "26598811-72c4-428e-b797-0627c0912d2e", "value": 52972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949610, "uuid": "69ee9e66-4bbb-4171-b7af-0e27462e9ff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949610, "uuid": "958d2d47-b9bf-4f3f-9b87-7305f076ff1a", "value": "721e184d75e37dd5fb8739bbf4c17d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff3d9cb-ba72-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677923725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923725, "uuid": "ad4aa9fd-b492-4efe-844c-4598248f0b74", "comment": "Malware payload (RedLineStealer)", "value": "4a23dd10d35552b67e066f3b2320ff98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923725, "uuid": "32f70a35-d212-4e4e-90ae-492183004695", "comment": "Malware payload (RedLineStealer)", "value": "88ff3188910b8a994dfbba135c7714c16c70a09dfaa0cef2fc2defd28a602311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923725, "uuid": "5a725d9a-9932-4dc7-928f-a0759e16fd6f", "comment": "Malware payload (RedLineStealer)", "value": "dab473984fa3f51256e258ab01a9b47e0062ccb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923725, "uuid": "0e2d10c6-08c4-41d3-9864-e88661b0cc17", "comment": "Malware payload (RedLineStealer)", "value": "b129d662bcda17bebe79b6309b437548d24bc447439b660f55210043f18bb9deb3605c138fe241079cef8e801807a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923725, "uuid": "b33b964c-dca1-401a-8d31-832739e11394", "value": "T1A4454A7DF3938431FBA63C308794DB2349AAE82C572557E773444B682A2C6D1A23D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923725, "uuid": "a1875080-1a5e-4f32-8035-43cfdf400e7e", "value": "20db1e79c216f1d522f5cd084231f477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923725, "uuid": "9b36ed92-607a-4640-b62c-3bbf73c85f8a", "value": "6144:id7iTt9CEG5ze2YAO671bbbbbbbb06w8huUQnvic:3Tt90kgZLui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923725, "uuid": "ffd9a966-867c-4b47-b0da-64f04a839bea", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923725, "uuid": "0d2cd3d0-dddc-4d50-bbc4-218b3bb407fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923725, "uuid": "37cffffe-9ec0-47b8-a537-25131105673a", "value": "88ff3188910b8a994dfbba135c7714c16c70a09dfaa0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cbf80d-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677917023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917023, "uuid": "552f39e9-bc5c-4a80-aeb3-8e07e6e8707d", "comment": "Malware payload (AgentTesla)", "value": "9abe5d247b821f3ed0c02b89ecbd2b00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917023, "uuid": "87a35ade-f46e-4549-b9d3-f91bc643ea90", "comment": "Malware payload (AgentTesla)", "value": "8a9f60c772d34e86904e09695233a02ae23708dd772f6fb10a754c13073813d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917023, "uuid": "52ae7930-f8db-4f25-aa1f-806429a54352", "comment": "Malware payload (AgentTesla)", "value": "a29d9b258671ae80243e1060fa6898d34054986f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917023, "uuid": "5d8ef2c7-48b6-43ea-9449-347093417501", "comment": "Malware payload (AgentTesla)", "value": "8afe96fad0591af9591c2bd647d2aef51237bb211f149aca020d1200f21399ba05928191211a88b57c43e2f7e981b614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917023, "uuid": "9e407ae0-eaaa-41c1-8c81-9ec80a540ec1", "value": "T1B745972808FC0AF245B1F1FD9FE4E753BD8488E6A6049D99C2838B89555395720EFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917023, "uuid": "e90a0fb7-adc0-4429-99fa-45e6ad4d4272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917023, "uuid": "a766d164-6602-4d37-b107-371a02ebf617", "value": "12288:6iMOEAlI3MzSSV93YMnf6l7wmtqMk0BWOuvbusrdClEdPM3oZEx:6BYdSSMg6ldgaBWssBClExCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917023, "uuid": "6053a29d-dd33-4837-be4a-1004466f1046", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917023, "uuid": "da95de01-907c-4ffc-9aaa-c750846969d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917023, "uuid": "39b85f72-fcef-44ca-b227-9ba9183c2f79", "value": "9abe5d247b821f3ed0c02b89ecbd2b00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c641ea-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677916347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916347, "uuid": "63b7b591-04a9-4935-8b40-f8e38ebcb215", "comment": "Malware payload (GCleaner)", "value": "c2b789418aac48cba417fb716c3fd796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916347, "uuid": "a503e652-7cce-4d6b-ae38-30ee4339eb1d", "comment": "Malware payload (GCleaner)", "value": "8b98ab7c2c0c1b05603f3e9c580c0f71e9f6737f3d5a99d4777d945b14d1e67e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916347, "uuid": "7d85926b-c24a-4774-8599-7d14ed7ed601", "comment": "Malware payload (GCleaner)", "value": "3288dfa064922855033d35fcff773dc1a03e4ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916347, "uuid": "344fe112-273f-4c0e-aca1-f14f8d3d400c", "comment": "Malware payload (GCleaner)", "value": "42faba16950d40ff46c1e692a1ddb29df025500f3b789a730b8c622146b610e80d51d843267e8a62ea264892f11ef68b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916347, "uuid": "5bd2eed5-37ee-44e2-b022-f47c193d37f9", "value": "T18354D03172E1D876C0722531CD22C2A55A3FBC239938959B37983B2E5E703D1963E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916347, "uuid": "893b87ec-3d81-4926-aa4c-d72b0dca19d0", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916347, "uuid": "cf04e077-d6d4-48f8-a826-1390a811e7a0", "value": "6144:ofkEUIzKUzqKjPvwIpUKSCNxDGD1BmH8d8xXj:ofkT29zqKjI0S4AeASXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916347, "uuid": "673b92e9-bfca-49b0-80e4-f5d2fc043b6a", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916347, "uuid": "d339ae22-e52e-4ff8-a49c-8ef313675efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916347, "uuid": "bf251978-e32c-40c4-bad2-9c9f5faa51fb", "value": "c2b789418aac48cba417fb716c3fd796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa071efe-ba78-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677926427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926427, "uuid": "9bd7f465-1521-459b-bee3-1be8e88b9609", "comment": "Malware payload", "value": "05c1042c7dfe7b64efcfbcf76656a71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926427, "uuid": "52ca0323-abc7-4ccb-99c4-4a157466f246", "comment": "Malware payload", "value": "8cddb13beb02bd705fa2497dc29cf5cd336b8de6427716aec08e867694a1a519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926427, "uuid": "fdb10904-efc7-45d8-ace6-1452bfba439a", "comment": "Malware payload", "value": "dd0c0755bd5fc9fb2492130ba633a267ad95daa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926427, "uuid": "3a53774b-dc74-4af4-b02f-c19fcf891004", "comment": "Malware payload", "value": "690d26a817c5c00f97f985269433beff44eddef80549ee6f7dadd4396f149b4e81822cd86f7ed44b3a66dc105f5ed464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926427, "uuid": "971d0745-9f83-482f-9777-2f92b48c4328", "value": "T1D5E6332661FC0051F476483AA16BEE6DB1FF4E230589D8BF52847DDC6832EBB192147B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926427, "uuid": "19a14461-a662-4bcc-86ca-97bfde30f0e5", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926427, "uuid": "9a116997-e09d-4d95-b8c8-652619f1a89b", "value": "393216:FtnqhPeUX0kLX/wCAYp9bFCJmow2Lv0FR:jqB3X/w0HJgvji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677926427, "uuid": "25dd6246-8a14-4b6b-9bff-b006975acedd", "value": 14039564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677926427, "uuid": "a3037d93-5907-4e91-907b-b7f1f6cab23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926427, "uuid": "02350a0c-a04e-484c-8796-e197c1dd5b30", "value": "AppSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f65df43-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908907, "uuid": "8f6820f2-4b44-4521-8fbe-3181d2823a0f", "comment": "Malware payload (Mirai)", "value": "faedf13035eb4107509d88b5e32245fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908907, "uuid": "d00a52b4-caef-41d3-999d-fbe8e96aa97a", "comment": "Malware payload (Mirai)", "value": "8d8774df6c57d1b33ddfa1d411de6f309e76240d3e498eec6fb64643130da376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908907, "uuid": "b5b23dce-5686-4336-afd9-36eb703ffc24", "comment": "Malware payload (Mirai)", "value": "5d42abc5b58f169ef91a73ce826f379626ad4462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908907, "uuid": "947bd588-a7e3-46f7-9dde-6073a1cb1580", "comment": "Malware payload (Mirai)", "value": "fa2fa5b7bb7195663320a4d44bcf2a624d0f5c973c7a7bb7ab6d794485e80dbe3580e36d9dd033251121b2e27c7ce81c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908907, "uuid": "1cc45854-bcf2-4707-97c4-152ec7353f9c", "value": "T1D3A3B60AEF610EF7E86FCD3746E91B0A348CA40A22A83F757974D828F65A14B45D3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908907, "uuid": "b303658b-6932-445b-a38a-9a6a83308102", "value": "1536:EDVrZPPl6yh62lhvohNUcZwdBZExdCBw5j4Zlfxa+9YvwbZnK:ED9ZPlph6gpKUcCdBwCGN4jSwbZnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908907, "uuid": "27709427-367c-43ec-bd17-9c1f813aac6d", "value": 100884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908907, "uuid": "fbeb19e6-0620-4eed-9353-470b0106a752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908907, "uuid": "15ca72d0-84db-4d78-8a9a-cab844c95c84", "value": "faedf13035eb4107509d88b5e32245fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389a94c6-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1677917083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917083, "uuid": "467806ba-da6b-4e9e-9e57-a26942e8c858", "comment": "Malware payload (N-W0rm)", "value": "6260b9579234861e21069cc94a9dd3c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917083, "uuid": "daa63ce3-3d6a-4ece-add2-ac16f95d45bc", "comment": "Malware payload (N-W0rm)", "value": "8dbfa6809f9a52d74ffa5bb373c588da4dbeb0ae2c8769e7311610c53826f812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917083, "uuid": "3a3caa4a-7af0-4cd5-8b9b-d0dcb53d9320", "comment": "Malware payload (N-W0rm)", "value": "1ab82fe2779a2c4d659365c1dde43c456408b67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917083, "uuid": "614cfe94-3f05-4cf2-a1b9-0339a75c9d8b", "comment": "Malware payload (N-W0rm)", "value": "f8bcfc22a511fc22387874ba07c1ff05e539cd0eb69eff8fd061574b67a8ec5ebeba9f457574c18c1840f2ed31bde9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917083, "uuid": "e35cd628-3c1b-452f-95fa-6c09594e58e3", "value": "T17464E130B2D09871D4B21531D9309BF85A3BFC62693859DB3B88372F5E712D09A6E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917083, "uuid": "e7c7dfd0-ac20-41b6-af57-e1311e6cd74a", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917083, "uuid": "48a0af3c-21ff-469c-a07c-c37e293786bf", "value": "6144:tw0SUZoOoQ/R4igFWKihNcy+IIpf5cBQaTIwMPeAZlGkMN8j:tw09udQ/RIFWxhN6F5c3kvHZQkMKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917083, "uuid": "483ee7e1-373c-4df8-8856-37e08358ffd1", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917083, "uuid": "f0ea820a-9e8e-461c-97c8-dce71443fc9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917083, "uuid": "e3d838c8-e0ea-4901-b468-74e8fc0299e7", "value": "6260b9579234861e21069cc94a9dd3c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab961a88-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930590, "uuid": "13a6a875-e758-449e-b044-0db16fcf8d89", "comment": "Malware payload (Mirai)", "value": "a4d14118bc79690c6b7bd3be89070e9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930590, "uuid": "0c05f21a-06af-4a8d-ae58-56b2cc934118", "comment": "Malware payload (Mirai)", "value": "8dfbbce10f999bd6fdf11b95a99a975f65c38bbb5a9b4f8244553a2ff05149a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930590, "uuid": "141c2825-0c32-4f31-a7b1-f119f633fb38", "comment": "Malware payload (Mirai)", "value": "3110cbe8c3bfe478538fe509f6b9f8b6d84f0705", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930590, "uuid": "9f38041c-3a8a-47ff-a8b0-1a23794a0b79", "comment": "Malware payload (Mirai)", "value": "c2c931d61e77d378d65ff922459cc0879d23f5113c8683e532f08cbfd97f2c62469ab2d2206711bba79bcc3596431392", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930590, "uuid": "315439ba-eab4-4a4c-94e8-860e73a4d1aa", "value": "T1F8436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930590, "uuid": "6ec49d3c-0d44-4e3c-8bb7-6173212956f3", "value": "1536:JeESt/basV2rcZhG6ySN7naftad1zWOIaEjrqMDs:JeESt/basVTgS7nafQdttXESk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930590, "uuid": "3a58efc0-21d3-4202-848d-319cb70a7369", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930590, "uuid": "607ab401-e3b9-44db-a749-751ec0bed1c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930590, "uuid": "424c51dd-2ffb-40f3-a63d-2b1362f1fe4b", "value": "x86-20230304-1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efd8041-ba4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677906517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906517, "uuid": "7ae828b4-8f0c-4b43-a539-619daeddeee6", "comment": "Malware payload (AgentTesla)", "value": "e01d75b2439d33fb14d27208ae11ddea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906517, "uuid": "e8d3babb-d06e-4f99-b5d5-52722333feac", "comment": "Malware payload (AgentTesla)", "value": "8fea022b2f3c3f6f97a8c4ebe93fe862fb731fa82f8d23ac8cd11c21a4824041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906517, "uuid": "25a8cde4-49c5-46d2-b3aa-cfa1cb2424b6", "comment": "Malware payload (AgentTesla)", "value": "5cb8026568c1553fb42c55c8027f8ce556beb931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677906517, "uuid": "1d6af73b-29a0-448b-a692-5d4eeaa5cd25", "comment": "Malware payload (AgentTesla)", "value": "aba3a8500cffcae94800aa07c29f4882cb9ad5fd2ab077cc9f9dca22ef011b771cb98988370f39288179295f05f909a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906517, "uuid": "a6a39a70-e988-4bc5-a37c-86ac9c3a9279", "value": "T15945A82809FC0AF245B1F1FD9FD4E753BE8488E6AA049D99C2834B8D555391720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906517, "uuid": "331de76e-6e90-4ffb-9ff3-baa096ba80be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906517, "uuid": "cf457775-89e2-4f41-987c-620db0c46d6d", "value": "12288:ZPMOEAlI3MzSSV93jzENKbiiMkqVobG9lAaX34ebA1eL4Wrk3Ti7cnhAVW20tG:ZkYdSSPXiI9XaXBA1Ukvh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677906517, "uuid": "4860b345-c4d6-4435-860e-8ce4bf77a7a1", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677906517, "uuid": "e62d1861-b694-4132-84d8-fe0b77b97940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677906517, "uuid": "8b659ca5-808a-41bc-a244-eb0264c1d741", "value": "e01d75b2439d33fb14d27208ae11ddea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce80e78-ba27-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677891535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891535, "uuid": "88bf46db-d00e-4203-b13a-cba1ecc6af52", "comment": "Malware payload (RedLineStealer)", "value": "17bee6caa7abcf7e7ccd644186a96d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891535, "uuid": "37797a84-095a-4274-b29f-9db266f6f55a", "comment": "Malware payload (RedLineStealer)", "value": "9056ef22ee3306ad372517f5824b4005398eb0609b1d5f31dcc1f65b17dceb34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891535, "uuid": "1f057c76-d3c5-4327-ab52-898da7eac5f8", "comment": "Malware payload (RedLineStealer)", "value": "ee66fc07deeac58f2e255aa01b5442b6dc2fb65e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891535, "uuid": "9d4d38d3-dc55-4769-9c08-4ab58a77db3f", "comment": "Malware payload (RedLineStealer)", "value": "3abbcaa84433fba2052b324f2d04c9f75415d4afcc3fb5630d98e22a2c8f6ef3577127d12fc88b4d7600a087f6e1ba3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891535, "uuid": "84acf42d-359e-4a91-86fd-f422eb2334e5", "value": "T1E7E4124BE2EC9462E4B5477049F607C31672BE642B388297274EAC5D0D33A78B636377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891535, "uuid": "044941f2-c436-4a27-9c1c-34103c8ab181", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891535, "uuid": "f4f80447-3cca-4564-a208-643be8d70afc", "value": "12288:2MrPy90i3tNHGE9FTaC6LLjER8Xk5JKOPFnv8aDHPdgPR37Y:Jy5tdtaZLGD/V+aL1AR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677891535, "uuid": "0c892b6b-eb32-4ca9-bd58-88726d2bfafc", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677891535, "uuid": "90fb05cb-1755-4922-ad5d-675f0c33aa59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891535, "uuid": "6cf58b54-aff2-41e6-84e2-8ba965738798", "value": "17bee6caa7abcf7e7ccd644186a96d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877daf7c-badf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677970473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970473, "uuid": "df2325e9-d030-43e7-8b37-7e3daee20562", "comment": "Malware payload", "value": "21e589e46ec5d7319655631f5339e752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970473, "uuid": "9eaba30c-a12a-42aa-b504-2fc296d4776f", "comment": "Malware payload", "value": "907a18a65f606b4c64b48da952e85b3e903072ea15774b503b1a389f3376b876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970473, "uuid": "7d327d64-a189-4d9f-83a9-03c586b4c4a9", "comment": "Malware payload", "value": "2b305494eba6c8874fac64989b76741e54bfce70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970473, "uuid": "340f0e0f-1dfd-4158-9bd9-4c96f67208e9", "comment": "Malware payload", "value": "0080ed9d2ee8092e63c1090d0f882945bf9df08cf34a742b530c274abc33c20bf741773288ea02291ad1c46e18b9b8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970473, "uuid": "840b4a6f-5ed0-4618-b939-701bf6fa87f9", "value": "T1EA838C02E2F641BBF49357B2A5F38597C7B5694D12980E0BBBC03E6A5823006F506FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970473, "uuid": "1ad0f51f-623d-4586-ae36-613680f4f309", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970473, "uuid": "50131592-1599-41e6-9f8f-e773f36a47d4", "value": "1536:6QpQ5EP0ijnRTXJIQIQQQJQSOb4fy56nwQX3CGDxrfn31Yu8hymD2nCHvHJzL+pc:6QIURTXJIQIQQQJQDb+y56nwQX3CGD9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970473, "uuid": "4a5c8f0a-e67b-43c2-877c-1e5b9cc33e27", "value": 82810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970473, "uuid": "082facb5-35c4-434b-9533-15e6b64348b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970473, "uuid": "cd565e1c-76ca-46f7-abea-04c4a87f4685", "value": "PhotoshopCS6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c4e811-ba27-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677891546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891546, "uuid": "186bed5d-3208-4921-b5f8-59d287a711ee", "comment": "Malware payload (Mirai)", "value": "aa6c2434087f1abee204471b6a6a39bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891546, "uuid": "675c3c1a-8142-45db-ba0b-abb7968af928", "comment": "Malware payload (Mirai)", "value": "91c7e5f0a360425421e6e2d7b64eeb81a4f7d12e2adf8b11eaf19ffcf116cc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891546, "uuid": "6e2bd3a2-eec0-4b71-a24b-400e3546748d", "comment": "Malware payload (Mirai)", "value": "90d005b86ab0a37ac0d54b96491a18976e0ba02f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891546, "uuid": "307a2360-99cf-440d-866b-d3bfe12f452f", "comment": "Malware payload (Mirai)", "value": "4d03578e1291f6d1faa879464413719bca9d9cd0ac963cea378b9405fe3667f8055cdfd4fca945cdef3129b28a001e78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891546, "uuid": "2056fbc6-5023-4349-9aa3-6b339b232a41", "value": "T12EE2D0AEF1B9B8C6CA992977C18D53493AE0D1F027985F5C53600DC8726CEEB744B4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891546, "uuid": "f5e5091a-4c87-4629-80c1-78bf15784f2a", "value": "384:FmOHKWYdDOHNsTj6VsSaIeNdpgd7m+zwzgM696kM88A5Lme2L0clHvbieFmiH+P2:YOHKvgtq+6S/AgdmrBkNlWFPl/UXWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677891546, "uuid": "7f966855-a02d-4434-ae30-ec4a13635ab3", "value": 31156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677891546, "uuid": "90e93020-9b48-4487-b8da-bc511a13b5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891546, "uuid": "3083ef22-502a-4bbe-8d78-c9ff4b081779", "value": "aa6c2434087f1abee204471b6a6a39bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f07b85-ba45-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677904385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677904385, "uuid": "170ea2bb-af45-406f-9676-4637081d77cf", "comment": "Malware payload (RedLineStealer)", "value": "2441174cabf9e14f7e01977105087a65", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677904385, "uuid": "c29bcc2f-f2f8-42cc-9d82-717567912618", "comment": "Malware payload (RedLineStealer)", "value": "92df7deea6b7d758f0c0a60a87c68de90e40fa07b3e261bebe7a5a48541656e5", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677904385, "uuid": "2380c17e-0e5b-4b0d-9016-24c8aabba1a4", "comment": "Malware payload (RedLineStealer)", "value": "b7ce96399a1264514abe4296696b36f3c1ae2c93", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677904385, "uuid": "2e2699c9-8299-4e95-a25d-c93992ca877f", "comment": "Malware payload (RedLineStealer)", "value": "dc7af134b50c6b7a4206b3df51372490646fed8f9afcff40c7b91cada189d799a5b379eaf967f64145380c58707cd53b", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677904385, "uuid": "38a65192-e0b3-4b94-8f9b-9c388c2b08bb", "value": "T1A5C6333295FABEAD04F946730E9334DD97935EABF589126105CD83C4E58B8FE63E4820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677904385, "uuid": "218459d2-e339-4d4a-b54e-168f6c3e3284", "value": "196608:vEnvo9nCSgIK1jzhHYgzRSnyyL3v7QrNHlThEP89vH023zW0VwLK4h09845yjb:v4YLg5zFYg92yy7zQxHlTh689vH023rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677904385, "uuid": "f15896a8-7365-4264-b099-9eebda58adf7", "value": 12424590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677904385, "uuid": "9c561216-e7bd-411e-94b8-44403b96ac72", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677904385, "uuid": "d553d782-5bbd-4dbf-92d3-2126163ca87d", "value": "PureLand Metaverse.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58c4d25-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677916917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916917, "uuid": "df538255-520a-4680-a55c-400254dd394b", "comment": "Malware payload (RemcosRAT)", "value": "039a4fb345d4835186330ec90fe7546b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916917, "uuid": "8846a65a-bd7e-4ec0-b286-7b9985bb3122", "comment": "Malware payload (RemcosRAT)", "value": "9367f2fed062c994290b2eff35d3560ead41338e9879d15ec49df4c7e8acd358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916917, "uuid": "ba864903-2c4c-46c1-a8b9-d8e7e5923b08", "comment": "Malware payload (RemcosRAT)", "value": "c4d7315343ab3105971cfc394f1411a9bd541e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916917, "uuid": "dcce1212-e19d-4241-aa4b-b973e63d81e8", "comment": "Malware payload (RemcosRAT)", "value": "59b224d85990f30d29787a7563238af8850a0afdc69b00f530f479d5ddb785e1da7933aa141c0c1cc51d540c29329f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916917, "uuid": "55476d14-def0-4516-995c-9822c0244a5e", "value": "T10135872809FC0AF245B1F1FD9FE4E753BD8488E6AA049D99C2834B89555391720EFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916917, "uuid": "35b63ff0-ef67-46ae-aaa2-5adaeae4af13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916917, "uuid": "3b2107f4-693c-4751-aefd-8c732bcfd2d8", "value": "24576:skYdSSgDDhccRCL4VirtZgKZEq9G+SsQ:Ed6XhccO4VixKGb9Sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916917, "uuid": "ba56be9c-1502-4d3c-82d9-602a8be79dcf", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916917, "uuid": "a04369b6-867f-4978-8416-c33b9e81a359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916917, "uuid": "67a82d5d-22af-4d5e-b974-ff792a42c6cd", "value": "039a4fb345d4835186330ec90fe7546b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07143570-baa7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677946205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946205, "uuid": "09d62763-414d-46ba-8908-4d6db99c9512", "comment": "Malware payload", "value": "542276ea0276e50eb956a5e4f278c16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946205, "uuid": "0a738959-3e35-4136-a9cb-9310b8f4339f", "comment": "Malware payload", "value": "94001baebf1a0ea64558c6c9bacbbafb53dfeba3ba96094f09ed52b497363a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946205, "uuid": "f8b9fdec-9895-4e9a-bb85-a1265fa36feb", "comment": "Malware payload", "value": "fffc9b0814abc854466ff0e494a83c7cc81c1f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946205, "uuid": "2b0d308d-51e8-402d-9e7d-aade105d3db8", "comment": "Malware payload", "value": "505e4aeac17247593df81a846cf040737efaf57c47655cb43bd5c12ceab0b419cd20fdbc1d31be3439ac096c574f81dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946205, "uuid": "f6c3cec1-c4e0-4d60-9058-8b338959ecb0", "value": "T1E9341201A3E4D473D4F38B300E795737ACA2AA235464639F531027793A33656DE1F7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946205, "uuid": "5271776a-ec91-45a5-954a-4aa62843b61f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946205, "uuid": "d4fccca9-6638-4ecc-b67f-4d981177efa4", "value": "6144:TYa6Zzl33NJppDAw+wuJ5vqkAdjTFmaUWxhG6+UsviR:TYTpNJppcwcJ5ykXaz0jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946205, "uuid": "c6bc3517-3960-4178-971a-001e37632b9c", "value": 248471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946205, "uuid": "4ef25669-4aae-4753-8436-c32dca5c4c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946205, "uuid": "6d350c65-7744-4245-9b21-086da7e2d2e3", "value": "542276ea0276e50eb956a5e4f278c16e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7752c01d-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677916329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916329, "uuid": "f3f15d16-ba7b-485c-b12b-ea659d225710", "comment": "Malware payload (GCleaner)", "value": "67215a65f0750a47be8239b1f0e52ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916329, "uuid": "3ef56c47-8d88-4d28-a491-273126ebe5ae", "comment": "Malware payload (GCleaner)", "value": "9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916329, "uuid": "60ba7cd2-17cc-4d60-ac25-c4e8bb19beea", "comment": "Malware payload (GCleaner)", "value": "c3e13bd46d93894d74fddfda1586dfdcffd836a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916329, "uuid": "135f11e3-5d29-433e-ba1d-801e95c16a33", "comment": "Malware payload (GCleaner)", "value": "71587380b6d93c6f1c70e64f169de5c1ed7b3378ab7d8f71023826808dd8bb71391c559f48f362c88e4a4c3c96cc23b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916329, "uuid": "f19c53a4-4fba-4a9c-a400-e94523b72c16", "value": "T1AA54D03172D0D835E1721930D871CAA66A3BFC626D38449B77683B1F9EB02D0567E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916329, "uuid": "7739c7a2-78c0-44e5-bad9-5d0ff8886e85", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916329, "uuid": "7105b8ee-992a-4d58-9223-d290e4b6f5f9", "value": "6144:9af5UIKNEUtGWCZxD+WQ6WAc+BziMBXn/tz/JExFFtj:9afCvNntGWU1+sWAJ1RJEFtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916329, "uuid": "9a0055d3-f057-4b56-af0d-a0ece1c7ffef", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916329, "uuid": "2274a7cf-668f-44f0-8bce-3b067cd80a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916329, "uuid": "14bcbf3e-3038-44ae-8be3-927c864625a2", "value": "67215a65f0750a47be8239b1f0e52ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd3ef96-ba94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677938404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938404, "uuid": "924cc6c4-1871-41d7-99a8-425425cb49bf", "comment": "Malware payload (Mirai)", "value": "08beddf160bbb8e8ac9cd09e2ca9c075", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938404, "uuid": "5d6c144c-05cc-4111-b06d-de7590688ff2", "comment": "Malware payload (Mirai)", "value": "9743690d979aafcbc5c024137d53bf3c807aca53a26d6b7e9bd703a8f71e4dea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938404, "uuid": "0d5f1661-366f-4f23-a303-c533dec370d3", "comment": "Malware payload (Mirai)", "value": "c50ad59179b53c080de9e8605df68d3675ba016b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677938404, "uuid": "f09dd4fe-3819-4dfa-a238-e41cce3cf333", "comment": "Malware payload (Mirai)", "value": "bbf9aceaddcd8ab0767552675038112cf46c3f36c0ac5032f5ed40484139147b1daf0cc1574da9a104887c92e2d39fff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938404, "uuid": "48bcd010-de1d-47f8-8184-1c77aaf9c2da", "value": "T19A230116178BC2E792B70D71E14A09A3BF723F68C69CA81107169EFCA1F9C7A52B0447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938404, "uuid": "1a187f6a-f171-4aa8-92ef-d3001328077a", "value": "768:zQewZbmXDu2fLhJRUyBqS1l6tJYsuUgEmp2Hbqy7S7pI9q3UELA0p7d87Kn3zrYR:zMb6XLayB7l8msuUgEz7SFxLJRdtfgr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677938404, "uuid": "b9c525aa-99ce-490e-bf16-224228c483d4", "value": 47032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677938404, "uuid": "0adcfedd-9216-4bef-b979-dc331e85ae08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677938404, "uuid": "aee2fc70-b6bc-46d8-a71f-50c99c412269", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382551fe-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908922, "uuid": "aa2c7e0f-a357-456a-a9f9-1af4585170e9", "comment": "Malware payload (Mirai)", "value": "4403f3caba5766f8326d30d027873b60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908922, "uuid": "a8dadcb3-ae95-468d-8608-cc1db9cb1675", "comment": "Malware payload (Mirai)", "value": "9776fbbac3c44c8932f96350711a87f76ebc7291165fd77abdaf272bc3d301d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908922, "uuid": "018f11cd-8d13-4fb4-a82d-910638cce929", "comment": "Malware payload (Mirai)", "value": "07252bfbb2fd0d4b8a9c273ecf2b559bcdc960bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908922, "uuid": "05970175-2a43-4f17-9359-b9e2febdabe3", "comment": "Malware payload (Mirai)", "value": "921f6fbd2580a64c83b1f754d776b8044a0663136f831367cde248deaeba6258e1397271bb5ecfde661a50768e230fb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908922, "uuid": "c58457bf-c7c9-4146-8d73-fb4c55944f98", "value": "T196539E63CD662C08D04989B4B430C63DB793E95181971FAA98D6A73EC807EDDF84A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908922, "uuid": "54c828b6-5036-47e2-b906-7d230f76959d", "value": "1536:Tzke+zIK+o1/zTOXSbbyKX+d/3Ty5GybMCNwbZnNu:TzIIKF/eXuxX4TyPMEwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908922, "uuid": "1027ff35-ada5-4cd9-b9e9-cc1f8fb3a17b", "value": 64664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908922, "uuid": "5b7db811-8003-442a-9754-3835dcde8117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908922, "uuid": "c27899f5-504c-4b60-be48-fa9addc5f9fe", "value": "4403f3caba5766f8326d30d027873b60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc4bff2-ba36-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677897734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897734, "uuid": "e0850d25-9ae5-441a-afd8-0abfb578e6df", "comment": "Malware payload (Rhadamanthys)", "value": "82a92aad9656a0a285167deeaf70c9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897734, "uuid": "499669c9-7275-4fca-a2af-c721af11aad9", "comment": "Malware payload (Rhadamanthys)", "value": "98c37baf4260e7d8356e75e115536d22a133a1c38d97b345de193c4f281fb023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897734, "uuid": "fd204e73-7c5d-4040-b1de-e78af8f19dad", "comment": "Malware payload (Rhadamanthys)", "value": "26b5ee22ba30fa02658a3ee90ab88bb57ac79d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677897734, "uuid": "87bc1dba-f58c-4f3c-9c87-5f8f0f96b1c1", "comment": "Malware payload (Rhadamanthys)", "value": "b3f59b22d60d54dc7316c588c4c225c17fc7dbd6014c43a6d4533de21aef74292e5ca32eb87da860ba5d50bdf06dc03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897734, "uuid": "0e370274-65a5-4b3e-a8f5-456926b218fb", "value": "T1D634D031B2D3C875F1620936D926C2A9163EFCA3A934A497F7483B2E1DB11C14B2D767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897734, "uuid": "d55428ae-1b4d-4fd2-9b0a-fabb74c8032f", "value": "bb33faca3c22fdf70d184f78a5e234f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897734, "uuid": "335b4d3b-71af-4fb8-aaf8-b574e4366ec7", "value": "6144:4mxaEwLWmG9PtsloLcDI4HlmINMIcC7dj:4sZwLcvslKcDI4HTcC7dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677897734, "uuid": "92e5649b-ae84-4014-94c9-91bc88f61edd", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677897734, "uuid": "fc9451f5-ce5d-4c42-98ac-61d3bc06a0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677897734, "uuid": "7cf02f2d-e2db-4bf7-a891-dcdf330bcd5f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd9e056-ba92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677937384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937384, "uuid": "29518274-5bb7-4422-96e8-468863e4af13", "comment": "Malware payload (Mirai)", "value": "81d430f1806de59708484ebb5e081e2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937384, "uuid": "38e31592-ee01-41d1-ba70-f87215aca771", "comment": "Malware payload (Mirai)", "value": "997f1eee55e95b43cb022695b893370c1160acb427d4a7c5d00f940e8c536b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937384, "uuid": "721047da-23f3-48bf-8b79-80a51357aa67", "comment": "Malware payload (Mirai)", "value": "c0ae7e24097b0651d33ba236345e0ece104f2111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677937384, "uuid": "28c31e30-30cf-49a5-93ed-101514ab28be", "comment": "Malware payload (Mirai)", "value": "46097d37544dca49a776c23c1269763233cd1ed81151e0d34bff6ad6d015541823c7eb75a0519d52af0029f6dfc7eb16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937384, "uuid": "8fbdd6cf-d002-4035-92a9-5e1cce2a8086", "value": "T14263861E2E218FACF7AD823547B78E21965837D627E1C584E19CE9011EB024E645FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937384, "uuid": "f2fae278-9fa7-49fc-b8cd-1ce9bb246bbf", "value": "1536:u/Ogc2i9L05qjDcf7kXtIgIhG+DYSz1uQKr524/ak:u42i9LOqjDcf7YtIgIiyQr52o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677937384, "uuid": "d1e2a8d3-837e-4dcb-80d0-203c581d0440", "value": 67936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677937384, "uuid": "37327c23-d3f6-4464-932c-bac25e1bb6d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677937384, "uuid": "622c024a-350f-45f4-acdc-d9c79f6ac32e", "value": "81d430f1806de59708484ebb5e081e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62acf55-baa6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677946070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946070, "uuid": "6dd45a81-b6bb-443a-b90c-392b598dd0cc", "comment": "Malware payload", "value": "19503c594ddfdf38c0c7e059aaf624cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946070, "uuid": "2812d783-fe46-4ec6-ab70-ca9de4d94f34", "comment": "Malware payload", "value": "9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946070, "uuid": "65060424-ce8c-4db8-9da5-c9b415454597", "comment": "Malware payload", "value": "35faf365ab0a99ca884c8a8c6138882cbdef0a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946070, "uuid": "d7d36ca7-2a1d-4b60-8423-5207f0db7f2e", "comment": "Malware payload", "value": "402a19fb95aad2a6840cc9fc457c214a158acf54644bc068653d51f9f0132b669e432fe0726e80eb913a7027e3d3753d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946070, "uuid": "eab674e4-385b-4a27-8685-017e3a8d01bb", "value": "T132549D227798D033D59316308E279B77DABDB8712D214447BBC41A2DAE70AD1FE3871A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946070, "uuid": "62fd063b-b1db-4425-8ced-9fd5cb56bec5", "value": "0d1c7c17a5c1778f16fd872183052036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946070, "uuid": "ffc84d7a-f26c-465e-8396-eca40e703888", "value": "6144:x8zp5MxVCSCyXcgjSEKnQnpTKQ3u03ao3vFv:Szp5MxNdcgjSbQnpTyUao39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946070, "uuid": "c232fa32-ccfd-441c-8828-72a6a457582e", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946070, "uuid": "ce2f9a65-bd41-45e4-8e27-0d3b7f4c32cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946070, "uuid": "0649bbf6-f28b-4493-a3fa-9aa2972b3660", "value": "19503c594ddfdf38c0c7e059aaf624cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fcb335-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677916355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916355, "uuid": "25a4b231-cd6d-48a5-a8a3-3582ce4d8a34", "comment": "Malware payload (Vidar)", "value": "52839742df9da1a99b19312471c531f2", "object_relation": "md5", "Tag": [ { "name": "1234", "colour": "#A0000E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1234", "colour": "#446B7D", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916355, "uuid": "62582b61-c5f8-442b-8467-04361c8f0be7", "comment": "Malware payload (Vidar)", "value": "9b67de2995d92373dfe94a615f0d66bd6969465059b6553a1a187abe80102fc9", "object_relation": "sha256", "Tag": [ { "name": "1234", "colour": "#A0000E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1234", "colour": "#446B7D", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916355, "uuid": "62cd2cec-e7e9-4546-9394-189dec5d685a", "comment": "Malware payload (Vidar)", "value": "eb13c7514f7f42befff9058c5e47c661e72f50bc", "object_relation": "sha1", "Tag": [ { "name": "1234", "colour": "#A0000E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1234", "colour": "#446B7D", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916355, "uuid": "a75f0d95-d34d-4185-9654-ff31a809807c", "comment": "Malware payload (Vidar)", "value": "c22bf7520db44056889a948fc3b4ba2a1301c0e7cdeb29d717c4628ea4b792f04d39db2aa9046057aaebea919342266d", "object_relation": "sha3-384", "Tag": [ { "name": "1234", "colour": "#A0000E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1234", "colour": "#446B7D", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916355, "uuid": "185ac42b-e010-4441-be38-2c6d68df7a5e", "value": "T13E37334DDBAE1277D12A5D7DF5CB930C6AB06F80CBF61D67388C58020A5C8D84AA5D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916355, "uuid": "25d95253-6650-481e-a404-ab9b925a2694", "value": "393216:KiJrTm7kaq1nWk3pm/iGrBvt6qH1pOyxfAZciWbWDMvNiN9ZUU6pGqAJjrEgXt:KG6+1Wk5evvpOy5AfWbLyOUui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916355, "uuid": "68c5ca60-d8a3-47cc-84dc-946deb892a02", "value": 24515549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916355, "uuid": "b2bb5060-83d1-46b6-8c20-598504e8b842", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916355, "uuid": "a31b2a99-4cac-4a6f-8fb3-5a00a06f29f5", "value": "NewVersionUnlimited.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc3de2b-ba99-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677940526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940526, "uuid": "63017f33-ed7b-4ed3-855e-8ae1fb682452", "comment": "Malware payload (NanoCore)", "value": "69d2576767e757ba9d9d04dc16d1e3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940526, "uuid": "bf06154d-b663-4b98-bbe5-700aba323d6f", "comment": "Malware payload (NanoCore)", "value": "9bc60bcffca3e692680f9e12646c8bd3986aac735b3b68c014d7db485403915d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940526, "uuid": "4d09ebb5-ab92-4f67-ab26-9ec9f415e84f", "comment": "Malware payload (NanoCore)", "value": "9643d5455bb9bfb4aeb96c313ad9123c500f5874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677940526, "uuid": "8ec0f72c-85c1-4e54-9225-49ba4e1fe8c0", "comment": "Malware payload (NanoCore)", "value": "38fea643824951c32a0549e72691bf1f596ff6be92dcc88426f48cd20f7f7a64118cb6bacc2b26fbc9f1b0a6937eb16b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940526, "uuid": "a4dbe4c2-f0b4-4e70-98f8-8c8be1a29014", "value": "T12FB57BF18E42FD81DBAA1EB480EC19904C5C2F9B56AC854CBCCC3853BAF5690BADD175", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940526, "uuid": "cdb60975-952d-4026-b3bf-43d133c4b94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940526, "uuid": "a1ee631a-663e-45fd-b8a6-993d89a87ecd", "value": "24576:4zIaYslAFWn9awPUbNGCuNnbJZQgmqNMIOXPBJVIUjk0huv/3JMh:4zWsn9vPeNGFVb7TvM/BPfjk0oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677940526, "uuid": "52b1c13f-6b22-4853-8375-1cd838f39568", "value": 2392064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677940526, "uuid": "f408e1d2-71ea-427a-adf4-a22541b15c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677940526, "uuid": "53380865-3dda-4ad3-95e0-1eff43052e0f", "value": "PROMOTION TARIFAIRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bdceb3-ba54-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677910573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910573, "uuid": "740580a6-debb-4830-b221-ed80e679d08c", "comment": "Malware payload (CryptBot)", "value": "bdebf5e9faa620c7aa177aa42ed35fb0", "object_relation": "md5", "Tag": [ { "name": "bdebf5e9faa620c7aa177aa42ed35fb0", "colour": "#F4813B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910573, "uuid": "4667596e-6385-4063-8c63-ff0653b53a86", "comment": "Malware payload (CryptBot)", "value": "9d825d4d5514d2907a0785014949ac89235c42b1a798c354ec044b66751f59fc", "object_relation": "sha256", "Tag": [ { "name": "bdebf5e9faa620c7aa177aa42ed35fb0", "colour": "#F4813B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910573, "uuid": "43235029-ce48-49d2-9de3-0ca86ca2b9d2", "comment": "Malware payload (CryptBot)", "value": "1dc8053ef958ade7164db212735dee9626f53ce8", "object_relation": "sha1", "Tag": [ { "name": "bdebf5e9faa620c7aa177aa42ed35fb0", "colour": "#F4813B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910573, "uuid": "887e2d65-b9df-4784-9812-460ca13f467d", "comment": "Malware payload (CryptBot)", "value": "51b3a215a62fa9714174c38cb095183b4f41aaa2e38a83fe0d9508b7a7552b48e83e1ee988994b3a9444e357547caf9c", "object_relation": "sha3-384", "Tag": [ { "name": "bdebf5e9faa620c7aa177aa42ed35fb0", "colour": "#F4813B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910573, "uuid": "0af45ac1-5106-4a07-838b-be443d1f67e8", "value": "T15A05F161F3C4D8BFCD5141F19128076691BABFB20450559B33C8BD2FBD381A6B669FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910573, "uuid": "f7e273aa-8389-481e-9fae-79eda95fed29", "value": "24576:v1Mxt5hLFiFMw57enjaEpWCb54PRvzQsWsWEhi8VL1H:29howkCUQ6ial", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677910573, "uuid": "cc130f7c-ae23-44c1-8900-0315cfcf5b08", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677910573, "uuid": "8dbf426a-35d8-40ac-8d71-68a54ca4db3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910573, "uuid": "c039f6bf-af9d-4b68-b314-2abc8c366eaa", "value": "bdebf5e9faa620c7aa177aa42ed35fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b8c28d-baae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949590, "uuid": "6048dbe7-ae36-4797-9ebe-0f2d5b8477fd", "comment": "Malware payload (Mirai)", "value": "c8da6158b042214e8b9afb0664ad6f24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949590, "uuid": "a4f1fa2d-e350-4646-9706-9b421936fcdf", "comment": "Malware payload (Mirai)", "value": "9f338920429a8cf775506be96feda142b47aeacb23ac0d3f01dd7950c3eb9d3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949590, "uuid": "a5b09a85-4613-4a39-8c97-cc416a763d88", "comment": "Malware payload (Mirai)", "value": "b4542a70302d954ccaad4519ef203b529b114af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949590, "uuid": "ffb7c010-5b90-45e4-add3-f6fe7b397dcd", "comment": "Malware payload (Mirai)", "value": "f1fbab5f9ea2dfd61b6b5c1b211779f84d45ef84a61b1b5d49b44db139ff9f2453439f4fcf6e4e19687744b61163083d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949590, "uuid": "00c9e07c-e19c-4a25-a01d-c63bc7e4eebe", "value": "T1BFC34C46EA808F13C4D51776BAEF42453323A754D3DB330699289FB43F86BAE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949590, "uuid": "a4c1405b-1e6e-4a88-a30b-52dd4beb2be1", "value": "3072:ea+Pd4QUEJfL9fU4QPYJEmqclC7Hf6M/9NU7:ea+jUWj9fU4Qwum5o7HyM/9NU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949590, "uuid": "2c4bdf94-b858-4ea2-a4af-1b78e0eebb6c", "value": 127283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949590, "uuid": "f1506b88-debf-443b-b72d-132d4670dbae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949590, "uuid": "474edead-895c-4d9f-812c-f8296e235a1e", "value": "c8da6158b042214e8b9afb0664ad6f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da157e3e-ba53-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sliver)", "timestamp": 1677910482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910482, "uuid": "2cc6e2c8-ac23-4b81-8073-0f5a3baced77", "comment": "Malware payload (Sliver)", "value": "92f4eb48c9fd263cf9eb88fb38a121f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910482, "uuid": "f26501f7-8aea-4885-a2d6-5601b7c9e161", "comment": "Malware payload (Sliver)", "value": "9fb9483c4b5f51906736ddffe7c4faebe924cc7d1a6160043ade31f1bd1f174b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910482, "uuid": "25866df6-4df3-4245-9d4f-280d40a8ff87", "comment": "Malware payload (Sliver)", "value": "d954af3653f4037291cbfc2cd717c00127a402c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910482, "uuid": "c721fca0-6f22-40f0-b6a8-b6bf20e75e67", "comment": "Malware payload (Sliver)", "value": "9843344a75181b9c3ef5186bf4d3f84033c43efe26a303ae95c1c356174faa61c7a52ce1bb3d9ad6178241bb39f08f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910482, "uuid": "8097aee0-1694-4634-bbf5-2cd328ff8ee0", "value": "T10D3712894AE19EBBD91EE07BF5FE094A43318316F62723AE157C5C851A73B071783A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910482, "uuid": "89d003da-304e-4a7c-b1db-722c01610cbf", "value": "6cc67e1b4c782dc2b07f26a430d4f88e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910482, "uuid": "69935a34-c2c9-43c6-9b32-7c5cb2813b55", "value": "393216:x0TOYft9L7Z5XHq594NUzeKxFPAdzMDB6Tpj:x06Qr/HqQNctnCcBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677910482, "uuid": "7fbba682-e26e-428c-b6d8-f340010fd32e", "value": 23577088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677910482, "uuid": "d98a4fb5-d3e7-41de-9d2b-a212a58c42d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910482, "uuid": "60a90289-afa9-4765-8b65-2e8a12f50106", "value": "92f4eb48c9fd263cf9eb88fb38a121f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78007e6-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916974, "uuid": "70d21bc7-269a-48d3-b7a1-e2cfbc853e94", "comment": "Malware payload", "value": "9aa0e6408529faf59aa8bd47db5d7f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916974, "uuid": "c3fc573d-6eb2-4a24-8d49-0ddcff04fcbb", "comment": "Malware payload", "value": "a01ec2d63ee3e6b00f454b89290b1bf2b4c4ae5aee078976dc26f71c7851c8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916974, "uuid": "413d0fe0-731a-4420-8f52-6e00270ac47e", "comment": "Malware payload", "value": "c0a461e964b6ef4a54a090a4ebf5f0855a13ca0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916974, "uuid": "b0f5fcbb-5725-44bc-803d-34893fa2890c", "comment": "Malware payload", "value": "eee795bd37735cef679122face9579d048399cad892e9e85a637f883539b03d8e355f0caedc8a8efb3ae83adfadb74cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916974, "uuid": "8086ca4e-c306-479d-985f-ace59eb0dc28", "value": "T16B06AE22FE419C32E6730230796AF374E5BE742847394ECB97808B68D9A15D11936F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916974, "uuid": "70e3aeb4-cdc9-4e0f-8e81-37fa9a57eaf5", "value": "98304:4EXRE318uCANuoCjOeiyca9mLWXVl38NBO/MmtpHRZZ+hq:NANt6OPqXVumMmtpH7Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916974, "uuid": "a7c14b16-79fd-474c-b3c5-d647adf8aecc", "value": 3760982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916974, "uuid": "ca1d6462-937e-4f91-ad2a-9fe93ae18f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916974, "uuid": "b9d61b15-0ec9-46fa-82bc-67647421c557", "value": "9aa0e6408529faf59aa8bd47db5d7f2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df455b20-ba53-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1677910490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910490, "uuid": "87f6c703-e3f8-4fb8-bd87-279c12172000", "comment": "Malware payload (CobaltStrike)", "value": "8d6b5daa3dbd2cecf334e1daef15674f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910490, "uuid": "3885a6c0-d376-439b-a888-325e67f9e397", "comment": "Malware payload (CobaltStrike)", "value": "a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910490, "uuid": "9f7808a5-b6bc-4092-9eb9-c98aa604120e", "comment": "Malware payload (CobaltStrike)", "value": "79f660ffe33e3a158202eb90800b88e948db1467", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677910490, "uuid": "c8d27eeb-dbd0-4420-ba85-c831bd48f2a2", "comment": "Malware payload (CobaltStrike)", "value": "0991a6e1eeb980a42568c58d86b07df16c574fb340f1823f6c83dd3bc608c708d8745f41cc82ebbb1dca211de0183dd4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910490, "uuid": "bf8a32ee-7e8c-49b6-a018-8a8ad89d2a34", "value": "T1F5D38D07F3F631F9D173C974C8A15649E7B1743603219FAF079886AA2E276D09E39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910490, "uuid": "24ef35a4-ecf3-4331-bcba-430b354769da", "value": "6cc67e1b4c782dc2b07f26a430d4f88e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910490, "uuid": "1314b9b7-a834-4a23-a495-6d0a6855e0d6", "value": "3072:Kuk09Pu3p7Rmun0nwJ6Pas57lUJnzhNA+wnXjc:hkNdRmu0nwsyYu8+wzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677910490, "uuid": "772e766d-12b6-4394-b23c-caf24b523a44", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677910490, "uuid": "e1570665-18be-4fc6-9c3b-ceb43b3bdd96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677910490, "uuid": "8a03ac9b-7808-45c7-8016-57c5f8c9a284", "value": "8d6b5daa3dbd2cecf334e1daef15674f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa40cede-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677921998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921998, "uuid": "4d8345eb-9124-4546-a908-4b9ca04d9697", "comment": "Malware payload (Mirai)", "value": "3325a00f328761fdf4331132d9ccd657", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921998, "uuid": "02f17b70-b9df-4447-81df-40eb73331980", "comment": "Malware payload (Mirai)", "value": "a53044d3f96a0b9c9f000648961e7f78ee0f18aba88b8bdd4d4df7b464a73c03", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921998, "uuid": "5b6384f3-3b6b-4bc0-a6ed-588a27aa7616", "comment": "Malware payload (Mirai)", "value": "2e156465f11eee12ee7072384146f71c8f1cc7e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677921998, "uuid": "50e2e5fd-5367-4ea8-8889-7927dd7f2fd1", "comment": "Malware payload (Mirai)", "value": "34234b44f49e55119bbede5e4d386ccd95c485a8d6c793de09c6b75bc0f3a775d86a96fee244ee54af35d3bc8f3b99c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921998, "uuid": "171db090-44fb-4b12-be78-52af111aa75f", "value": "T12E83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921998, "uuid": "d8f04408-c42b-459c-898f-dc05c1c4c33a", "value": "1536:iVLyu95Kfgkj752dCexuV/8UZlDwfkJ4MYfWW:iVLyMg5Fezxu5VD1eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677921998, "uuid": "c43431f3-3161-478a-b492-7d1298c7e150", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677921998, "uuid": "455b7c44-d2c8-4257-b015-3e19a56e29f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677921998, "uuid": "6327cd66-3432-4c9c-8ee4-afa90ea4b460", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcb9fcb-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677920957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920957, "uuid": "e6e496c4-9b83-4e10-85f8-7485bc5f7bab", "comment": "Malware payload", "value": "5b095bf1659cc61eb5fe026f93086ae0", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920957, "uuid": "1a1fb537-0fdf-4279-977d-cd3d84036f36", "comment": "Malware payload", "value": "a55979165779c3c4fc1bc80b066837df206d9621b0162685ed1a6f6a5203d8af", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920957, "uuid": "f366edab-523b-49f2-976a-685b0f6d363b", "comment": "Malware payload", "value": "de761f9bfaccbce0bf13087c62c7f07f90cf45e5", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920957, "uuid": "746c7697-0a2a-400a-86e2-5130ffd758af", "comment": "Malware payload", "value": "18325c365525f379891d092058cff11c251a3e77e6472194a681ac4ce65f2d0e1f3e10e30fc6429c6716ee63b01eadcc", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920957, "uuid": "170acde1-399a-43cd-b96a-d885074d520c", "value": "T1B8F5FA342DEA502AF173EF7D8AE47596D95FBBA33703585D10A2038A0B23A42EDD153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920957, "uuid": "e0831e55-7776-42f0-9a70-94bac9fe4d95", "value": "24576:Bq2pALU9NJAWAdsCR7RIuXAxXgP0WEY/2DwF/mxUrF0ExGy:bA4nJAlkfg9iG/1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920957, "uuid": "67feb764-9272-42e2-b1c1-5f4b6f3899c6", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920957, "uuid": "f2ff7b1d-5055-40f9-853f-b37b8aee2725", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920957, "uuid": "29c4bb26-854d-4fd7-966b-1ee67672eda6", "value": "8702268950347.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff478c69-ba3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677899807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899807, "uuid": "e72372fe-eb7b-4a6e-ba12-bf81d5626af7", "comment": "Malware payload (Mirai)", "value": "cb9675baf75ece52708a7c9431fccd90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899807, "uuid": "d249a4fe-3c4d-48b0-a522-286d2d0adbad", "comment": "Malware payload (Mirai)", "value": "a90fe2047f8725c91fc7c35f04f254d61384f2b254b0eab632e89ca75fabbcf8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899807, "uuid": "b2e7b85e-73d4-4138-b2a6-f3289996bf98", "comment": "Malware payload (Mirai)", "value": "7d711af942e01a48ea0d17ccff63df656baefe04", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899807, "uuid": "d5468432-654f-496a-a55b-b49aea72ae7d", "comment": "Malware payload (Mirai)", "value": "1bf4e59c327bc4ff441d16a4de02709ba1fcc834784669c6a9b4c491d8299e7c7a122abc1299e919e1a8b0326052c724", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899807, "uuid": "06f949fb-853e-4397-9c90-bd08ef2fbb34", "value": "T1FA13F102D307A851E6722D3AD9F42A8FFE069B3DF55DE43950156F0C09E1509BFB8257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899807, "uuid": "15d76801-dfc1-4e1c-9382-4faeacc96359", "value": "768:J+605QKcgFCMEYkzZP1WpCdTJxu3GXVYJJuJ5/SRvXpTerEAE7pG0Z89q3UELEj:Jd05QKcgFfE3zSAT/cuJ5K1hernEt3La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677899807, "uuid": "e008b558-95fb-49b3-b025-0374e68f591b", "value": 45556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677899807, "uuid": "72f55095-6e7b-43a5-84f4-ce48fabe5865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899807, "uuid": "85279594-cb76-4f3d-8f88-ed1c87b3cce4", "value": "bok.arm6-20230304-0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127576d9-badd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969417, "uuid": "c36fc83c-402e-4dc4-91c0-efdb77a71486", "comment": "Malware payload", "value": "2fc00713db68a23c3d7163e5c66efb45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969417, "uuid": "a74af57c-73ab-4f0a-94dc-908b4c873bc6", "comment": "Malware payload", "value": "a95e8e313e93553a7c4a541803a26620fb30a9a0a87a69c014ab8d5d9c43ef82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969417, "uuid": "c656e040-9fcb-43c5-8ead-ae9e24cd9553", "comment": "Malware payload", "value": "d364a75da0fbc8ed4b920a226e538672e31db8c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969417, "uuid": "7d825b6d-c37a-4b07-9f37-9f768d12cc5f", "comment": "Malware payload", "value": "3092cfc46a1a10ba8b129e1c26d91ddf18ba28ba2bc5e48d6acd25aff7c429f0c9abb03df13de2b2c63d922c2ae4a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969417, "uuid": "1ec8a050-ada2-464c-b82a-bbb99f03a1a6", "value": "T1D6058D0A7E9AD55FF4907E7D451892903BF9DB500A9E06124F07BE4C86F8AE027A3CD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969417, "uuid": "a74e5b08-b5a8-49a0-969c-d7c3bdc84f9f", "value": "df9d2281cc91e4d59a7f6e9ff8df71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969417, "uuid": "2fec59ca-d1f2-4bc5-ab6a-4a68082ddd1d", "value": "12288:Z0+2KVO/y/KKywS+KWy0svTWOmni7nAU5ua/a5MbrY9LN:e+2UOaawS+KWy0+TDWiUU5py5WYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969417, "uuid": "00490093-c165-4737-b19d-22e2929b6c36", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969417, "uuid": "71f6b170-f173-4a30-ae99-5bb9e3ce318b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969417, "uuid": "0631a782-95b2-4c67-8d5b-a9c1b5754159", "value": "Activat-Photoshop-CC-2019-v20.0.5.27259-64-bit-By-Rover-Egy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a124ae2d-baa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677945605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945605, "uuid": "cfa12794-6b84-420d-871e-81ca5aad7237", "comment": "Malware payload (Mirai)", "value": "038eed3a8fe8465d4b7b56213f47e05e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945605, "uuid": "17c6b876-d0ff-470a-a970-b58c7ea4df45", "comment": "Malware payload (Mirai)", "value": "a990a53256f9d2b563bd230922a786354a71b4e7f610d2d31ffbcca608ee2422", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945605, "uuid": "d18ce086-2ca4-48a6-a5bd-c74bcb7f8db9", "comment": "Malware payload (Mirai)", "value": "b73598b613b28b9f5afc41ddfc1fa393bfb1262c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945605, "uuid": "21184e58-00b0-47e3-9695-416e6ed8dd7e", "comment": "Malware payload (Mirai)", "value": "601d3f255aa63c2de24db7211d671afd6a64e1063db9df4f66a7f45601cfcdb0e737676f11da72509c92685478f46378", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945605, "uuid": "299d8c07-3c5d-4cdc-a8be-1107ee63a2a7", "value": "T1C5A2D0257F1DE98FCD37B238C7A6E5C693D07C34D3DCD5826741C11BAAA36846824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945605, "uuid": "4cb56a3b-a0fa-469e-a2df-c64f1c3da5d9", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkgaQNAr8vcoBAvP+qNV+KLebRtDmSyU:k98o08kxofBE+ZkgaT47C2EpitD6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677945605, "uuid": "335b5da6-c925-415f-b5ad-d490e4aec72e", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677945605, "uuid": "fd31c5e0-a69b-41a9-b882-06c0fb620586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945605, "uuid": "ef224231-08a9-40f4-a684-b05cd87bd06d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2b1e30-baae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949601, "uuid": "00b7219c-3c2a-4200-abcb-a1af8047a51e", "comment": "Malware payload (Mirai)", "value": "0c83798b062a495e2bef343c98cd1c9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949601, "uuid": "bbf473c4-9b70-43ef-a90f-6e44550185cc", "comment": "Malware payload (Mirai)", "value": "a9cd2612b0f0789b119189413f328d75860d0f8f5dcb03d4cefabb64b5221508", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949601, "uuid": "c467fdef-fc36-4217-9692-70516212d71e", "comment": "Malware payload (Mirai)", "value": "9579400b1e3c7d949ee8e2e8b3d6f0728ea4ca97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949601, "uuid": "efedd457-d323-44d7-8f11-71914a56d662", "comment": "Malware payload (Mirai)", "value": "1da62c3309eeac49bb7048bbb3a3180455bc7773b8556bc2e267979f84538ed3753deaf59c09bb35b75b2397dc8503b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949601, "uuid": "a2b99a76-c2be-488b-93bd-9761d870c0eb", "value": "T1D0732979151AF2BCECE590B8F80314E239910B1D36EDE1D3B093507AFEB570C662AD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949601, "uuid": "a8bf3e71-4cad-4a3e-b5ae-7e70b7afd2be", "value": "768:4U1hMqB2y7Zuyg3CiAuhpUJjSb0v4B60JQNaivKaNDMrFaw5G85KqOH:4k2LtyivUJv4i5RMr4H85KqOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949601, "uuid": "40ad6c68-9d4f-4512-9a7a-0b25380c6d9d", "value": 75208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949601, "uuid": "df12c83a-c8d3-409f-988f-4236354f8835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949601, "uuid": "108714bb-ade2-4f08-9ec4-1897e23138a8", "value": "0c83798b062a495e2bef343c98cd1c9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ee4a0d-baa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677945610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945610, "uuid": "bfc735d4-faf6-4f38-8b16-bf9ced3d6cd1", "comment": "Malware payload (Mirai)", "value": "cdd812c82dc56fd36987516e2ba797f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945610, "uuid": "3d6a851a-1ba3-4ff9-a9ad-b84c0eafde52", "comment": "Malware payload (Mirai)", "value": "ac785a761821e6eea89f69a2120b2f26b7d1653aacaaab9bcc24ec78de72b9aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945610, "uuid": "6a93d9a3-5141-4482-bdf7-15cfffe332a3", "comment": "Malware payload (Mirai)", "value": "aeb7565fd0add76ffc29324d66f3b37169f5d5f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677945610, "uuid": "f822ed27-a66c-455e-ab9e-1b3d5fa3907e", "comment": "Malware payload (Mirai)", "value": "0fb4a99d4d916d89ef6317337899ea0dee08c1d3facafa60cdb1cedf6954523c4a0667c78ef697bcf17416c8df8f75a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945610, "uuid": "afb9211d-cb74-4654-9cac-490f2486d026", "value": "T167A2D0200293CCD186B0857BE369C5877AEF5AB042FE342F262136595ED864F94BF6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945610, "uuid": "d8dd0bb4-8209-4b1a-b524-8a0793ee34f0", "value": "384:b+I5hpgy5Kbyq1kkIwNdLN31jqpLFrIF0u4ZXvuGFhymdGUop5hT:KEhpgy+z1t1uNFrFs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677945610, "uuid": "72481596-d854-47b1-bf70-e296ca1416a2", "value": 22176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677945610, "uuid": "f1fe9d17-76dd-41f9-96b6-042f0dfce118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677945610, "uuid": "bfad8e72-c853-48b0-9598-cbb5b1ebb39f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b34374a-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916792, "uuid": "a30c874c-2a94-4725-9c44-08c9c0951246", "comment": "Malware payload", "value": "db58b89373061f445458eecb3bc06bec", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916792, "uuid": "8ad3f242-4ba1-4d7a-be53-1847a3e64cef", "comment": "Malware payload", "value": "acce9e4cbd650f6f150eef38b414f1070acf1cd40fb531999c566eed26f0407b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916792, "uuid": "285034ce-d219-40e8-8354-2d747904912b", "comment": "Malware payload", "value": "16f1a237b085cc5c1d324430d324c2cfc405d2ca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916792, "uuid": "c6dba5ce-9d8f-4b08-ba99-d9526e136d05", "comment": "Malware payload", "value": "9ad9815fffecdffe0f1805227e12eb10d28a0337376f9fa745b0f61ec9e87b056c4eff46d6751c7ca7fb858de1c6bcc4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916792, "uuid": "a3304b9a-6dc4-422b-9f82-066546f8d1bc", "value": "T1EC357DA1DA961219494F1BABEC430E724DB9C02D63270A39FFAD538E610755CC3BFB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916792, "uuid": "dbcb73de-d052-4dfa-9dd1-5dd8922b7dc0", "value": "24576:U72Xr3cB3N2n740fhGZbLastfk5yDEvEM:xzcB4wZbJE8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916792, "uuid": "bd909b47-eb3a-465f-9507-15b16d9fa78c", "value": 1067169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916792, "uuid": "b5e8ac3e-0cc3-46a8-abd1-140ca6bc7bda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916792, "uuid": "bccd40a3-e4be-4f02-b187-8f53d1f715b1", "value": "OOCLU25638420380_ARRIVAL_NOTICE_INVOICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b208f3-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677963002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963002, "uuid": "fde48d2b-7145-4928-b22f-2d2638edf93f", "comment": "Malware payload (Mirai)", "value": "2a90057d2a22d3c6ded18a240a5749df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963002, "uuid": "50d7f399-d122-49dd-942f-6394ecb83817", "comment": "Malware payload (Mirai)", "value": "ad1530ee420139fe277cbd1b5788ae6e688fec934cd62e1e8eb3f2aae9db8c36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963002, "uuid": "c56dcadb-0b17-436c-aa88-41377c4319ed", "comment": "Malware payload (Mirai)", "value": "e69c9ef182def7d5680bfbf7c302946fe7f58a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963002, "uuid": "c631da6a-aa67-4f9e-86d8-f4c317fc31e8", "comment": "Malware payload (Mirai)", "value": "21b1ca2bd8f85ec76ea509ad7f5bcb644d53fd62ba20d40f6cb27c44c4afb2a24f018bb1543dda7b74dfcae389d407fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963002, "uuid": "b6f553a6-cb7f-4034-bda9-c7cf4f3895b6", "value": "T1BF335CC4A743D9F5ED2546782077EB329A72F43A1169EAC7D798A532EC42B01E2073DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963002, "uuid": "f726b5e2-76b2-47f0-a99a-08fd54cf026c", "value": "1536:AYlBunVnQHW0uLqDbyTLVJ8WVe3SIlgUk1nI:AYbwVnQHruKbyXfQSIulx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963002, "uuid": "b2bd4a3a-7419-41c3-a5d8-50078b24e678", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963002, "uuid": "10ed5d6c-92d8-484c-bf52-b558b131b8e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963002, "uuid": "30ddc264-32bc-4323-825d-b2fd96b89b46", "value": "2a90057d2a22d3c6ded18a240a5749df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452f7969-babd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677955759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955759, "uuid": "f70048e0-c725-4da9-b25d-137508fd3a35", "comment": "Malware payload (RedLineStealer)", "value": "41eef04db755df557ca0312a759496aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955759, "uuid": "252d9aa4-9e9a-4f35-9fea-3ac90bec6b00", "comment": "Malware payload (RedLineStealer)", "value": "ad176b78fc926be4bcf4b28dc9c0be60f33d86bd98f63b1790d01ca00adf3b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955759, "uuid": "bc71b625-f997-471e-aebd-0d6b197bc5cc", "comment": "Malware payload (RedLineStealer)", "value": "8afccfe1b3b5474b6d7dc75eff12b5514e425233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955759, "uuid": "21f48141-84b4-42ed-8abf-990f20e82702", "comment": "Malware payload (RedLineStealer)", "value": "1a23449ee196d45704927feadd1720cb68d884722e28782fecfab5985ee09aca317aa1df121cc6dfd5a9486b5e083dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955759, "uuid": "9b8b4136-a0fd-43ca-a651-31a3127c1bd3", "value": "T13404AE1176B1D037E17219304C36C2F52B2ABDA3AA74A5CF3390BB2E5DB12C14A72767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955759, "uuid": "82ba4101-9953-4348-8865-365de175cf86", "value": "803aa1e15a1117e9632bc3833b3fb2c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955759, "uuid": "7e9f4118-48f6-4334-a474-d85be3a753c4", "value": "3072:CR5Jc26kYbugIwjpIVQ8eVT7HxjaxsiIM8yTO6PGvY+JI0Ka:2L6digIwODmT7H9ax3PB+C0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677955759, "uuid": "e6a199a2-a805-4df2-bbd4-cbde2c966cb3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677955759, "uuid": "fe7709c5-a1e2-4772-8574-4855e7e7763f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955759, "uuid": "66df53b1-da39-470a-be00-0df1ecc7547c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f2f569-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916976, "uuid": "925606e8-2acc-49fa-bd5f-f0fcbdb70d0a", "comment": "Malware payload", "value": "a86e2d91fb0012c9ef8d50335d12d222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916976, "uuid": "f695c323-f0e6-41ce-85a8-ca61636016dc", "comment": "Malware payload", "value": "ade7d3e8412c5d547caac260f689ad62470c1b125b9e88d5610672c92e5619ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916976, "uuid": "22829f87-c6ca-4b0f-86f6-c8dbfd9dee02", "comment": "Malware payload", "value": "77fe6feb0f24f4f4a88b390ff469f910410f42e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916976, "uuid": "79d4591b-ee97-4bbe-8043-bfaba727f0e5", "comment": "Malware payload", "value": "9b1efe69da6f6a00ce229b8dca343387c43e5cc154d82e47ad1ad6c0a6c9e87cb38339b3861947d8d678fe24a47648e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916976, "uuid": "16ba1910-e866-420b-a0c1-2fe16f5fe8a8", "value": "T10306015135EC54F3F2C2661B4BBBBBD7A1AD32D1591186DC0798D0833D2B62223DE29E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916976, "uuid": "8ee96ef4-4055-40e0-be60-b588129e6af0", "value": "98304:vT4pPO5Gn4SOAjkSvBTaPX+alSeReNBoDVF9of55zVB:vT62IBTamNPWOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916976, "uuid": "847cdc1d-e9b6-4bf0-a1c2-dfdae487145a", "value": 3772371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916976, "uuid": "833b22f0-917d-497c-b202-8179131ac07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916976, "uuid": "d1cc7bf2-9b90-48cb-aaf6-5defb7b79632", "value": "a86e2d91fb0012c9ef8d50335d12d222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae9911f-ba31-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677895827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677895827, "uuid": "64c9ab0b-e2e8-4142-9cfb-f213384956cf", "comment": "Malware payload (Amadey)", "value": "8c003b520b4b3a58eaba0a0704627361", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677895827, "uuid": "2146ca6c-e6ba-4282-b3c5-26948f32489c", "comment": "Malware payload (Amadey)", "value": "ae5f46a37d4f937a8e2819cbd8ce6d1434949f06022eb98f872b038695b2396b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677895827, "uuid": "c8b3476d-ecaf-4e69-bba0-e9b8c804cccb", "comment": "Malware payload (Amadey)", "value": "fc7998dcb6c2a59b92a3dd3e8be4ccf764a90af9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677895827, "uuid": "e3b9778c-3a91-4c44-adf2-489d298cd2ec", "comment": "Malware payload (Amadey)", "value": "7ce69d7f18b2c85168c82bdbb82f10e9ac9d8685df37109b70265cdd2fcc708e4bacb6ee6012598a00bc5271fea80e3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677895827, "uuid": "6b6ac81c-4972-4a7e-aafa-2b49b3b70729", "value": "T13004BF31B6D0D432E1621931CA25C2F5563ABC936D38A9DB33B4372E5EB11C14ABE726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677895827, "uuid": "8133ff31-9633-458d-b126-38a06927a4f0", "value": "bb33faca3c22fdf70d184f78a5e234f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677895827, "uuid": "ccb65657-708d-48ec-894d-9f561db3ef3c", "value": "3072:I7u7txg5vVr6L0nOlGVQHpR6VYd+BFDqo6AlhXjAXPSQ:7Zx6vVrlnlQHbcW+eoJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677895827, "uuid": "08c22da0-a083-49ec-96a8-8a3f3fa0b02b", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677895827, "uuid": "5e4600ed-5b26-4fa1-aa15-d8c8e6f4873f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677895827, "uuid": "d1332596-7bec-4dc5-99b5-a2e67afd61a9", "value": "8c003b520b4b3a58eaba0a0704627361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90b9b53-baae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949618, "uuid": "2c0ea369-d181-4ae3-8c7b-5ab6b3ef1803", "comment": "Malware payload (Mirai)", "value": "aa1e06f4e0c013a1fbfcfe0f7e645596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949618, "uuid": "121b848c-5d60-4ad5-b77e-a704fe9bdb88", "comment": "Malware payload (Mirai)", "value": "af1b82a3c050d00e3248f51ecebecfd087558e5d8fd1afa69d70c71a9ca78249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949618, "uuid": "a48e7708-3fab-40f3-b295-79d208a1f902", "comment": "Malware payload (Mirai)", "value": "df3a3430f65624f010e12f364ad51111646516a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949618, "uuid": "aa065b8d-5e20-4100-bee2-8bf389a34712", "comment": "Malware payload (Mirai)", "value": "39b312dbbf2057e0f0f818fef5158475a35a761ca657fd5df714e87baf51b699d8a159c3367786a1928325a0cd758e23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949618, "uuid": "a6c454ab-6712-4e7c-8254-8212f8738e1c", "value": "T18D234BC49A43EAF5ED120A7420B7FB335B37F07A1159FA87D3659532AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949618, "uuid": "d734387d-c381-4a0c-b411-a76da7ad967c", "value": "768:cY/QjSN+MGBs8WWE3/NRHgzqduOxPwVFEwaK3g+ZdG:cY/QjSN+MGBzXE3l3duOWVRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949618, "uuid": "83cd0a0b-922b-4236-8198-52107490ea34", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949618, "uuid": "d99aa5fe-02c2-4518-a3f8-bd728b9c4cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949618, "uuid": "37be1e36-b074-4fc5-9e62-667865e67b11", "value": "aa1e06f4e0c013a1fbfcfe0f7e645596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1516438-ba9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677942626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677942626, "uuid": "40cc132f-0508-474e-baff-47d33afa311c", "comment": "Malware payload (RedLineStealer)", "value": "98b9fcdc2748de2349afbc56e61c4f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677942626, "uuid": "1fcf46a9-5fa1-4fb1-ba86-020485028983", "comment": "Malware payload (RedLineStealer)", "value": "af8218ea9ebd7b93dddefc452469641485fbcb79f1d566c9c0d6a1f21f921f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677942626, "uuid": "5910721f-4327-48d4-b676-653d4a49cc58", "comment": "Malware payload (RedLineStealer)", "value": "a310dc439bcbb14337b405ba433f804261a7cef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677942626, "uuid": "6d54d605-2216-4d1c-87ee-61373a688150", "comment": "Malware payload (RedLineStealer)", "value": "5fe8639cc9f26c280689d938b7d4aa744257d258be796db346b922f1f6ca78200600a4bc2e4ffe2c092dded4b92900d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677942626, "uuid": "05b1453d-8e7f-45bb-918d-dee885e23b72", "value": "T16615E70E2AAFDEE2C2583B31D099A41C0A65EC05776ED2279DD11BD367373325B0A16F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677942626, "uuid": "f7c395f1-5054-4add-942f-4722db482374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677942626, "uuid": "b0288b8b-9902-4557-a905-fd28590ad3da", "value": "12288:T2qS3/b3zPrHDf7jDAZXf4K1CyFMbM0FicEVMrTUJ+GH9huBy:KDHICU9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677942626, "uuid": "51f49a77-687a-4c13-b2bc-fdd326f2a05f", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677942626, "uuid": "49a20be9-95c6-44a8-96a6-aef1cc9c5af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677942626, "uuid": "253fe6ab-0654-454a-a026-6789502e1181", "value": "98b9fcdc2748de2349afbc56e61c4f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ce5ad4-ba63-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677917160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917160, "uuid": "bc9a6746-33e6-4e8d-9f3e-86749468d19f", "comment": "Malware payload (LummaStealer)", "value": "87d65081908d01ee0958b44f854d5157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917160, "uuid": "2908b689-deb4-4c85-8586-eaeaf2a83111", "comment": "Malware payload (LummaStealer)", "value": "b0de6f0584252e07bfc8fa1207c4d959e33874e6fd2961ab07532f15d21450c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917160, "uuid": "11712108-3191-4768-8b72-253c0ef6604c", "comment": "Malware payload (LummaStealer)", "value": "d6e7cbd886b8c2b39c5f23e5d03cf3e3a658d1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677917160, "uuid": "a2373d17-46bc-48dc-a6c1-20288ad40510", "comment": "Malware payload (LummaStealer)", "value": "2c3ccf02eda07ba6c1d069a09e449709a5639422b1a9db00562059206e3522e2716a1e79b5ad94996b801ed772668877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917160, "uuid": "4cbb82e7-1602-4d49-8c2a-45b3348a863c", "value": "T1C336E5CB99C18A92C2213A3393B2D245A2F4A711135BD77ACAAF13E31F53B7C75509E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917160, "uuid": "4730d89a-c377-4220-a54c-0ef0c934964c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917160, "uuid": "0b4628a1-d93a-42bb-b175-fc18f162cd67", "value": "98304:VlhDJ2TOJ8hWGmCHujQ+EhNe/2mRlJ+NneC9:DxCQGObEhA/27NnB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677917160, "uuid": "ddf21fba-17e9-439e-9765-425e00b2e4ba", "value": 4866058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677917160, "uuid": "d965907f-0346-41ca-a350-5ebf1fc74dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677917160, "uuid": "7f79ee7d-e73d-4a4b-8861-3154ae8c42f2", "value": "installerx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c09343a-ba41-11ed-88f6-42010a9c006e", "comment": "Malware payload (CrealStealer)", "timestamp": 1677902405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902405, "uuid": "e33509aa-566c-459a-a1b0-dd264e01de90", "comment": "Malware payload (CrealStealer)", "value": "9e63c8f3f5d2cfd5b55d81bc1d90b586", "object_relation": "md5", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902405, "uuid": "cc3476ce-cfed-41c0-b2a5-728268354825", "comment": "Malware payload (CrealStealer)", "value": "b20adeff31b7005d135d3c669f61c9083c5bc46887b957cb4fbdb0454614e1bc", "object_relation": "sha256", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902405, "uuid": "01b0f125-50d3-48bc-8acb-ba01c389ba0f", "comment": "Malware payload (CrealStealer)", "value": "ec1fbcc77a210b0c9a25086d88329d4541936d0f", "object_relation": "sha1", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902405, "uuid": "4b8d8f79-3931-4c1b-a182-fa44e59d4ae1", "comment": "Malware payload (CrealStealer)", "value": "80b1658cb6be373413224faa1438dadc4340306ffddaf6f032c10c05ae676695058c49007f16ca52534059d19d1c60ba", "object_relation": "sha3-384", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902405, "uuid": "b6905845-8d96-4f48-a46f-31253f262e99", "value": "T11E5733D8E01908B6DD59C1FA9B47D7709F70ACED94184B82A9F0BD2FF1F91A39928143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902405, "uuid": "9b29db55-27fd-4701-919c-2056bce1fb93", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902405, "uuid": "253c08cb-a59e-4ef7-835d-ae87e4e507a0", "value": "786432:3WOp0XMYjJat3MHQXI/gRyOkbqlmQLVDaxLnQzHg1oH:GOUdjJ6vzrLVqQE1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902405, "uuid": "b57eba2c-4c53-4d46-959b-74cf9e320b47", "value": 27289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902405, "uuid": "6c2762e1-8677-4e59-8b28-9e3e0bb88db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902405, "uuid": "70330a42-506f-4e75-95f1-25f4bd760a8e", "value": "Vanta Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6387f200-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948508, "uuid": "14357ff7-00c8-472d-a8d7-15440965b3f2", "comment": "Malware payload (Mirai)", "value": "6d62ac4c6b0feb81b40d85b398ca0592", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948508, "uuid": "7ee650ec-682a-46d8-8762-e6d47832bd87", "comment": "Malware payload (Mirai)", "value": "b2fef3a6ce1336900fb894ce7f86928b0e1865c8dc1b7304a3b3e602390daddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948508, "uuid": "b713159b-6bfb-42ad-8466-ff8d3e98184d", "comment": "Malware payload (Mirai)", "value": "1a4c6f2ca6cfb0e1868b828e964032fda65bba70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948508, "uuid": "eec64b5d-d901-4910-bf22-587f36ed9fdd", "comment": "Malware payload (Mirai)", "value": "4290ca62f09bbed3378abffdb8eeb6edcc58481205737769ae4cc2c3499903175ca863103c78cb2be066243e621ebd1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948508, "uuid": "677fc0c0-3a11-45f0-8e10-c5fab2a3d2ed", "value": "T168336C36E029DED0C6960134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948508, "uuid": "a9a84ef0-d11f-4f8a-aa69-eb1353a84b11", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Xm3CZQoV/bnmCozw:Oa4U7G7SvT6ftB6m3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948508, "uuid": "7abe6f9e-b8ff-4085-9391-ad85ddc56a13", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948508, "uuid": "455cce55-7d06-4454-8942-2f528d27ee8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948508, "uuid": "bf01f71a-c394-4fc8-9cb5-e68a944304eb", "value": "6d62ac4c6b0feb81b40d85b398ca0592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a9138c-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677916437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916437, "uuid": "170a1319-1489-4775-9b6c-df7d1ec2df8e", "comment": "Malware payload (Vidar)", "value": "8a5e102aaa6846d3c79d40e92e120e19", "object_relation": "md5", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-crack", "colour": "#746D91", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916437, "uuid": "ba8e2aba-c84a-4f06-99bc-188c609db94b", "comment": "Malware payload (Vidar)", "value": "b3b9d9d19f58fb77f37b0184eea0e90f53a5b947fe335f2548e2d10d1d809d68", "object_relation": "sha256", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-crack", "colour": "#746D91", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916437, "uuid": "b0eca24e-6389-421c-8f09-f45a05801f83", "comment": "Malware payload (Vidar)", "value": "d34ec15250b2a792cc92ba601e05fee36d13eb84", "object_relation": "sha1", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-crack", "colour": "#746D91", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916437, "uuid": "c34a95c2-9aa4-4e8c-9945-32d3ef2a1c27", "comment": "Malware payload (Vidar)", "value": "f1619a9e256af64c2601ad6ee693eab67b23353b8e434befa21bbbb77647772ea17288a95691869eaa967f603c605226", "object_relation": "sha3-384", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-crack", "colour": "#746D91", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916437, "uuid": "2c183641-6c86-4696-b98d-0ef18cdc4ea8", "value": "T1950633526494A3018A5577C8F22FA83643539BDF301F293CC9A96A9D2375BBE3F451F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916437, "uuid": "d8563eac-83ee-40cc-8673-22be884f3fac", "value": "98304:5W4EiVUuH4SC6V0E/y2z10/H8F7rOo6CPEA6o4pXSyI4qXo:5YA3CA0Ea2x0/cdCy6xpCv4Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916437, "uuid": "27f45464-cf59-4972-9e5a-6f2b13f960eb", "value": 3903577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916437, "uuid": "99b9aa36-351a-4ec6-ab53-92bf3111611e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916437, "uuid": "34836c77-8d2c-4974-819e-463ed858b174", "value": "FiI\u0435 (2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0307843-bad3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677965414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965414, "uuid": "8d0a1260-5197-44de-b000-96d1ea726269", "comment": "Malware payload (Mirai)", "value": "18ce21f1e0a9d882f147c2f5a622b2e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965414, "uuid": "2ed5b4b7-9901-4241-b87b-bdfee3faea36", "comment": "Malware payload (Mirai)", "value": "b4f4698ca8c769f143406bf3b4d66469481533d4f6f15d2cb2f9f2870f2960d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965414, "uuid": "0b4e343a-6c1f-4868-aa07-bffa144ce946", "comment": "Malware payload (Mirai)", "value": "d4a2ad966b94b989e1658e8627939ed6284f6032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677965414, "uuid": "b9225a48-8c8d-4878-baaf-5cf4fad03c28", "comment": "Malware payload (Mirai)", "value": "1385e6f35f1314e8a856cb0e3c71eb08c979b028d98742772defad071fb5466c690eed9a0b274390008d7ba9fea962f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965414, "uuid": "12efb606-03a9-4427-89c3-d4759edf7f05", "value": "T181635BC5DA83E8FAEC2209753067AF368776E13E1525EA93D3699832EC52701E1473DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965414, "uuid": "c66cfc17-aad4-4385-b507-8ae725607df3", "value": "1536:wRh2EkamD71Zbv5JUbPDfCT4ltubCuJy0rrMSF:wZBmD71Zbv5JUbDfCMlUb7yiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677965414, "uuid": "b3164bb0-14df-445d-a3c7-b72915f57811", "value": 67280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677965414, "uuid": "7d01a915-7114-480e-ae5c-5764c66081ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677965414, "uuid": "44016511-e9f3-4eb0-b27c-253b6eff1a1c", "value": "SecuriteInfo.com.Linux.Siggen.9999.611.29397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b03863-ba91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677936915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936915, "uuid": "cb609c4c-3520-48a7-9f78-68b342a11224", "comment": "Malware payload (Mirai)", "value": "cf1810414f8bad05d621321880c8ad35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936915, "uuid": "0f2b1e0f-9cc3-49ae-9e36-c27f5ab907b2", "comment": "Malware payload (Mirai)", "value": "b55cf50228e7edd1f4deee01d3303d1e41bdf02a3cde44a950dfed77f393c30a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936915, "uuid": "954e3b61-cc03-4485-a632-633bb7334bc3", "comment": "Malware payload (Mirai)", "value": "976a10aa92d1c0e1175cc6b81ecf71c49ffe9dd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936915, "uuid": "2c5ee499-a506-4c80-af09-0b97f69537b1", "comment": "Malware payload (Mirai)", "value": "d188d199dddf0559bd5bb17618cd7f4377afc67e6545340aee8d0d1ca0f6852d29bafe47ced134f2f627977e66b4babf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936915, "uuid": "0255cf35-f5ed-4737-94fb-33ce53f4634e", "value": "T10663C506BF740FB7E8AFCD3749AA1705258C650A21B83B757934D828F64B64F49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936915, "uuid": "1299f499-d637-4214-b241-7d3431d06081", "value": "1536:s5KqO60Cg3XkLB3ILvTdt38K8ZweT4Qg:sYqO60CgH98/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677936915, "uuid": "93885a06-5bd1-4731-8c58-21b075e48050", "value": 69104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677936915, "uuid": "25da423b-3581-4b4a-bc4e-cc4600159979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936915, "uuid": "dd8af11d-4511-4406-ad75-f8ad9bc55a84", "value": "cf1810414f8bad05d621321880c8ad35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a395f7ff-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916833, "uuid": "723e82ba-e48b-4c33-9d59-9df820b48484", "comment": "Malware payload", "value": "3ab09abde9826051d1c04b0a23271f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916833, "uuid": "5878ea56-1d3e-4dd7-84eb-fa42a5cbe57f", "comment": "Malware payload", "value": "b5f3ddaa578e9196ef6d7fc31fc0329d95246d5c61d1165b772c2dec34f3952c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916833, "uuid": "1ea98106-ef52-4992-bc13-77e04f5ff243", "comment": "Malware payload", "value": "684fec9d1578aec5c4e2e591f36f6b102a63bae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916833, "uuid": "ae1b6d54-eb76-4478-a2ed-8bbd331cbe7c", "comment": "Malware payload", "value": "8ba86711fafe14786f3c35d60bf67c72333aa67fc07cfe629d3d2b6bdbde89c0c0b5b56b9db0eb41c6de7d44b1d92088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916833, "uuid": "27f280c3-2538-4245-9cd7-fba2808de573", "value": "T123A5232535D1D076DA7B183478F098721EB9FEB12F789D9B0761177C8A342C0973AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916833, "uuid": "bea593fc-c48e-4a5c-9718-35549e2eaff1", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916833, "uuid": "8a1cc365-7cc5-4ce4-9e63-160cc6ff78ec", "value": "49152:zMBQcNdNReG0vZC2FyYJmeF0kWzJQ+HGouQ5V5aS1GtyMT3BI:zMBQincG0v42FfxF0PJrGTQcSkoCRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916833, "uuid": "5c6b2202-6ea1-48ee-ac69-ce485b9de2b4", "value": 2143222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916833, "uuid": "fd84494f-15cb-46e4-a66d-3a9a019b0e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916833, "uuid": "f89288cb-1111-46a4-b4f2-d368762fcf6d", "value": "3ab09abde9826051d1c04b0a23271f48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9ed449-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677920955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920955, "uuid": "6c5fa4c4-8ccb-4248-897e-f1a03296f68d", "comment": "Malware payload", "value": "fcdf0ba1ce0384e1a55a9191d2761da0", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920955, "uuid": "8403f13a-ad49-4581-a414-42e9e1a18713", "comment": "Malware payload", "value": "b6d05d8f7f1f946806cd70f18f8b6af1b033900cfaa4ab7b7361b19696be9259", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920955, "uuid": "4aee7d99-a2b4-42d5-a73e-20c7ea90a878", "comment": "Malware payload", "value": "4454a27ff9f40d54231820f2b3352f55556c0533", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920955, "uuid": "b677e1d1-3bc2-4837-a714-7dfd476dc2f6", "comment": "Malware payload", "value": "dc6d7269abf4e5f7666e7617433905b2212ae03849b50283eec85740a589e864f8c913b9531a153232bd54ced823a80a", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920955, "uuid": "9d07bade-ab1f-4a22-8fff-0d042285a370", "value": "T100B50B342EEA502A7173FF6D8AE475DADA5FBBA33703585D10A2038A0723942EDD153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920955, "uuid": "c75479be-ddd9-4e4e-a8c0-e85767d8af82", "value": "24576:4q2pALU9NJAWAdsCR7RIuXAxXgP0WEY/2DwF/mxUrF0ExGyP:SA4nJAlkfg9iG/1xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920955, "uuid": "63dd1461-62c2-4172-968a-6e7c0d4378cf", "value": 2354250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920955, "uuid": "c340528b-a179-4e71-a0fa-0ef5ed8df836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920955, "uuid": "597a50eb-bb2b-4414-b25e-aa89b10c0550", "value": "documents.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e808f14e-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677970205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970205, "uuid": "d3e650f2-36c5-42bc-9ed5-2d06441a5fab", "comment": "Malware payload (Mirai)", "value": "edc25b28c3a5027fd1e600d171c20886", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970205, "uuid": "3df1cdd6-d371-4b2f-8557-66f11d131f77", "comment": "Malware payload (Mirai)", "value": "b754310d9ebec457c153a2c0a1ad1ca1e81f65e966313e9e589a647a92794318", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970205, "uuid": "9983dfd8-9e4d-430a-9eb5-a7acbd3b2d74", "comment": "Malware payload (Mirai)", "value": "98dd2b3f4e111f7a56d0145f4ae8bbc40b78696d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970205, "uuid": "fafd2674-51e1-4017-8968-534278a1697a", "comment": "Malware payload (Mirai)", "value": "5d7adb59e644d5c3c4bc7a40522e0163145392f0f2394f486402aa8997bcb77046490cfc54a2f9d327256c76f4a2d116", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970205, "uuid": "83b4a1e7-f1db-4ade-a463-e6cde5b79667", "value": "T136C2E0B53FEB6DA7DE0A003A785DED3751B2B592D36B7746F28081052C071A8AA32CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970205, "uuid": "ec006aaa-e25f-484a-9f0f-7009c580560d", "value": "384:Mm1DMwk8JPyGgZDZpEXVZVBO6UIadsiWLRYJ4SwF/pfUVlMWEbo28tEe5mjWZSlJ:/MwqDZ2FbBO6UaHRYncWnH5C0NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970205, "uuid": "58567e05-f301-4e62-9b06-08efc9b88903", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970205, "uuid": "f70309a7-2cf4-49ea-900a-360d3ffee3ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970205, "uuid": "5f828aac-e11a-4dde-a0d3-e49b86119e58", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fe9457-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930602, "uuid": "7e66265f-ed8f-4667-82fb-cc15435bf582", "comment": "Malware payload (Mirai)", "value": "089ac7b6161160df89e1379bf5bfa22b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930602, "uuid": "88f715f3-f656-431b-9b96-7660acc98d7c", "comment": "Malware payload (Mirai)", "value": "bb3130fc2b0ff0c475fc41af085dc7514a3b9b323d0aa59a5a724b39e8aa5751", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930602, "uuid": "c0aca948-05d5-42ab-8ddb-73d1975992c3", "comment": "Malware payload (Mirai)", "value": "799670392f086b0d2351ad4c6e38a1f1c684b09d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930602, "uuid": "62419062-0f4d-43f2-8e4f-04c1d28b86f5", "comment": "Malware payload (Mirai)", "value": "b7047dd03a01a333339cb79a0db91f20b0db41a06010345955f8ff73443d0b1b7f29f9ae2d37e987abb95d15c61efba4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930602, "uuid": "25d27188-2d8e-40e3-b252-4e9baeec97a4", "value": "T1EC83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930602, "uuid": "15dc0232-2f23-4384-8470-5df6332185cb", "value": "1536:iVLyu95K54kj752dCexuV/8UZlDwfkJ4MYfWB:iVLyMgvFezxu5VD1eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930602, "uuid": "72cae70b-2a47-42c3-8ec9-a040dbf0cb88", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930602, "uuid": "7f39dc20-919c-4cf5-aa5d-c26201de8d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930602, "uuid": "1a7b8f42-2f5b-48eb-b8dc-179282cda61e", "value": "mpsl-20230304-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc12155-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677916900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916900, "uuid": "e882dccf-c8d1-4cdb-8435-9d636a7c061b", "comment": "Malware payload (AgentTesla)", "value": "42b73a725880a41150450f53c681a9e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916900, "uuid": "3851b191-f31f-4acf-97fc-03bb3916f67c", "comment": "Malware payload (AgentTesla)", "value": "bc282c69e6f9c69b93651c0d399318577b6f9494c0b851eadb4a5b44bfef1262", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916900, "uuid": "2f5ee70f-06a1-4b4c-95ea-cae06b886bdc", "comment": "Malware payload (AgentTesla)", "value": "0fae6a0ac549aafcf6b9a203bca639aaec91e9ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916900, "uuid": "ccf94f86-eddb-4c76-b83f-f5da5880ba44", "comment": "Malware payload (AgentTesla)", "value": "cc293a8dd60e1f83f7baf3b4c1b6a0a11954beab3442ea1f4415cf99a1a256380c08a101c2f59d1e16c098edba7275d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916900, "uuid": "7498305b-aa72-4148-b767-e23e8db3a151", "value": "T16045A82809FC0AF245B1F1FD9FD4E753BD8488E6AB049D99C2838B89555391720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916900, "uuid": "fbecc57c-4fe3-4249-af0d-5efcd3d1d088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916900, "uuid": "49ddd831-3768-4d9d-b15e-cb5fc5332397", "value": "12288:wmMOEAlI3MzSSV93ZCHcuB6XmKbxN4dAyIW6TmLmEfQ+DXtvb7sGpHXzFTg:w1YdSSI8sKsApmLyiXtvU+3zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916900, "uuid": "a2df8ebf-3197-4295-92c8-a9627f53d8d1", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916900, "uuid": "71fbd267-17f6-4986-85eb-6b4e32605b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916900, "uuid": "446ad209-925d-4497-8f92-e0b85d6f7484", "value": "42b73a725880a41150450f53c681a9e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe7eecf-ba6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922544, "uuid": "718c063c-b0d7-4202-ae99-f9d06216d524", "comment": "Malware payload (Mirai)", "value": "0af23c94068a0cbcd9d9c11367630ec2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922544, "uuid": "2864424b-37b4-4f3c-acee-446335606d35", "comment": "Malware payload (Mirai)", "value": "bc9d979e337056664e4851c6a9c56bcfbac85632ca26cb5295b348036bcb7f87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922544, "uuid": "02fe6191-5db3-4b9b-b13c-6defc951e822", "comment": "Malware payload (Mirai)", "value": "5b58579c51e1313391e728e1eed59b531266fecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922544, "uuid": "c9565bf9-f3da-47ac-8917-12a0ea81e1c2", "comment": "Malware payload (Mirai)", "value": "3081b93a74fd8012086aa1ece9517c92139c51b39898c655f9f5c1e1c20b92afac683c610a7b329abd350725488b745d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922544, "uuid": "ea8a4983-5fc9-476b-96f7-09e4210fb7f5", "value": "T16C633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922544, "uuid": "62e126aa-712f-48ca-b43c-48737bb026ed", "value": "1536:lGRaTYmol/hGIAs4PNvAOQQGm75123tStCl:lya7hJlGmVDsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922544, "uuid": "077ac337-c1e9-4f2d-9545-4b7f8e745d4f", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922544, "uuid": "77f3723f-efca-47d7-a541-62082afe0dea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922544, "uuid": "2913b113-974d-4797-97fb-66749f3f3c6f", "value": "0af23c94068a0cbcd9d9c11367630ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1379173d-badd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969419, "uuid": "049aa8ed-e72a-401d-8672-f888b746b735", "comment": "Malware payload", "value": "05ffe79385de12ab61acaed3c23d195a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969419, "uuid": "753462e8-5fa2-4095-8d73-90216d9f3914", "comment": "Malware payload", "value": "bdaf728aee883c0dca1c6e54834cac55013c35c31e29e7aaa81966a8233ccf8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969419, "uuid": "2b39db6b-3ca1-4894-ad20-233fb14ce9ea", "comment": "Malware payload", "value": "f5a6b764e3f1f96b4e0bb22c428a5b39cd3e48e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969419, "uuid": "8a491f0d-0e24-4b43-abe3-0c8e8ee5611b", "comment": "Malware payload", "value": "d1c9b1e14309bfdb6872282075951884485735533871964387dc61b2f54924bbcc04cafacc3894ea837c5780c2b9c03e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969419, "uuid": "5b499708-a118-4e6e-bfa4-36057d5c8c5e", "value": "T1C8A4E1547F94DF61F6BCA6B811B32000DBF3EE61A6E3D319FEA570650C377818A6A442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969419, "uuid": "de9fafe4-e97b-41ea-b2a0-e9152e92b6bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969419, "uuid": "cefd4208-339a-430a-b4d4-7f37f1deb02b", "value": "6144:7bUO0GIR2PGGE3pmPU3/0sq2z0T/DwiV0nKRAJybjD4ZCzkQByxY/i0cneunD:X1pfEAhsVUrwiV0n6AJKj8sXBySiuun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969419, "uuid": "e199a1fa-ec72-4121-8d82-b6c1b7cdf0a3", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969419, "uuid": "47b11ded-2f40-4036-9990-11cdb77e8011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969419, "uuid": "3cc5caa0-9633-47fb-89ce-74f26bcf923f", "value": "Adobe photoshop cs6 keygen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1f1f52-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677948521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948521, "uuid": "9b78ff50-089c-4160-a180-1678cead0d40", "comment": "Malware payload (RecordBreaker)", "value": "01405e0d41f7abac20000a33497ad01a", "object_relation": "md5", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lead-software.run", "colour": "#654C68", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948521, "uuid": "6dcc55ec-042f-45b0-bca7-38b2a6b4b9ad", "comment": "Malware payload (RecordBreaker)", "value": "be6f2d0e8bc44799f04488d565b3550008ba754233217b3f7b3a6b92c0840caa", "object_relation": "sha256", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lead-software.run", "colour": "#654C68", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948521, "uuid": "00530052-91a0-425e-b787-d15c0db1250d", "comment": "Malware payload (RecordBreaker)", "value": "a1f40972effc7531fcbfc2654b34a15d5d930d5a", "object_relation": "sha1", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lead-software.run", "colour": "#654C68", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948521, "uuid": "2765042e-4a57-435e-aa24-eaaa9f4abdc0", "comment": "Malware payload (RecordBreaker)", "value": "730cfa1b03306c501d634d05dae5d8d3aca1e459759bdd2073cf5d8ce058c53fd3c37528edde73baf416fcf29cfcc4dd", "object_relation": "sha3-384", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lead-software.run", "colour": "#654C68", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948521, "uuid": "29b4ce1d-73ac-4f0e-9a27-6f43b86cb53f", "value": "T16334BF1232EC9677DA57C9F958A8D6B985FDB2382BDF90CB7B540C1B6B406E1303412E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948521, "uuid": "1bce8f41-d48e-404a-b375-00d79d0638a7", "value": "1f635647f64b745c77efa805ab50ac90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948521, "uuid": "fd07e56e-6926-4d06-a5f5-9db8ddc9c116", "value": "3072:0tJ40ggd+bgsfqcpcuLHorEpbn3/3KziSHvVUbs2p+YnfEGXAO+hxq:0tJ6ssPorEZiLHvqY2pzZXMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948521, "uuid": "2c451135-921d-4c42-a1f3-a57fe0ebb7c2", "value": 245365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948521, "uuid": "1c3489d4-3f2f-4ccf-8442-04b88a447938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948521, "uuid": "b6b6c193-b9fe-43cf-8993-877444ae1250", "value": "n\u0435w\u0440h\u043et\u043esh\u043e\u0440_\u0430\u0440\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5a231e-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948607, "uuid": "3f5ec079-862f-40e4-ab6b-f4d39ea31e01", "comment": "Malware payload (Mirai)", "value": "b11280988583d53cb1091e3183a0700e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948607, "uuid": "c98c359b-76c3-483c-946e-603cfe147ba8", "comment": "Malware payload (Mirai)", "value": "be997eeae35a51b770182258ead9cbe119e3e5c014f87a7c0bce259bf12bc623", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948607, "uuid": "6a60cb14-9eeb-4f90-9a49-ed0b4f2bffd3", "comment": "Malware payload (Mirai)", "value": "d80dc853d0d47b497532070c63ea6138c4e9cbb3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948607, "uuid": "6e824f3c-cf1b-4b2e-96a6-924bac6d358e", "comment": "Malware payload (Mirai)", "value": "c3bcba51bedd4a8e54052bc42aa7655d80a6e20a2faee0a1e74765df54dbf826641eff9ca6b62cc45d8b141c2319b1ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948607, "uuid": "55f37f13-f773-4dbe-a2bc-7c168d62c8a7", "value": "T1AA532895BCD29A16C5D022B7FA2E518D372663B8D2DF3203DD222F11778A81F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948607, "uuid": "ea2aa22a-055f-4c20-9ae0-d7bbf7e2910c", "value": "1536:YsfchJbzun57Rsrcc/84RdPjt5KqySQI7dH:YsfcWRsYLS7bHy1sdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948607, "uuid": "9968cc39-0f82-43e0-9dec-6e545358247a", "value": 62636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948607, "uuid": "bb0304ef-41d8-4a35-8838-de327a71bec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948607, "uuid": "f05a90b7-d441-4648-a535-ab27a2c76abc", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35feea6a-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "2e4fe9fa-8aaf-409a-95dd-18c403539021", "comment": "Malware payload", "value": "e88665301bf9f4d6e9e185995460fcb6", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-2022", "colour": "#1C8712", "exportable": true, "hide_tag": false }, { "name": "pcworldfreesoft.com", "colour": "#07B420", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "805b3a3c-eda4-4bb2-bee2-319b05adc722", "comment": "Malware payload", "value": "c025a0d0d4f6a69bdcdb013dbcd02a27870c3d5f0dde54c4813082fb0178226e", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-2022", "colour": "#1C8712", "exportable": true, "hide_tag": false }, { "name": "pcworldfreesoft.com", "colour": "#07B420", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "23058954-2296-43fb-b550-1b377f18efc6", "comment": "Malware payload", "value": "3c8f118868f24569eaf6135eea90cc81fdd5d6b0", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-2022", "colour": "#1C8712", "exportable": true, "hide_tag": false }, { "name": "pcworldfreesoft.com", "colour": "#07B420", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "4bf03383-bb3c-4aef-818e-d381f7f218ce", "comment": "Malware payload", "value": "1ec91c15a59efc731702aa3ed97e0f85f93d9e4d6471fd4fc3b52e7deeedc17555768e249320310579a9cc4fe539cc52", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-2022", "colour": "#1C8712", "exportable": true, "hide_tag": false }, { "name": "pcworldfreesoft.com", "colour": "#07B420", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "59b679ed-8154-4d3e-9ca4-ca7b1ec384a9", "value": "T12017339E1C2E1B529F2953F6A3E3FC3A2B374C6E644540DCA07816E6570826F7ED2670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "7d75436a-42b7-48d1-aa3e-fafa9aa2e493", "value": "393216:Y50hRnAP+RmIjW/xy2EwMCv2KjV+GBRNYnxLQZN5wBnCo9Rr7usIMX:cKAGRPaxy2E3CPBbNSxMD5wCsVCsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916219, "uuid": "6e21ee62-0d11-46b5-9344-0e7171882ffb", "value": 19599934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916219, "uuid": "8df10c9d-5204-49a7-b2c4-f2a122be524e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "0a6afd7d-f7d1-470a-a233-1aa5dd5d0e41", "value": "installerx64bypcworldp.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd53984c-ba5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677915614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915614, "uuid": "51f62f33-2c39-4f8b-9cc9-3d70cc7af6d5", "comment": "Malware payload (SnakeKeylogger)", "value": "569d7baf983eb60d8151404f52188b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915614, "uuid": "7e486f60-7a80-45be-ba22-c64473f41c7a", "comment": "Malware payload (SnakeKeylogger)", "value": "c11cb2ff5a5d6629947b8b1d36f406714e485845ea2fc21a2eb313a798504e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915614, "uuid": "ecd01227-c128-4fdd-b792-c410d15e0991", "comment": "Malware payload (SnakeKeylogger)", "value": "354796fa0189633e9638360e3f248437174d8357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915614, "uuid": "5197dc2d-7217-4741-a462-f7f41ad3a633", "comment": "Malware payload (SnakeKeylogger)", "value": "62c3ae5b6a7f689fba8245b9ef1e003b4da8b4350667ddfd2e66e317aae4f5f747ca4cfb37bf5f281f75e7fcbff508e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915614, "uuid": "2140b861-3c62-4710-bd0d-0539072f7aa4", "value": "T16A45872809FC0AF245B1F1ED9FD4E753BD8488E6AB049D99C2838B89555391720EFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915614, "uuid": "fa9751bc-b178-446d-859c-6cbf7c13eb97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915614, "uuid": "b7511505-87c3-4021-9a5b-a3a90a5671df", "value": "12288:0x1MOEAl0VePTzEomC1e6guRInkhAu1B/DNrRhhXbb0tuuZR1r3MzSSV93:0xyYuKz+IR7AUxrRhhstu2mSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677915614, "uuid": "8ac526b0-3b34-4aa5-9ee8-53bc1d1e001e", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677915614, "uuid": "9b1c6a94-be94-4f42-b114-f42a3178bf49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915614, "uuid": "2f671d05-d5aa-4486-bd9d-2ed395639b27", "value": "569d7baf983eb60d8151404f52188b6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88c4daf-ba27-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677891528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891528, "uuid": "c1189c1a-37ab-4759-8ba8-ec90c67ffeeb", "comment": "Malware payload (Mirai)", "value": "efbf9d728d6990528b2f2f8e0afd4593", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891528, "uuid": "62cca6eb-63e7-4456-8f30-bcec4570397c", "comment": "Malware payload (Mirai)", "value": "c360bcb74aafe3980b11ae4c18407a363846d113e9515d7c0d4a8adf7c7c0bc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891528, "uuid": "1f5b4494-7ce2-4a54-8360-0ec028d1b517", "comment": "Malware payload (Mirai)", "value": "04ef4b8c73c48665b8114cf38829e031a3b1dbd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677891528, "uuid": "b2ceeb37-affc-4f4d-8dd2-0ea25421e58f", "comment": "Malware payload (Mirai)", "value": "75cd32ec1dbc926359ad1379eeef672673c0e7028162fda518c4910d931b1d743f476723e069af5866b4b7f0d13259e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891528, "uuid": "118efbd9-6080-4176-8d3c-509c33385531", "value": "T1DBD2E1F5FB47CA8AEA98097ED2EF661962AF00A1C6FF7B274E80CB01514B11C9580DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891528, "uuid": "0ba78631-2fe6-49d9-a1fb-92d9686ca723", "value": "768:K1HlwR1KmXGVlPMDhKuTQoPiH1XB+hxMK9bvIFW7:QqTKUAq6zH1Q775wE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677891528, "uuid": "e56aa033-0aa2-4359-9a6a-efba66beff4f", "value": 29060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677891528, "uuid": "b704552d-672f-47c5-800f-663601cb0fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677891528, "uuid": "7522b30c-74bf-4ab4-877e-66752d6e1535", "value": "efbf9d728d6990528b2f2f8e0afd4593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69296129-baac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948517, "uuid": "e3f5630e-5d88-4077-b2a1-d9184d8502db", "comment": "Malware payload (Mirai)", "value": "933ec84ae473388c8a67fd3dd4f7b77d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948517, "uuid": "9808e9f3-8c44-40d8-b8db-bbbb342ed77a", "comment": "Malware payload (Mirai)", "value": "c409b7cda715d2f08e5937e9dfc1fb02742fcab6eae9de1139b7e2344cc51e1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948517, "uuid": "ee7c9ba8-f734-44bc-85a2-2474a73fdb86", "comment": "Malware payload (Mirai)", "value": "4b9b6555f9383b7a381c0e199fbeb836adf9fe3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948517, "uuid": "2a51cd68-f586-4821-a1fe-9077e15563db", "comment": "Malware payload (Mirai)", "value": "39651e9077a94addf819c86f03d5930445a8044941617dd0267ce911f85eb1705a0dc9d829fdefe335a126bc203950ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948517, "uuid": "5e3eef2c-f5b2-41b0-b2e7-66cceb93a255", "value": "T14FC2E175A561AC11E3609C7FED2D84862B0597BCD2EA7475720D0F9939C068A5BFF043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948517, "uuid": "5231d6eb-8eb9-4bba-aea1-5e302488c808", "value": "768:leFzIGBncjvZcMIxXavR5TLH/AWkGqNN9q3UELur:GAvJmyRLvkGqNgLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948517, "uuid": "9690a46b-1348-4333-9397-25454a023b83", "value": 27324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948517, "uuid": "f6e3c9f3-3d53-4272-90bf-5e426f2fb61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948517, "uuid": "30038d91-e7be-4dd3-85f6-b5557aadfdfc", "value": "933ec84ae473388c8a67fd3dd4f7b77d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc1eb6e-baa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677946213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946213, "uuid": "2a6fb60a-98b5-435a-8390-038f0823c855", "comment": "Malware payload (RedLineStealer)", "value": "9a9dc96618b1988462e32f2c24831915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946213, "uuid": "54bf508a-8315-40d8-9177-76e86ef944df", "comment": "Malware payload (RedLineStealer)", "value": "c56393ba5efe9f493772530698b9f612aeb5d4e6744478f8e09ec1d9d2382526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946213, "uuid": "8670e8e6-6459-4464-b96f-3989b44f9b98", "comment": "Malware payload (RedLineStealer)", "value": "3daf257a29982bf9c0958409672c8fde9a55d30d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946213, "uuid": "80524aaf-56f1-4320-8575-fdef15941692", "comment": "Malware payload (RedLineStealer)", "value": "6b67f0a56bdd5cf326f97032e8f075cd0ee22bc344887d445fe1c1685b9b642448ab5bb09ff40d0df0a6234719d9001c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946213, "uuid": "0ba5d79f-c73a-4b3a-bd55-41fe08b4443d", "value": "T1DD56F173F0DA1471F8732A36B8A26422393E489CE0472DA928F46BD7E572D0D5F4B791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946213, "uuid": "f10c7fc2-95f6-4af7-b331-63df5a208e44", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946213, "uuid": "373a23a7-3666-49f2-bed7-fad6ab527af8", "value": "98304:cxyA8N7tV7MLLTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRR1b:cx3g7t5ETVHJack+YlGlSRR1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946213, "uuid": "9c84a4d0-16b9-4d37-ac86-296f4fda375f", "value": 6425644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946213, "uuid": "9e789aeb-180b-424b-897f-f6f2c53e8885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946213, "uuid": "1c00ce5e-4966-431c-92e9-92cf33595c14", "value": "9a9dc96618b1988462e32f2c24831915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10cd7db-ba51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677909608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909608, "uuid": "841a70b1-7273-4eb4-8fc0-e9e86f8ff014", "comment": "Malware payload (Mirai)", "value": "5ea29a5d7e53de01bf05c5fcca099eff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909608, "uuid": "9ac78362-90b8-4e3a-93cc-d0a8ae1484dd", "comment": "Malware payload (Mirai)", "value": "c64eb8b1b669ec0f1072e0ce87cacd9448b9ebcb8b1813099f178ef3c3b18350", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909608, "uuid": "5fe48a67-0ff4-4087-b7e7-b9ca981f72a3", "comment": "Malware payload (Mirai)", "value": "fb3494b4651c446470198b3e3c8e2e7b39eca195", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909608, "uuid": "17a9b11a-c1bd-4eee-8a66-ccc0c722a38d", "comment": "Malware payload (Mirai)", "value": "d5cb818340b85f77ffaa358865e88b36497dbeb8a23bcf6cca7003e6c0609b44ab3911587fb68b7884effe85829cdf03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909608, "uuid": "6e2a948d-9c27-457a-bb0e-3d7dbd2b88cb", "value": "T15D731985BC91A625C7C156B7FE2F018D331997CCD1DA33429D286FB87ACA81E0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909608, "uuid": "fe81052f-ae47-4304-8adf-443cd0af4813", "value": "1536:Wz2jUYZ/PCY2oHPA5tjt3n0Clzb5fU27iOntZh:WzIB343JDz1M2vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677909608, "uuid": "2322f0cb-c0a5-49e8-a189-fa36d59a1f65", "value": 74808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677909608, "uuid": "e1af0221-3c72-4264-9dc2-2cc17fcc363e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909608, "uuid": "4d0e489d-e7da-492a-a150-4eef3d0a3cbe", "value": "rift.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcef55f-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677963373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963373, "uuid": "60cf5b6e-e7f6-4f3e-a25b-6372ddd2df74", "comment": "Malware payload (CryptBot)", "value": "8e038ccf48cd94b3ad945132b79bdfa5", "object_relation": "md5", "Tag": [ { "name": "8e038ccf48cd94b3ad945132b79bdfa5", "colour": "#1650ED", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963373, "uuid": "f2e45099-04f7-48bf-ac4e-9ff146f8a094", "comment": "Malware payload (CryptBot)", "value": "c65f7813ba0322873383f82fe21d76592f165c78dff188ac0a6c35827733fa4d", "object_relation": "sha256", "Tag": [ { "name": "8e038ccf48cd94b3ad945132b79bdfa5", "colour": "#1650ED", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963373, "uuid": "67a63fe1-8fc6-4302-8cfc-668f6a587c64", "comment": "Malware payload (CryptBot)", "value": "2c58337886402aedd9d51a7efdc2fb9c283896e7", "object_relation": "sha1", "Tag": [ { "name": "8e038ccf48cd94b3ad945132b79bdfa5", "colour": "#1650ED", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963373, "uuid": "e06b1327-3105-4568-8ccb-ecf750a168bd", "comment": "Malware payload (CryptBot)", "value": "0ce3f7d88341f78b784c7df31bdd91edffeee5d61f200a0fea4c35a938c197186379822c29c2259dd7285ce50f11140c", "object_relation": "sha3-384", "Tag": [ { "name": "8e038ccf48cd94b3ad945132b79bdfa5", "colour": "#1650ED", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963373, "uuid": "03158713-e3be-4814-a457-fc4475b34d23", "value": "T1DE0502B23081A0BDF27225B1892DD1E253B67B318531949B32D96D3CFA7C863E713E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963373, "uuid": "9407d237-c7de-48d0-8fb4-638971d60b5e", "value": "24576:SBORYQ6qFgLYn4NBoxa7ZoXtlV3e+CT68gyk80kwjH:4MjHFaYn4NBzFodlNe+CZdwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963373, "uuid": "bdd4e5f8-91fd-47c2-92a6-e69522fcc53f", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963373, "uuid": "fcc37c93-9705-4374-9dd9-01ff619de852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963373, "uuid": "59044fca-4760-4e04-8621-a6885f579afc", "value": "8e038ccf48cd94b3ad945132b79bdfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35940ec1-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677916219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "04aea1eb-e21f-4bcf-b69a-c67470b094e3", "comment": "Malware payload (Amadey)", "value": "81f40a8afc158898f127f509853b4c8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "088637cf-01c9-4414-8611-66bea805a764", "comment": "Malware payload (Amadey)", "value": "c6df64c1c448ccfccd92366ee2bdbb28c413fda5ba9aaaad1648caf76d6950fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "f9afdf90-9d91-4650-b06d-3b24613870cb", "comment": "Malware payload (Amadey)", "value": "1f41f28fdf07718d72791e84c373c6bb615fdff9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916219, "uuid": "d9c60583-cf71-4fa0-a611-2d01fd7ae6c0", "comment": "Malware payload (Amadey)", "value": "c8c296f66daae8198742d242068f6de7ef072519644e9b31d4f00e633e4279f8ae09995db61d0704e466a779d13103ff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "3aa71ca7-7c77-4922-a4bc-2fc2410cabe2", "value": "T14B44CF21B5E1D071DD9B8D319834E6A86A7AFC725635848F33583B6F2C307F246B6326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "9ed217c3-224b-4b78-ab73-bb87328c8d0d", "value": "7678d4c3c7ae7af0fe9e5b0456987a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "1a0e6ccc-6557-4b45-99a7-1d833174f21d", "value": "3072:2gGBWVLdtTuyp9AMlCGjAww/RN7nG/409epf6n3ummj3mh09Gu2v3TQBupbtq/Cx:JBLKA9ZRHw/f4FKSneD2h09o8B7/CAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916219, "uuid": "6b3e938e-c0a4-443c-aef0-1b58537fdc90", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916219, "uuid": "75b6279a-b86f-4941-a8c7-4cd90fa2f421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916219, "uuid": "2474466f-41d0-40a3-83c7-129c14cfc9bc", "value": "81f40a8afc158898f127f509853b4c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb8431d-ba51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677909627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909627, "uuid": "dea44d55-85aa-4d3c-8406-02b88b169b7b", "comment": "Malware payload (Mirai)", "value": "c586027b5448e3707a67a2df76182889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909627, "uuid": "768b5ca6-64cf-4d4c-863a-0ac478b67e33", "comment": "Malware payload (Mirai)", "value": "c8ca734a8a9ef050a2bc76febc06aca6f6c72d186d53e3b9b55c4d5dd7f75ed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909627, "uuid": "2ef98060-fe41-4bf6-bac4-3ba3ba957b02", "comment": "Malware payload (Mirai)", "value": "46cf4dd0978c7f990212d199594cb94e0e7560b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909627, "uuid": "dead4903-7d3f-40a7-9fba-c04b19c504a9", "comment": "Malware payload (Mirai)", "value": "9e7d627487bf1368ef3393cb7a7c3fc79c27099e79c89a56ec6619860a3cb6069831db678c3ae31111648877899fcbbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909627, "uuid": "a553ca58-a4cd-46eb-bdc1-9558f7411e2d", "value": "T133632A42A7080C47D1671EF0263F17D1F3EAEA9112E4F688390FAB4AD6B0E339545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909627, "uuid": "00c68c8b-8a58-45e7-84e8-e8083802c703", "value": "1536:sqhI/LB0d8ODNuxsfYbWKJPjajDctdJUvRIwbZnlp:sqOCNDwUKJxltdJU+wbZnlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677909627, "uuid": "90c100de-1069-47c5-8884-c747af830f85", "value": 73096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677909627, "uuid": "313da905-6119-4a00-93ac-14864b897bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909627, "uuid": "2d91eaf5-5537-41b3-85f5-13801e898f1e", "value": "c586027b5448e3707a67a2df76182889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc7199-ba60-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677915922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915922, "uuid": "e7a4b193-3abe-49ef-866c-08a5ec8bc2d5", "comment": "Malware payload (DCRat)", "value": "80cf5f05e555782227e1f2d278a9fe94", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915922, "uuid": "da57e4e2-b926-44c5-9be5-db473ffbaeea", "comment": "Malware payload (DCRat)", "value": "c975dd821026ab85767c99a7a8db0bc046763394a2b7c5e2cd2ec86f23723698", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915922, "uuid": "adea8cf3-7b7b-4613-8759-d8b834d12b64", "comment": "Malware payload (DCRat)", "value": "dc72f038ad0cb75c86a14a897c31975351becef3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677915922, "uuid": "a8ec5ac9-c4da-497c-b088-a4b38db3222a", "comment": "Malware payload (DCRat)", "value": "37da8f4f6e9e15aeca3e034dd534c69e93db949496b146ac92f50e6422524a93e9671e0667eca3169951b8219d735ccc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915922, "uuid": "f08cfef7-20b1-4dee-80e2-a4e2e339bc7c", "value": "T149F42B7635D814B0F266DF7AC2FABB16DB2BB5327B07564B1221428344622C2DF76D2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915922, "uuid": "c4cbe384-632b-4d2d-9386-c255c7abfb42", "value": "34c076e543b95918c5f8b18c85e7fcd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915922, "uuid": "73983a55-35bc-4d85-b95d-a766e920ee8d", "value": "12288:at68XYEiXl6+xvCHEkmgpzvA5POKAKwB3LGltHYN7UXodqH8fDWwmbz2XGLEi1uG:D8XYEWx6HEhGwE098eIQK23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677915922, "uuid": "362c88bc-c697-40fc-8ae0-af6e174c6342", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677915922, "uuid": "c2843504-7047-46de-9409-8539badc1d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677915922, "uuid": "60d3859e-72f6-4120-b753-7c28c11cc4c8", "value": "80cf5f05e555782227e1f2d278a9fe94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1357e5f5-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969848, "uuid": "79ecb7e2-aeab-4470-82ee-42a9eae6dbce", "comment": "Malware payload", "value": "63c7e3f1f0b29d5b84ea2af2d9c9ffcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969848, "uuid": "f617b715-434f-4ec2-ac30-9e9f96c9f104", "comment": "Malware payload", "value": "cac690dac1ab7f072111eaca623baec624101ee38fe13b3dcd83118826d2f5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969848, "uuid": "335d51b8-989a-4bb6-b251-9ab82484e8ed", "comment": "Malware payload", "value": "f467bb45eb2ea20ae8a070bf47ecf399cf520ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969848, "uuid": "c404506e-b97f-400e-a2c8-58ed2880632b", "comment": "Malware payload", "value": "e11811a231864bc97494e4a7c72a913b0cb1215f28e6832ef84d8e652ab39b08f85cdbb2a22573753b1c87a7a57c84ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969848, "uuid": "7c696d3d-d4a3-4981-9436-ab533cbe8554", "value": "T15F943043D2B202A7F14796F2F4E348C34F95AD4E158C0D16B8C27929D52B419B29BFEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969848, "uuid": "ac28f45b-c5c1-488b-bd37-c4dfcff818d7", "value": "1d1577d864d2da06952f7affd8635371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969848, "uuid": "bd2525c1-e848-4280-9fbe-6b32f8c66c5f", "value": "3072:23ZEw7g2SAeA/e5Kytf949veFFn5wMZ8Jd9fDL8Jd9fDOQQQQQQkQQQQQQQQAQQM:kZEIgH8yp949vefniMZapvapHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969848, "uuid": "d8e94cd5-6725-4b9a-92d0-45aef58ad2c2", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969848, "uuid": "cc2044ad-0c38-4a93-8c29-3551967c42f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969848, "uuid": "f5c86f0f-b017-4995-b210-5645fb0e2222", "value": "Adobe Photoshop CS6 Extended 13.1.2 Extended RePack by JFK2005 Upd. 12.04.2013_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38171491-ba75-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677924813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924813, "uuid": "85f86c58-28b6-4774-9016-23310da4b8ab", "comment": "Malware payload (RedLineStealer)", "value": "6053e850ed0ad036a4b101aa9750051e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924813, "uuid": "717c15bb-0d9d-477a-ae35-4231fdd87e40", "comment": "Malware payload (RedLineStealer)", "value": "cad2128ad37d097fc8eddb017c13391eee60926673fccfe5fa5eb4d44f5c30b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924813, "uuid": "c5f9418f-f518-4139-aa34-109556c018c7", "comment": "Malware payload (RedLineStealer)", "value": "f06a1c0887773e1dd1e1651ba1e26351727e7129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924813, "uuid": "e12c42d1-d3de-496f-a03a-ba0c1927225a", "comment": "Malware payload (RedLineStealer)", "value": "b8baecddf7ecbec1a61498a7f3b0ddf94c901703ebbbbcb278960004d6a13bd86cbba1deded7a2aa0b91a181b6d48c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924813, "uuid": "05bd05b1-ac86-4d57-98c2-d04250a4db90", "value": "T1F384635273975488F8CB8EF1149F95A91C2C09FE3E1F68CBE946B408DB51F685AF8309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924813, "uuid": "e90e3775-9511-41da-84d8-29ff41064cee", "value": "e54a12e0a5a3fa1d995076758d617f27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924813, "uuid": "81495226-fa85-4a81-b656-8a39e2ce8be7", "value": "3072:BmEuMYO2kJcjBlZyyyJvBHddCIHIom76/qZAfoilnBFEatQuSK7kPexq:BmrLuhqIHI17iWiPaatQtKo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677924813, "uuid": "418eb2b8-c661-49fc-aa40-5c6009d1c3f5", "value": 378997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677924813, "uuid": "dd1aed19-cb54-47b2-8ec7-2fd6d129f2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924813, "uuid": "71e74e50-7d3b-45e7-ac92-2703b0be285e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa05c75-ba5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677914590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914590, "uuid": "5e951440-9ba3-4fff-b14e-d43b5d20df21", "comment": "Malware payload (Amadey)", "value": "f7ab2172748e041ae595f162af6b10e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914590, "uuid": "f4fab831-cefa-4911-ba7d-119a3a810fea", "comment": "Malware payload (Amadey)", "value": "cc58a99b6e68b6999e9f18192fa460aae6ec12794200ca3d98bcd24d2422f7cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914590, "uuid": "87f88f78-a8f6-41ad-96d2-e45d4e2e2df0", "comment": "Malware payload (Amadey)", "value": "988633cdd76b32b9047cd751e276ca00cd3e667a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677914590, "uuid": "406cccdd-1262-4b01-9680-cdc697d5f8bc", "comment": "Malware payload (Amadey)", "value": "2921c4c906e045df8bd46acbfef8444fefcbb48737b7585295e89ffba9933e472e23737047d5226a6f9c11369b48634d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914590, "uuid": "1170a7d6-a265-4a75-a754-c622dff049e9", "value": "T1BF936B1030D2C471D97E55351478EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914590, "uuid": "928cec4d-f494-4623-ad45-407be7c6b588", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914590, "uuid": "3eec6629-2dfc-4d56-bdc6-38c10209ea56", "value": "1536:euON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJU7aI89p:euhVZbtvbpxLHoUsYuNhV25LJU7aI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677914590, "uuid": "c95bbcd0-5844-4364-943f-17ef7b273dec", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677914590, "uuid": "0cefbb41-16b9-4ace-ad81-07a260cbedb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677914590, "uuid": "743d271d-2838-4ed6-9534-c620856fd4a1", "value": "f7ab2172748e041ae595f162af6b10e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d059e6-ba60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677916004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916004, "uuid": "c9b62693-ae35-456f-8a28-b8365685f497", "comment": "Malware payload (RecordBreaker)", "value": "256f78ac96001a2a2268dd0627ba4426", "object_relation": "md5", "Tag": [ { "name": "7575", "colour": "#C3035A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware", "colour": "#1F2893", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916004, "uuid": "9318db5a-0b99-4e86-bb6c-af9af1ccd233", "comment": "Malware payload (RecordBreaker)", "value": "cc61eef11b7bb5b3ee46faed1ec58602beb11115a417261149d1c8d72c489e41", "object_relation": "sha256", "Tag": [ { "name": "7575", "colour": "#C3035A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware", "colour": "#1F2893", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916004, "uuid": "f5a1f955-e449-4913-b9d3-f757a062d485", "comment": "Malware payload (RecordBreaker)", "value": "772c2b6056f83f24c7bd4156168f75886ac1b522", "object_relation": "sha1", "Tag": [ { "name": "7575", "colour": "#C3035A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware", "colour": "#1F2893", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916004, "uuid": "d03775cd-7a15-48cc-a145-5ea76191e2d6", "comment": "Malware payload (RecordBreaker)", "value": "8fbe4bc5eef084a3f246e2260330001509a2a92efdb302ca870f92a3ae721232b68d538e07d14270161ac29ea0294ffa", "object_relation": "sha3-384", "Tag": [ { "name": "7575", "colour": "#C3035A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware", "colour": "#1F2893", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916004, "uuid": "be656aa2-bb97-456a-9330-02d39496d734", "value": "T1CA273313444A0E36D809837A55ED4F0DE255594B48E39B8FB331A22F79FB7E88D17A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916004, "uuid": "2d0526db-96c7-475b-8fdb-75ace86bd42a", "value": "393216:ROSsVaEAcQdLIfrV+BK9XGAUgURex/4G8CgjySg13HHUYfIBSo4:R5sAdciEfr4u/UxC45jjySsH1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916004, "uuid": "3a608dc8-70cf-4069-9314-3bc83165c3b9", "value": 21545665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916004, "uuid": "4d6ed5c2-fa3f-4919-bddd-daac5980f6c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916004, "uuid": "e58a92df-ede4-4f90-9071-22f5700270e6", "value": "n\u0435w\u0440h\u043et\u043esh\u043e\u0440_\u0430\u0440\u0440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae105fc-ba91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677936924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936924, "uuid": "c830f4be-e475-41ca-8201-16b6a75c8468", "comment": "Malware payload (Mirai)", "value": "120ca39c3701184adf8092f79ea65046", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936924, "uuid": "9cfb95aa-c1db-4ea7-8ae7-383b3af42b52", "comment": "Malware payload (Mirai)", "value": "cdbd56768e2664832543675545f149740b701adb40f9edc23da3534bb5e84dbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936924, "uuid": "4861eefe-9a9b-479e-8bf6-ffdc10642321", "comment": "Malware payload (Mirai)", "value": "9f6db5160888b82341336d840ff94caccdd8f102", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936924, "uuid": "c5c0e045-51cd-4fce-9f13-af09e2e10adc", "comment": "Malware payload (Mirai)", "value": "c0fa9643be6e5e92d2f09c99658353335e63d3e9fec4a19c6f1c9696df8cb7f1f5deda8f6d52d2fbe004e79e324bdf93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936924, "uuid": "587ba9a0-a2cd-4bd4-ba58-fd3bddbb22bb", "value": "T1E373831ABF654FF7E8ABCC378AA91B0124CC651A21A97F797930D814F24B24F55E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936924, "uuid": "d11e2148-3336-42b4-a075-7450dd368267", "value": "1536:7p/bgkjaVYjj/m6mI7MZz4ODnu9d6dPRRo1/:7dbgkjaVYH1QZz4eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677936924, "uuid": "5ac96c73-e396-468e-a6f2-f7968e274221", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677936924, "uuid": "4f05d022-afb3-46f4-8467-ae68b738e46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936924, "uuid": "b9b5d07f-a419-4344-a1fb-9d709923f94c", "value": "120ca39c3701184adf8092f79ea65046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4514899c-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948886, "uuid": "a7f230a6-002a-4e0e-8193-e56dae40910b", "comment": "Malware payload (Mirai)", "value": "e2c5aafe4d98c3461760fdfd87aa84c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948886, "uuid": "e795b1e9-eb98-472d-b7e0-5204fca04f20", "comment": "Malware payload (Mirai)", "value": "cde2acad845ba331cac7203906f8488165f8052c0dd8d992b5db6e341558a9b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948886, "uuid": "63107ac6-9d3f-4da8-a1cb-970587ef8d31", "comment": "Malware payload (Mirai)", "value": "b77d615158e0331dab5ec5a04a0be6bec9319882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948886, "uuid": "89e86925-0a2d-46f8-9a23-6b49e5a31816", "comment": "Malware payload (Mirai)", "value": "6d3762548d1fb3f2892ecf0691d053fe4b7e46a979bb0fcdfc2d5ef2817a556b09681ff059e3276d420cad4be92e6251", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948886, "uuid": "802b89c0-4414-40f2-a5c0-ca36937f3c54", "value": "T11482D0114180FDB6C9F0C83D9D9687D173B60A74E1FD297A65180668FB8B2AB49BC1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948886, "uuid": "ec7a853d-0bc1-4d7a-8a7c-8af40186f45b", "value": "384:yyHdDxi5VVG8HuvbAO/ezu6wbpU3hymdGUop5hXwK:pQzVbRbzu6IpGs3UozJwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948886, "uuid": "632aa935-cec8-4e7c-b5b0-e0102e8c6838", "value": 18500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948886, "uuid": "165ddc9c-6229-46a0-aea8-d0d6955876d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948886, "uuid": "5bb6e1ef-ca86-4ba0-9d9d-c19736f21d73", "value": "e2c5aafe4d98c3461760fdfd87aa84c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56209a95-ba85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677931735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931735, "uuid": "d37982ec-24f2-4b2c-9a4e-041f56cda0d8", "comment": "Malware payload (RedLineStealer)", "value": "8210be1ce7d53faf31b3485ef5741a68", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931735, "uuid": "6e83f11a-c2f1-4cf3-bcee-93fad6523e2b", "comment": "Malware payload (RedLineStealer)", "value": "cdf2c7d2460732ca3cd40e473f1eaaaa668ca915841d34914d5aa231942e9728", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931735, "uuid": "23e8f8b0-e89d-4f19-9405-463c293dc525", "comment": "Malware payload (RedLineStealer)", "value": "4236414c85e3bb4880b6109a0c2218858b45a644", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677931735, "uuid": "515f00c6-9bca-4ed6-b9b8-ad1f9d0452af", "comment": "Malware payload (RedLineStealer)", "value": "40e1f4e3fdeea5c88c07de1fdaf1b5123b34dfcbfc520bb40a815c02dfca7c4b65ddf67ac082c72c686864b1787c4b7b", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931735, "uuid": "7aa09218-58f8-49ae-a5fe-961b9a69971e", "value": "T1B955E051B4C38432D873113106E4EAB5AA3EB81147659DEF2BE10F2E4F346D1DB73A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931735, "uuid": "b741b0f8-6bfc-42e3-a82a-ec86b581d67f", "value": "0ed70d493c31fe7e849b88ee21606c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931735, "uuid": "e11c95db-bd5d-4f27-a20e-6ba5dada1ec3", "value": "12288:w4SfLvYT17WA+8hpLCduip1ah3Cjy+Rh:w4aQT1hhCYip1ah3Cjy+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677931735, "uuid": "69f772d1-a871-4cf0-8041-ff44117b243d", "value": 1406976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677931735, "uuid": "4e45b5c0-bd1f-4b1c-a64d-cafd71f83610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677931735, "uuid": "2faabff5-dba9-48a7-a233-cc13935a138d", "value": "8210be1ce7d53faf31b3485ef5741a68.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e732635d-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677970204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "1483632c-473a-41ab-8eda-66a79cb6fc86", "comment": "Malware payload (Mirai)", "value": "14a47e0ecc8157801602f0c62ad6e68f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "33cc7184-5f77-4bb2-a837-f41c71a55746", "comment": "Malware payload (Mirai)", "value": "cef4604abbdc84a03bfad1f0d3714105a2db2d968c495c84eea5f8c017be6aa6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "74ffdbf6-288b-40df-aaca-9b14af1c5fc6", "comment": "Malware payload (Mirai)", "value": "9787212b68602a6d2c76f5c6efaf368775c2066a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970204, "uuid": "7a44429d-bab9-46e1-af83-644658ab92b2", "comment": "Malware payload (Mirai)", "value": "b6601fa248d946456cab3bdcb310ff291fd41329281f29d15cf1dec7ec2329dcbdf70c072d388dda7c98aa074ca1595c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "dda8649e-3b84-4faa-8afb-911681a2678f", "value": "T19133F101E2415D73C5085C3B90EA99883A942AF8E0A2F437726C07FD5795ED6EEAD12F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "64394d4c-ed76-42f8-9da2-2394e41e6d6b", "value": "1536:gHRb7hjdQFf8JQ99Hk8KSgN/XOf3LVLrW2y:4Vljq2evQHXOPLNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970204, "uuid": "e250c899-6d62-4005-894b-2ea07ac07028", "value": 52536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970204, "uuid": "6fb32d09-e700-4d04-b59e-59adcb702f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970204, "uuid": "bdf813f1-19de-4e71-ad7e-c2658daee67e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa086bd8-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677916978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916978, "uuid": "e4607ac8-4a64-40be-932d-6def3ba892d0", "comment": "Malware payload (AgentTesla)", "value": "6c2ca3d7accb6da47d068b0810fbce69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916978, "uuid": "41797351-6dbf-46fb-a11c-19335453a6b7", "comment": "Malware payload (AgentTesla)", "value": "d03b8c0fcbbdc16e4c7d5794c037ad639ce4c55aa42fc1905c179c4213d0b04f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916978, "uuid": "7ab759d7-e56c-4c8b-a53a-157c892ed8ae", "comment": "Malware payload (AgentTesla)", "value": "4777ec71b0afe86075499b31b031e7944165679f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916978, "uuid": "e00d0c83-39c3-4f7b-ae6a-e62783d24083", "comment": "Malware payload (AgentTesla)", "value": "9cc3bd8f4ce02165e34456315fca22bcb69f043a305ad7fda179a7c5451ca2dd28913297057b33aeec8dafff38b44b63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916978, "uuid": "881a2613-5c5f-4fab-ad5b-cfa4fa85b834", "value": "T1F045A82809FC0EF245B1F1ED9FE4E753BD8088E6AA049D99C2878B8D555391720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916978, "uuid": "22e973c7-69c9-44e8-98b8-ba9794459e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916978, "uuid": "2c037fbd-2667-4211-8b43-c3f3e0ecd0af", "value": "24576:qlLJ4SNTHDKDqe9Cre2xZBpyirq8YdSS:cLJ4SJDKDN9we2xZ7yiW9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916978, "uuid": "932f33c9-1a48-4f73-a85d-07848912cc38", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916978, "uuid": "5869914d-566e-4898-a09b-726c06622c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916978, "uuid": "4984c640-1461-4cb8-ba95-ccfe9465701e", "value": "6c2ca3d7accb6da47d068b0810fbce69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03045723-baaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949635, "uuid": "3334bc48-7745-4d47-90f2-344e9d3be2c7", "comment": "Malware payload (Mirai)", "value": "59a0ec7d43716f9518fb8128df3078de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949635, "uuid": "26db2059-a826-4524-b383-6031e112ec5d", "comment": "Malware payload (Mirai)", "value": "d0c3c58c13fd97a0dcbae4262e69035d370f0fa2e4003d43fddaba4ebdbc7655", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949635, "uuid": "23dc6ad5-2bd7-45a1-b1e2-28903ac9d6f2", "comment": "Malware payload (Mirai)", "value": "07b4a933b43fdfc51abdd01170c884b842b5271b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949635, "uuid": "5c02102b-5bc0-478a-871c-54d338fe43e6", "comment": "Malware payload (Mirai)", "value": "b67eb883edad5e449f8aadc315422263add0ad05611d4f65051c53404adab3b4417be97e79402764bc6f6dcf38b57749", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949635, "uuid": "f2942034-deba-42b6-8adc-95801699dd15", "value": "T14B530856F8818E11C5D412BAFE2E118D331757B8E2EF7212DD206F247B8A96F0E37916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949635, "uuid": "eed64c1f-1291-4583-b130-6e0720c6a8c1", "value": "1536:YknntSx98IV3fJ4lCGxKTR4qklzZIWieZdr1hs:NS/8AJqCGMTR8Zdr1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949635, "uuid": "c959477e-c5f2-48a9-a2a7-c6118d1b12ce", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949635, "uuid": "277f1ff7-1cdc-4c64-804a-8cedb2d7c537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949635, "uuid": "eb058742-a66c-45e3-b019-63e3fdcb986b", "value": "59a0ec7d43716f9518fb8128df3078de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21b3b62-ba6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677922011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922011, "uuid": "001fea99-bc28-48f3-989e-69a370cd6c0d", "comment": "Malware payload (Mirai)", "value": "1aedcbf6d8fa184176596c81a200da2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922011, "uuid": "6cb0b0a4-c64a-41d4-be8c-5be525d4c5b5", "comment": "Malware payload (Mirai)", "value": "d16d43f3708a155bf00790a8b4866717ef78c83255684493b8fea523f3d62bbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922011, "uuid": "05dc5c51-e107-4c49-aa69-3e50816e13b6", "comment": "Malware payload (Mirai)", "value": "b5cbfbd9fdb25d3acf84424d15ae79606208ea4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677922011, "uuid": "579c17bf-1055-4773-bfa1-29dfc2f8cc9b", "comment": "Malware payload (Mirai)", "value": "f327477d72b28fffb22153fb7cb6550492c304b1040540dad38d11bcc8ef8bcd341b9f210839a194092bddb3ec840a73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922011, "uuid": "d2e5f0d9-6fb0-4a88-89ad-9440eabd129e", "value": "T128632851BC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D37A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922011, "uuid": "7e723301-e1b3-442f-bcf4-53c90bb7c6fd", "value": "1536:ONKlxkmiig51kRmO//kWUzrbiAsDwY8rNRuVAvvWK:ONDWzk13biAsDHaJvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677922011, "uuid": "192f5ed7-383b-476e-8aa6-cec072f8b26f", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677922011, "uuid": "8c911244-5b36-44f4-b2d8-e3555333d388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677922011, "uuid": "54bb9f7f-f86e-487e-b718-2e77cc9c33c1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ce1fb0-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677923143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923143, "uuid": "9e983759-6067-4d4c-ace2-f1d56a02f27f", "comment": "Malware payload (Mirai)", "value": "8abe072ad3569ce1fc180316c2287923", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923143, "uuid": "6b5d5fd0-0e16-4bda-ae78-4c8412eacaa3", "comment": "Malware payload (Mirai)", "value": "d1a9c1a2f085c39f49bc7d2882a352f4e94972b67f8ea22cc8646a7ae23c8271", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923143, "uuid": "9d7af408-c491-4441-aa1e-0b8f0dd5f8d3", "comment": "Malware payload (Mirai)", "value": "0369d47129d4ae2c9d45db02e9d6f95427a40de9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923143, "uuid": "32328b5a-6459-4082-a974-3222d0e8aec1", "comment": "Malware payload (Mirai)", "value": "c45333aefe72e2ec57a406123118dd378201e3e3886a833b81166775cd12f76cb096784ac9fadc1b52ebee21c4cfd3d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923143, "uuid": "d100e3db-f15d-475c-b470-779eb28ab532", "value": "T159438D37E96E1E74C04641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923143, "uuid": "68e63bdf-537c-4c8c-a2a2-81259053b5dd", "value": "1536:Vaa0brW/Od9hlCR3KEgKYXwKEpPDCMC2+WW:Vv0brWGd9X5EnYypPDL+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923143, "uuid": "6ed5271d-38df-4e67-9c2a-5ba24dad915e", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923143, "uuid": "114ff2cc-ccf0-4cce-870a-88f9e1af1af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923143, "uuid": "faa7165c-1d9b-41fc-878c-2e3967da1cc9", "value": "8abe072ad3569ce1fc180316c2287923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797c5daf-bac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677957135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957135, "uuid": "1093b14b-1489-41b3-841c-13159c78a1b4", "comment": "Malware payload (Gafgyt)", "value": "93fad5b89699c4d4dee9e092f12c80d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957135, "uuid": "98fa2209-86ba-4c22-9a4f-39e617492f83", "comment": "Malware payload (Gafgyt)", "value": "d1c6a34c30dd00a4e70bf71221f6503b98f44fd220bde0bba1a85d06d4d5ed8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957135, "uuid": "49e34c76-02ba-42a1-8f91-5ccaa89f7188", "comment": "Malware payload (Gafgyt)", "value": "1ff3be41e7af270bc854e3ddf63d769b64772fbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957135, "uuid": "4bd21fd7-72fa-47d2-8a79-0036cb502238", "comment": "Malware payload (Gafgyt)", "value": "e89d19f8be7fc32abcdfd22f15f739c51cf50f10b7cc58519470a37aafe2aecb2b896d2cf98457e7a8443b25bce9dba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957135, "uuid": "de53b125-9f24-40f8-a093-377b59960d3f", "value": "T109933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957135, "uuid": "3891c9bb-de7d-43cf-b310-7c59494043d7", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5e5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/S5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957135, "uuid": "21da559c-5441-41ec-8ca3-40c7fddd12e4", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957135, "uuid": "e38d6bdd-1352-49f0-bb09-34340fdf7253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957135, "uuid": "3a100483-9fef-4800-b382-3140fd1c392a", "value": "93fad5b89699c4d4dee9e092f12c80d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c63cad5-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948872, "uuid": "4ad18950-b51b-4277-8bcf-1e29390db1c0", "comment": "Malware payload (Mirai)", "value": "7c5143b0667b834e428bd8b071d2f0e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948872, "uuid": "0e31667d-7d87-400d-994e-26420c554b57", "comment": "Malware payload (Mirai)", "value": "d1d8160b88381078d2c6821c9e333bda13df4aef456a0a8307ddf22f65a3047c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948872, "uuid": "243d482f-19c5-46fc-8ced-ff155716e24e", "comment": "Malware payload (Mirai)", "value": "4b735759a4ef5861048d9d06e2164b82628e6171", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948872, "uuid": "7143a0f7-e2c1-485d-a70f-99b11980b118", "comment": "Malware payload (Mirai)", "value": "e0212c3fffbfcec5e645e4996024de0cdad319b3e15553f0f7f05af710a17901c231541d8291282fa910d4276f29a711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948872, "uuid": "6ff1f37d-24ca-4b1c-8efb-ae37ad0ca30f", "value": "T1AE332AC0F98BC8F5C807893090A7F33FCB71D8794175E6AEEF49AE65DA27641421628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948872, "uuid": "5b8b0868-64a4-4a3e-b289-e56808f6af57", "value": "768:EwE9mvya0ZLpI62ZiFGustCVoic/uyA0esdgThlz2fBVEv6xkMSm2:JSlLI6qiMuOCVofmgu3z25VXxkNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948872, "uuid": "2a5ae390-474b-41d8-91c7-c46580745649", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948872, "uuid": "e479d76f-ebe5-4e31-a082-22905b64b63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948872, "uuid": "7fa2a3e4-bc7c-49cd-9972-ef2eb86aa0e1", "value": "7c5143b0667b834e428bd8b071d2f0e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7a740f-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677962995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677962995, "uuid": "8800beec-db45-4479-89cb-a5c1233327e2", "comment": "Malware payload (Mirai)", "value": "3ddb102ff6d65e936cd5622834ba515b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677962995, "uuid": "2e057426-258b-4d96-8912-d7f5c238a559", "comment": "Malware payload (Mirai)", "value": "d3b359fa6e3e0b12971983ac38531ec035456d081c026e7173c0cea19445cdd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677962995, "uuid": "3763b7f4-361f-4395-bb9f-2b44b7c6fe72", "comment": "Malware payload (Mirai)", "value": "b4a176b294b1d03fdaa8032294c472508fc56618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677962995, "uuid": "37dd8c77-0de5-4fb6-b796-a35154aee4ff", "comment": "Malware payload (Mirai)", "value": "a01bc4569d40b82bbfaacd929901d19b60811b43299a3f241d612f88c2678dc1562700bcf3783226e3b3e87e76094b78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677962995, "uuid": "00303d9b-0e13-4a10-998b-c3260a52a510", "value": "T16573A60E2E218FBDFBAC823547B78E21974833D626E1C585E19CE9015E7434E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677962995, "uuid": "7c3538aa-2460-4b9f-b7c7-e3187f5df240", "value": "1536:prmprU9Xqao6BglsYBwm0bNbUO4JWF/jeQ1yHhGvTQdHT:QpryXHoFss0bNLFHyHh+kdHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677962995, "uuid": "f98a2b15-08df-4a20-a049-087a7c200d96", "value": 77564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677962995, "uuid": "00e9c091-12fe-41c2-acc9-2aebfba09b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677962995, "uuid": "1f8251e5-8c3c-4f97-b200-010d134524d1", "value": "3ddb102ff6d65e936cd5622834ba515b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0351416e-ba6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1677920429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920429, "uuid": "5fcfe3ed-d806-4bde-8e17-ddc3a5274a6a", "comment": "Malware payload (Gh0stRAT)", "value": "88bdf5c6a9756ae6d4c3b3024954dd73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920429, "uuid": "73d4d8d8-c79c-48f0-bfd4-96fb471c3cc5", "comment": "Malware payload (Gh0stRAT)", "value": "d3e842a19d952d896bf00b7c9ae1cbdd9ca4813940f709f77abf3e45f6695951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920429, "uuid": "8ce3bce3-0830-4f92-a4c8-1c4a508e95c8", "comment": "Malware payload (Gh0stRAT)", "value": "d36a52b24d6b3dc5862540477ccac7a03e4e5590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920429, "uuid": "ebf6f1ea-4df7-405b-96a5-2d17c8f8e0a7", "comment": "Malware payload (Gh0stRAT)", "value": "6d510bc53c35ae50344c303c721dca63544d5d2ed4dc13bee2885b11610dc39d6733b0cebefe44eaf670f2fd54299e85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920429, "uuid": "be9727f7-d167-4e55-87ec-b65d0c109d4e", "value": "T151A4AD1233E0C877D396B1B4C9C297F5A265AF011F2599C36FB1370E2D721ADAA32E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920429, "uuid": "e7d028fd-ad45-4d66-9827-e33a97fd0f83", "value": "77eef4e097d1e4bdf8b3e7692e2593aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920429, "uuid": "796d8bcd-9875-48ba-980f-1af46303e7ab", "value": "12288:bkXOs/EQaS77z/t705Hux7xGTjCbqWd+YLMU:c/EQaS77TR05OxdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920429, "uuid": "2099ffde-be9d-440c-9a8d-94a30f024711", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920429, "uuid": "99d27711-f0f1-4d41-a7d9-3173af892396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920429, "uuid": "52ea447b-d114-4160-8359-c8ccbb6d4af2", "value": "88bdf5c6a9756ae6d4c3b3024954dd73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4f8dd5-ba6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677920953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920953, "uuid": "45679180-2028-4d04-9e9c-94c940a2bb95", "comment": "Malware payload", "value": "8a23352b3ac130d72164c570c918c19b", "object_relation": "md5", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw - RD4432", "colour": "#98CAAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920953, "uuid": "f6ff974a-4986-41e3-8303-5b10ec25e7d6", "comment": "Malware payload", "value": "d4a358c875ab55c811368eabe8fa33d09fe67f2d3beafa97b9504bf800a7a02d", "object_relation": "sha256", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw - RD4432", "colour": "#98CAAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920953, "uuid": "f0e74222-bed2-411f-947b-4e8505f44bea", "comment": "Malware payload", "value": "6bd76ea4be3759de48e9d7631809aeee4c9fba0b", "object_relation": "sha1", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw - RD4432", "colour": "#98CAAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677920953, "uuid": "8d8b4333-c7cf-4112-af90-3105fc596a27", "comment": "Malware payload", "value": "1bbbe8701dc31aaa6b76bb7e2565ff82aa87acf4b10f541c19d7c2b2a5b4cff87238e02206aed383e855739a7719edc3", "object_relation": "sha3-384", "Tag": [ { "name": "202lg", "colour": "#11B033", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw - RD4432", "colour": "#98CAAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920953, "uuid": "509b9c5f-13f5-4508-9bba-0bf0b5b4f973", "value": "T11335332C9156E424A556AA27D2F6908CF0CC4E4D339BD64B1A69C2577F82C084FE3FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920953, "uuid": "41e2293e-7879-431a-8893-07588bfa3645", "value": "24576:JZzCKHV9S+3nMRAMiP1ShTBEOz+rwadpnO1WXRFaw3d1OmG:JZLHVk2PPGVEkadpwWBI+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677920953, "uuid": "a58665f7-4c4a-45fd-8672-0d0bae19e50c", "value": 1088906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677920953, "uuid": "310a41aa-1aeb-4826-b381-dfd781c725c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677920953, "uuid": "a0ae2f66-d984-45b0-9b5c-28415f990a66", "value": "requested_documents_714407544541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe74e8c-bab5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677952448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952448, "uuid": "2e87308a-0d50-4f91-ba1b-17e02719c8f8", "comment": "Malware payload", "value": "2e382c3e088cf48f3d0a08b3c57f23f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952448, "uuid": "1a1fa855-048b-4112-b709-604cc5c238f7", "comment": "Malware payload", "value": "d504a61cc2998c7f65cdc49eb68dbfe3c80ed439c2e197b275ea4c9d684f28e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952448, "uuid": "9c38f34b-60e3-47bb-99be-3cff9388ea16", "comment": "Malware payload", "value": "2f16f416941b95f2579f25fe876c64e7861b34ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677952448, "uuid": "387124a1-f70e-4e78-be70-7f4477261cff", "comment": "Malware payload", "value": "41de47ff288285d68d9e4d3e2ca8b15a4b68edeebd1b3a502fc5157a7b518d256c87b44c51e692596a6d446c9dc540fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952448, "uuid": "e5f9ea30-84c8-4385-b62c-aafb692a2a1f", "value": "T10E5633D417B024E5FA3A2137B452A13DB3E73C098761C1DF8B25B6163D23AD439BAB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952448, "uuid": "73f61146-efcc-4c24-a3f5-cacd4735fc84", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952448, "uuid": "f945f5dc-53b3-4bed-9f6d-d7e540cadac6", "value": "196608:dVzINJAT8UXlVh0bYofG7rYnRluDYxOv:LIvrUXN08GaMnRlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677952448, "uuid": "e413a7ad-7b43-40da-ad72-038f00d2ce45", "value": 6462172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677952448, "uuid": "7de99860-a7a0-470e-b765-09b95aa618ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677952448, "uuid": "a3cdad0c-ba3f-4507-9763-fa056f1bc614", "value": "Runtime.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde1ab10-baae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949626, "uuid": "d33dc0ad-7d50-4e27-b6df-38a970657a0a", "comment": "Malware payload (Mirai)", "value": "0a90d21d957ca3538db9b809d4ce78a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949626, "uuid": "21bbf5dd-8853-43f1-8c40-55eebfdc296d", "comment": "Malware payload (Mirai)", "value": "d6e023927d969bf6120d7bc7244f58116e0eb4c7cb82442fb38375e2dc1c7270", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949626, "uuid": "e03f7765-4289-4eb8-b620-6cd60ffb3199", "comment": "Malware payload (Mirai)", "value": "abc6043e0e43470ceea1c4e78a0923135d6d683f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949626, "uuid": "30cff203-8195-4977-9c5f-da4d6823cae1", "comment": "Malware payload (Mirai)", "value": "e30f05eb22effa3d7238f583074f8596b7999110c4d168d6f9536a9db22be2d05c2d36b96881915c5c6616a28fcc0acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949626, "uuid": "1b4792b0-8267-497c-8bb0-c339dd2c3cb8", "value": "T18263871E2E218FBCF7AD863547B78E21965837D627E1C184E19CE9011EB024E645FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949626, "uuid": "52a00c16-8a99-4d7d-9fe8-a9de4138f469", "value": "1536:O/Ogc2i9L05qjDcf7kXtIgIhG+DYSz9ZQGPp24/aa:O42i9LOqjDcf7YtIgIiW/Pp2oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949626, "uuid": "98f07e9d-f25d-4d66-9882-4011a2f71a7d", "value": 67936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949626, "uuid": "b1b1008f-bbb5-4af7-89ca-f5054ca4fc74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949626, "uuid": "da429092-ae1f-4389-83b4-f5b980f2123d", "value": "0a90d21d957ca3538db9b809d4ce78a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61178e57-babd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677955805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955805, "uuid": "f18cea8b-41fe-48b4-8de8-6f6ab53b4d27", "comment": "Malware payload (Gafgyt)", "value": "05bd6e53484ad98bad7a412029e8bc06", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955805, "uuid": "f45f48e0-21e2-4f9b-af71-cf6314989a09", "comment": "Malware payload (Gafgyt)", "value": "d815ac6601f5d4355f7970d33ff0a6ecdf741d891fe1e89095df2c9de3689bfd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955805, "uuid": "a4c5c1ed-4d72-47d7-af52-312318201675", "comment": "Malware payload (Gafgyt)", "value": "855e875b7867f5b3f3b2a8742ba2866a07149b87", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955805, "uuid": "b3456652-4968-441f-8314-7284a838979e", "comment": "Malware payload (Gafgyt)", "value": "9414f678368760258edaf1b6384526fd861c39baa35456f0d908632719c5e640620bf71e3a4332f92bfc7cb77c02c962", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955805, "uuid": "738fa325-197c-4539-832f-39ad17c065a0", "value": "T193A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955805, "uuid": "072e2a93-bb15-44b9-afed-803b987e8600", "value": "3072:7e9h9oZ15hvFfKufS2faYj0+rQ0Knm4XATe:y9wZ15hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677955805, "uuid": "cab1fcc5-6c17-4503-b72c-b47c0574a826", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677955805, "uuid": "f9e1ff40-d622-4807-ac5a-3ebc79a7e495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955805, "uuid": "3771548e-9963-446f-9a77-755483bd7b09", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a4cc54-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677916939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916939, "uuid": "02fe5df7-2ff3-4c41-aa58-73bc5217b27d", "comment": "Malware payload (Vidar)", "value": "a5662362d94475dcaf41d9b176d2b7d9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916939, "uuid": "1bb8d230-8900-484f-9c8a-d6054825ed90", "comment": "Malware payload (Vidar)", "value": "daeb55142c78a55a7f9b43b839d3d0708c8f0739fe260366070330876e72a340", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916939, "uuid": "34256583-4ef3-4582-a487-ecc5b1ecdc7e", "comment": "Malware payload (Vidar)", "value": "8c0c72037da2f61a8d59992616f04fe348a26b72", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916939, "uuid": "7ceb3023-7fff-4e42-86da-90e3ecff6b32", "comment": "Malware payload (Vidar)", "value": "318c565d997f26d24730b3f89f3124fb29084ef721bd435026b6ea155bb26db1a30604c12652bc4fb346a113b3ba1b89", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916939, "uuid": "9a4f194a-e80c-41e2-a23f-4b6d711de85f", "value": "T15976CCD13B44C127D94729754E67A39E6B1DFCD1AA30B08B7360F72E5A38AD3AC69301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916939, "uuid": "8fe51791-13f9-4222-b8ca-14cd2bcb3f12", "value": "196608:IWhQpbkME/PTDYQ4n0i7oh+9iieNQOYfBSCo4Pz:EKzP6d7oUiilSj6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916939, "uuid": "99bbc380-2fe1-45a0-9e88-1f62aa211460", "value": 7589888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916939, "uuid": "523aacb1-b5fa-4fc6-b310-aed5391ecf53", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916939, "uuid": "bf626e19-9df1-45a4-a8ed-f5da8818a226", "value": "a5662362d94475dcaf41d9b176d2b7d9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefdb6c0-ba51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677909604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909604, "uuid": "e8bdb5aa-04f9-4be6-b3b3-e91bad117776", "comment": "Malware payload (Mirai)", "value": "1da2f9f7001f17a05983c4a25337285c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909604, "uuid": "7fec0817-149b-43fe-b812-c0fe1015d2b2", "comment": "Malware payload (Mirai)", "value": "dc1f999bc4d792f570ac04ab08e62ec7c6f00b67956839343f6c7df0649d0205", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909604, "uuid": "d15e20dc-9e2b-4cd6-a236-73e67123104d", "comment": "Malware payload (Mirai)", "value": "d649cf15d1f53ce1bea1f7ca1952606c091e26bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677909604, "uuid": "b4b38997-c62c-4db5-a505-1dfee4e048ad", "comment": "Malware payload (Mirai)", "value": "34dd532871a20606ba0413a8a1a66593351b4f32ee59eee2929deee4babcdb9c34be9c54b4e14ecefeb4c833f25acce6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909604, "uuid": "50467d0d-daf9-4c94-be91-95c8921446ba", "value": "T17C534AC0A583E9F2CC01127D34AFAF724E77E57BA077EA86E3D8A937A54550191033AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909604, "uuid": "1eb07ba1-97ec-4f7a-8d49-637b9605f633", "value": "1536:lDQUwOthA06okng+AVP1zw/Ly3aJ8xDxWVu72qVYjh:JRhA06okg+Al6Loi8xDxGYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677909604, "uuid": "99ff1363-93c7-46cd-8a95-130aba2abeb7", "value": 66416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677909604, "uuid": "ecf4d501-78c2-4c3f-9071-0622038c63f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677909604, "uuid": "266e74ec-9605-432b-8dce-bc1d53a5ada4", "value": "rift.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e8beb1-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902123, "uuid": "38681d43-1edc-4d7d-bbf2-e5ab244d92b7", "comment": "Malware payload (Mirai)", "value": "e33abe7669e4d062df9c7bcfa6b86ed3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902123, "uuid": "06e6f475-c810-4f1f-8ead-1a8a70a660c5", "comment": "Malware payload (Mirai)", "value": "dcd02eaf683e1d27826b0c898dcb77bc6c7b15a9b5404e539d4070215ec190ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902123, "uuid": "d4466fb3-5a2f-4a50-9074-1574bc0295e5", "comment": "Malware payload (Mirai)", "value": "feca1a25fee45eb69f2fee7574354bf137e769c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902123, "uuid": "92262fb7-a446-4230-b1b1-c2db4505cfc5", "comment": "Malware payload (Mirai)", "value": "c8e60f89c2f445e5b8661674fe62ea18a93004530b9169c15b60184eb5948e9df022a456ae3ed054b475c245f441e5fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902123, "uuid": "b1a2b3d7-0f88-48a4-9316-d2b805bc44a2", "value": "T1A8436BC4F643D8F5EC8705702077FB379B72E1E922A8D643D3B4D932AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902123, "uuid": "0c8ad9b2-ceef-403b-8ebb-5ef01c4f50a6", "value": "1536:JeESt/basV2rcZhG6ySN7naORe9xzWOIaEjrqMms:JeESt/basVTgS7naOw9BtXESV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902123, "uuid": "4186ca13-a793-4b5b-a63e-4344bedee0f8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902123, "uuid": "4e5ce25d-33b2-4400-a635-383530d6d4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902123, "uuid": "446f5584-a08c-4616-b719-a0dc01a1b1ae", "value": "x86-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bde0702-ba32-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1677896123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896123, "uuid": "46a06159-0d58-4e0e-82f9-4211a237fd13", "comment": "Malware payload (AuroraStealer)", "value": "c1e0847bb381373f3206d346cbe36048", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896123, "uuid": "1d2f93f0-3ece-4fd6-b003-0d5cdcdc891a", "comment": "Malware payload (AuroraStealer)", "value": "de6a505d15313427ffff2dff04ab85cf7d2d387f3ffa43bce0e4a74beaf110e1", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896123, "uuid": "39fb272f-d318-4d9e-b474-f50a67d7e16f", "comment": "Malware payload (AuroraStealer)", "value": "7ca2f998482d8d9617844547423ec84f9471fbbd", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677896123, "uuid": "4522c27b-b390-4cf9-8009-3c5f8029fc7f", "comment": "Malware payload (AuroraStealer)", "value": "fbe61e525e6018468db1badf542d16edc4405b2fee6c208ada94a0ec228189399a1bb00e9c73f79bb99a6816d88652f2", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896123, "uuid": "d60b5629-ce71-40ab-8816-92baf73efc7d", "value": "T1F4F51843F94485E4C1AEE1308A669223BA703C885F3163D73B50F7B92B777D45A7A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896123, "uuid": "dafcfe30-311d-483d-afc7-a511730ba743", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896123, "uuid": "36d59752-2ea2-4619-b95c-4a79d3ebf77e", "value": "49152:VoXYiVIj11zpXVLuuK/wRPBU0aD5EjN9aLDdIHNm7Gplk1oG:VobypXO7EKLRItmKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677896123, "uuid": "bcf97c36-808f-4a9c-ae63-4d8cc1a46266", "value": 3515392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677896123, "uuid": "4e84c69a-ea12-4504-93c8-a0c05b9c93b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677896123, "uuid": "efb333d7-e451-4aba-a4df-0eee888e3748", "value": "de6a505d15313427ffff2dff04ab85cf7d2d387f3ffa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c34840-ba74-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677924321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924321, "uuid": "d7b31f09-b7d7-4ba3-85ac-6a9fe089d08b", "comment": "Malware payload (LaplasClipper)", "value": "734ba2bdb55866a9702295823e3230a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924321, "uuid": "34ea7cd1-3fc7-40e3-8939-98bd5a2a82bd", "comment": "Malware payload (LaplasClipper)", "value": "de905b4833434a3f8065f6b05b28b0d44465386052f86223fbdacd53b0278986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924321, "uuid": "3d21929d-7e91-49fb-a7c8-a8be451a40a2", "comment": "Malware payload (LaplasClipper)", "value": "080b7829a8c4360502bdd6f40b29f9cbc43445ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924321, "uuid": "c24842ce-a624-4131-9ca6-20c4f4b9339a", "comment": "Malware payload (LaplasClipper)", "value": "f8eb5a13398a5c073222899806f6a4f568c34783c2ce0813696942bf69ff67efd8e0a82297b3cc94f8b15ad337d7c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924321, "uuid": "ab7d4fcc-afde-454d-bbf1-cfe08892c8a6", "value": "T1B65623A313752045E1E2CD388B37BED971F2065ACF81E87DB0EAA5C729729E4C663507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924321, "uuid": "dcdc1dbd-ebc2-483a-a30d-82a53cad77d5", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924321, "uuid": "0346578a-215c-46c7-99c0-84b15157ca36", "value": "196608:dkDVQDVkqFkfNiFPeWi6Qk8TwIMYS6NZ326fbN:wsKW2NaVkw7z6NZ3tDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677924321, "uuid": "cc87adb2-b381-4eae-902c-ae7d59fc3c97", "value": 6393000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677924321, "uuid": "dc330235-a43c-4a98-8662-ffc380c1bf7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924321, "uuid": "e03770e7-19fb-413c-a001-49d3774c30b4", "value": "734ba2bdb55866a9702295823e3230a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7247f03-ba2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677894129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894129, "uuid": "0dd0b6e4-488d-41c1-8ffb-50e8a46315e0", "comment": "Malware payload (RedLineStealer)", "value": "0c3be9f43be9ab4a7f0a7111d4735442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894129, "uuid": "48dbcc01-cb86-4bea-bff0-68254da66b72", "comment": "Malware payload (RedLineStealer)", "value": "deb0e5a5558198881a52c3b9e0135b49e113057e8bc355e9473106094550fc5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894129, "uuid": "459ba653-d1f7-4c84-8b1f-3969c732c279", "comment": "Malware payload (RedLineStealer)", "value": "0ac3c90b0fba94a81bf07042eab6e835340afec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894129, "uuid": "97309431-74c3-4263-8038-86b12ea828c6", "comment": "Malware payload (RedLineStealer)", "value": "1ec2c236ee2773f1eef497cb7d528ac2b601d26adff149c7692d3dfa9c27b385edc68ac70472c31e873a304f4c884a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894129, "uuid": "bb9d89e2-ea2a-4c3f-abd9-5b4f0a62a021", "value": "T1D5E40257E6EC8132ECB517705CF202C32A367D605334939B2B4E9CA91D736A4A73672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894129, "uuid": "3a2136f4-e053-4e08-b605-e6e8aa85b17c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894129, "uuid": "12ecd8e3-078f-4de3-850c-91ebc3b04f8c", "value": "12288:fMrhy90drp4N9E4UflCeabr6ZQlNqPhHXvGTev1bkg/aYxAGDo:WyeO44+a/6ZQlYPNaWZWGDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677894129, "uuid": "58113c2e-a15d-47d9-9a28-013a7b184de5", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677894129, "uuid": "b3946aea-484c-442c-86d6-b8e3fc2e129d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894129, "uuid": "0ca5c67a-ba64-4587-ae0f-3d50e7e452f4", "value": "0c3be9f43be9ab4a7f0a7111d4735442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db48a63-bae3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677972228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972228, "uuid": "d21e51d6-c24a-4633-b56b-8357ac498bbb", "comment": "Malware payload (Mirai)", "value": "96703a5687838e3d8dd944c7787bc7e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972228, "uuid": "a053be96-6e14-45c2-a185-6a65b531b3d1", "comment": "Malware payload (Mirai)", "value": "deca8927fa1c66461966fd90e040e7c883797b548302979024c665e4ba47a59b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972228, "uuid": "17567cb6-250c-4480-a6f7-2e6730714e3e", "comment": "Malware payload (Mirai)", "value": "bbedf05f937f5de60f10f86082a052eba0d99d2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972228, "uuid": "e4fbb6b0-43dc-4903-9ed8-81357b2f19fc", "comment": "Malware payload (Mirai)", "value": "3f44a3b1c860cd863800849987c1ddadb07c64101b5ef774478c9d546c2e2419e2371cd23d71cddf90a9489f8cbbec73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972228, "uuid": "3e6af279-fca2-4d9f-a5cd-577da4afb105", "value": "T18DD2E1ADDA3A2C46DEAD5C7C07E812F16D85F1C1331CDDCA03211888B9ABADF6C59074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972228, "uuid": "28de9b2b-7cac-4455-8878-61b91b9050f9", "value": "768:E1uUtLrVDsAp6tLFx+1TLu/HVKRJb0WUk:EbDs06tGJaMRok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677972228, "uuid": "cd365330-55d8-40a3-a790-4b6b346336e2", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677972228, "uuid": "b3b2094d-a28f-4099-95b5-4614a82ae3c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972228, "uuid": "453d7c34-be96-409b-981d-08aa4c0aa1db", "value": "96703a5687838e3d8dd944c7787bc7e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9748c218-bae3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677972217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972217, "uuid": "afcbe1e3-6671-479d-8b74-86ca4ba2e131", "comment": "Malware payload (Mirai)", "value": "fd5d18fb234e694d92be39707265d650", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972217, "uuid": "f3e9b33f-625f-464c-a35a-216ff1e5f244", "comment": "Malware payload (Mirai)", "value": "dffcd4d3900cad0f70efc6bfe671f55b90773b4b38c077979bf0a46f9294543b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972217, "uuid": "b491978d-e114-475a-a29a-29945a5aacda", "comment": "Malware payload (Mirai)", "value": "b78ddba66adf72bf9e687676b005f4bae9792d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677972217, "uuid": "1af752aa-13c7-487b-ad37-dfd7b756f99d", "comment": "Malware payload (Mirai)", "value": "565a5d7daa1253542c66022ecb1974ba32589b39f3cbcc323df6d81b260be618d5dbfb244fac088ebbf4769d05711957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972217, "uuid": "80d8c955-cce4-4c29-959d-fce2470afa77", "value": "T17DE2E0BAF2B6D911E2332835BB1741F38B1A0F647B5C649B08B085D1C38585F75DA68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972217, "uuid": "50ee9705-e68a-4415-8d8a-c89a14922fb8", "value": "768:J35qWJNo1ldm1CWrb67cPesdSRgmaAYBSjz1I39q3UEL5G:pBJNMlMzIc/dSSJBi1lLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677972217, "uuid": "e823cd47-dee0-4c4f-b924-b5863b7fba21", "value": 33020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677972217, "uuid": "4e9d9a82-7dae-4d59-9271-67b58fcc2595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677972217, "uuid": "70aba5cf-03ed-436c-8419-8b44cdf6e658", "value": "fd5d18fb234e694d92be39707265d650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0dcf08-ba2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677894116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894116, "uuid": "450b4930-836c-434c-8df8-784e8129f6e3", "comment": "Malware payload (RedLineStealer)", "value": "2cb6b1906191eb5e8beeadaca5158250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894116, "uuid": "0158de7d-f936-4454-b050-721bdd9926ac", "comment": "Malware payload (RedLineStealer)", "value": "e1710bde227f564c560614832808b1d5ed9ad6a1ffa82e4054fc6d5b70654fc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894116, "uuid": "a6e10640-9873-4c34-9627-7a42eda93554", "comment": "Malware payload (RedLineStealer)", "value": "7d593341c069b792b495138f76e52e3a1f5eccc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677894116, "uuid": "f993449a-5031-4819-b95e-46c9c2ec8ef4", "comment": "Malware payload (RedLineStealer)", "value": "545d5ca79012887e5823365f66372719d9207b6c716a7e21962d445c93975d0c28fc64d4ca73b7d505605ef0fc464a46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894116, "uuid": "c29086a8-c6d7-49db-ba11-32466a7ebf39", "value": "T121C40247E3EC9023E8B45B7019F703D31A36BD605B30936A238A6C6A1C735B5A936767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894116, "uuid": "c982aa33-1180-452a-980f-2fe9d8bbd754", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894116, "uuid": "b7d54399-3d5e-4e65-9c0f-aec1763c4d04", "value": "12288:hMrgy90vKDCfNTWProgeLvWzbVbVSncTGa:dy6KDCfNSgabMcia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677894116, "uuid": "dff7663a-3e0f-4888-abcc-a4d100914bc9", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677894116, "uuid": "30511d0a-ed1d-44d3-bcf4-9f10b06bd70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677894116, "uuid": "3d513605-57f2-420b-8c3f-c2e4eb97da80", "value": "2cb6b1906191eb5e8beeadaca5158250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a369e8-ba62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916887, "uuid": "de853e24-4dcc-48dd-82d3-66585774e46b", "comment": "Malware payload", "value": "5bdd39804fca331fc892b95c327832c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916887, "uuid": "5abf5dbc-4904-4b8d-8763-6021aafef3cf", "comment": "Malware payload", "value": "e22e5896a68f8cd86af38064e16f96520a89a22ee07bbc40fde704e11dbf5ccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916887, "uuid": "e510c2a5-4a7e-45df-a507-99a08bb7bd8a", "comment": "Malware payload", "value": "c75bf2f982e15c0dc2e02eecce28272c29039231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916887, "uuid": "596ae1e6-2823-4caa-8564-c27b15083d87", "comment": "Malware payload", "value": "0aac12fa1f65023dc8fe85c7abc34db7c5e0721b052ca952cdd3e5a41f3dcce89b404c2a4b4137f9f2c7ba8b35c4276f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916887, "uuid": "f283b94a-7f14-470b-b5b6-5460a37cf2a9", "value": "T140341201A3E4D473D4F38B300E795737ADA2AA235464639F531027793A33296DE1F7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916887, "uuid": "802e20e1-aa35-4275-8c85-c262a41023d3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916887, "uuid": "eea4b5cb-30ef-4f10-aa9d-57387d493a8c", "value": "6144:TYa6Zzl33NJppDAw+wuJ5vqkAdjTFmaUWxhG6+Usviy:TYTpNJppcwcJ5ykXaz0jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916887, "uuid": "f4dbb305-2a3b-4c8d-ae39-f274b77d6c5b", "value": 248095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916887, "uuid": "3c04774e-91af-4092-ac07-3439b4ff95b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916887, "uuid": "fe9b3193-6a63-442f-8d67-27f453c9251f", "value": "5bdd39804fca331fc892b95c327832c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15aa3b8-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930600, "uuid": "b2ab5e71-ff45-4b3f-b4db-76db1c1368c5", "comment": "Malware payload (Mirai)", "value": "fe7ca3b588e342f79c7814bb75dc24d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930600, "uuid": "1607093f-8153-4678-9c35-b7d14dbbb55e", "comment": "Malware payload (Mirai)", "value": "e436196f047741070c580695f5444e0c2cdd175c88f68affdc9230d09a71c978", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930600, "uuid": "4ad58e41-f139-499b-b485-01f52a0596cd", "comment": "Malware payload (Mirai)", "value": "9dfef53c2b799ab63addadca7d7e6121f3ed0d05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930600, "uuid": "add343d9-c1ac-44b6-909e-832c2a759b96", "comment": "Malware payload (Mirai)", "value": "01b41bdfa1eae84ad9f61d333f5563bb0b462d879663641e2e8ddc78cc9f564960b5678a76397c94f482183ec524a52d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930600, "uuid": "617f4ab3-ae1f-48d7-ab6d-9c38df574e89", "value": "T153534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930600, "uuid": "b1a8b7c2-06ec-4442-bfc3-5debdeeb855f", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQWLiKimfFoktCe3fYRMi:WShU3q7cEDlCK/0DO9i8Fok06fYRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930600, "uuid": "827b490c-dbc7-4b94-8c1c-dd3a7cf7bce1", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930600, "uuid": "2ce45461-82e0-426e-abef-b50b95db627d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930600, "uuid": "4a12aada-a6a3-429c-aeaa-d659b897dc0e", "value": "x86_64-20230304-1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13197a6-ba9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1677941874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677941874, "uuid": "4f5e8e4e-efbf-410f-b61e-816b0b82d3a3", "comment": "Malware payload (RustyStealer)", "value": "35e1653cfe2a2cb545b0f8e6582fb5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677941874, "uuid": "e93cd013-e432-4036-ab43-c2b96e605c9b", "comment": "Malware payload (RustyStealer)", "value": "e48987d3d76db18d7fe6824afb6982315530cd117bc27c88c332d1ea01c31cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677941874, "uuid": "070ec594-1864-4400-8f15-48c2845cbb5a", "comment": "Malware payload (RustyStealer)", "value": "1978e80430c75995bd40d4e7197f5a9406124440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677941874, "uuid": "85560f8e-ce08-4d4a-b844-4fcb79de46c3", "comment": "Malware payload (RustyStealer)", "value": "304d83769e3cc6646bb37d0d3c1803b5f0f138d68db4b0d23dd513ed2da40382dad86c2c5c65e85b55dee53ee6cd7546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677941874, "uuid": "15085cf9-0de1-4ab7-89a2-ae8b62a56fdb", "value": "T17CE43A47F26260BCC56AC07893567133FA32BC4949357E7B5BE0EB302E61B50A72EB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677941874, "uuid": "ca81970a-fe7a-4dbb-b242-aa71df9798c9", "value": "017af7f52eafa48a0616e6ba931e5325", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677941874, "uuid": "bb261ff7-7f4a-4219-8abe-7327f1e0800a", "value": "12288:lIfGpSTDujPPbiABAp2NR1C9Ub9d5rVkkjFUle:lIfJTDUH+oY0JrV3Ule", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677941874, "uuid": "76110ada-1fb1-4374-9ebf-37bd768bff66", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677941874, "uuid": "165c5682-b6cb-4e1f-8ed4-4a4dc36622c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677941874, "uuid": "ebccb139-f937-4df3-a3c8-b59881e0aaeb", "value": "rw_test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146b79ae-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677969850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969850, "uuid": "a84ab21c-dfad-47be-afb4-298140a856eb", "comment": "Malware payload", "value": "a26cfa70556a61b1c0a3c0251ecea80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969850, "uuid": "65230981-cda8-4123-b609-0dd0b232e267", "comment": "Malware payload", "value": "e4ebd8a12c039824c90f23ee142e2437f69028bcb4919ad2e0a6322fd4933eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969850, "uuid": "7cb10eea-9585-42c1-b278-80f1487e71cd", "comment": "Malware payload", "value": "e1e5410ec7a2daad64f0ade5e7c61fda92e754b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677969850, "uuid": "1d3ecbf5-0f06-4e9f-b013-27f6e473f719", "comment": "Malware payload", "value": "13182c8f228178b0f1a310d745d3f10a9e5e19453e9eefafc84a1b23ac57c8a60a7ff799274cfbd6b21668787360bfc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969850, "uuid": "a929707a-299e-437a-bdf3-8697fc435bdc", "value": "T1E0E43391D59AE39EC1882236041A590A91F9DE3BAEC7F36C18CC4CAF1EF0F955ACD611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969850, "uuid": "6d96bf94-c3a6-498a-a8a6-8507a7a4b2f5", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969850, "uuid": "fa47007d-c694-478a-aede-adf01db4dd84", "value": "12288:vyIxZnRjUtvrnTfUDqnuy77il3vtU9N2BI1PxRxVk8C6skQWocSES7qcQ:6I/nRj0vrnTfUmDM3qLPxR3lChFvES7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677969850, "uuid": "c075e463-b986-460c-b89b-795269716303", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677969850, "uuid": "f4bb6878-0e57-4e1f-baf1-e54443ef3da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677969850, "uuid": "86078eb1-03d8-4f33-bf8a-862369ae66f0", "value": "adobe.cs6.all.products.activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2e002c-ba60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677916074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916074, "uuid": "ea9338aa-4383-4072-8e9b-830e1923d59b", "comment": "Malware payload (RecordBreaker)", "value": "974f0e1666ec1f77440453a15c1b4cf9", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-7575", "colour": "#FE45E4", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916074, "uuid": "8a69f939-da31-47a2-84b2-0c905432f7bc", "comment": "Malware payload (RecordBreaker)", "value": "e6184f4c038715256adc9b6483a596ec7f3c3921a981ff1f122b8b47b13f27ab", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-7575", "colour": "#FE45E4", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916074, "uuid": "21d2ca11-439d-4a73-b8ff-300f85eaa4ff", "comment": "Malware payload (RecordBreaker)", "value": "5c06f7304737346ea91497619b86fd9f2650cdc0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-7575", "colour": "#FE45E4", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916074, "uuid": "3b8ab182-cf84-44bf-a28f-69af1160274f", "comment": "Malware payload (RecordBreaker)", "value": "3b85163b94e45c0da987f5adc3946ae3382e55d47072c2e2eee8cfeec31e86070d8630065fe5bd1ddfae5b3469e02c02", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-7575", "colour": "#FE45E4", "exportable": true, "hide_tag": false }, { "name": "pumped", "colour": "#BBA0FE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916074, "uuid": "20c02e17-c879-48c3-9b0b-81704699cba4", "value": "T1192733AD20485F31E93D5AC2730E664B466663BEF06041AC4E4BDB0953B67C77E78A3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916074, "uuid": "359ce158-9a79-4824-b129-3fe531379670", "value": "393216:J642lPacwL9QAHi0i0rPYHAOHqTZcVBaC1M2GqbW1t4+b8XNBhGJ8RZ:khdaci+borAnq9cO4M29bWr4+b8dBhWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916074, "uuid": "a2284848-33fe-41e7-a0c2-048469208fe3", "value": 20421934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916074, "uuid": "d9a448f6-cfd9-44f3-b200-338992ed44ff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916074, "uuid": "af5793f6-1327-47d6-b29a-230fa3096031", "value": "n\u0435w\u0440h\u043et\u043esh\u043e\u0440_\u0430\u0440\u0440.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f16282-bade-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677970207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "795525a5-9336-4a1a-9c27-496e41522ff0", "comment": "Malware payload (Mirai)", "value": "bc3da58f8deed5e718f9c36fb623a532", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "a50f4ef5-f6a0-43fe-b73b-a176e5d58199", "comment": "Malware payload (Mirai)", "value": "e6ed967ea86df5ac62de7fca8c833fee4435083e4499db9f5f02f8848ef0c891", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "4f5c28cb-ce3f-4990-a13d-8fc2011fab38", "comment": "Malware payload (Mirai)", "value": "abe0b0eb9344234a269937938e2ab7ec0a8d4585", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677970207, "uuid": "8bb08998-23f2-4009-91a4-f245a79f16d9", "comment": "Malware payload (Mirai)", "value": "64ed3111c615e14b2206a38e6d6f0fb4af439b2f0c86ca3c6c3e2ad6f4dbcabce5d234ca8cdef3b5294ec47f68114273", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "5145894d-8e42-48f2-8804-446523b680db", "value": "T19743F991BCC18A6AC6E063BAFA6E559D332173F8C1DF7617DC100B04778A91F4D63A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "683b385a-e9f2-4967-8074-182d44a0b03f", "value": "1536:mTamp6BslYK1kdVeGHL+AhT7hSRa3npbRR7qcR785M333:mGmp6F+oL+Ah5G6np7r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677970207, "uuid": "5ef2d0a2-ebe7-45e4-bbde-a7c1c3536cb5", "value": 59832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677970207, "uuid": "f1911f6d-220c-4171-8aea-6bb3427e2426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677970207, "uuid": "b72a029c-5c23-4e55-9b70-279eac1e5e75", "value": "cutie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eda810f-bac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677957117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957117, "uuid": "e1346dfb-d385-4cc6-969b-a680b1244311", "comment": "Malware payload (Gafgyt)", "value": "b448e32063353845e25ff71c34cf05f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957117, "uuid": "41212721-d532-4771-91a3-b8b77546b778", "comment": "Malware payload (Gafgyt)", "value": "e876b6c9ba578bc8c645ec499c99493d603e227ae1e0c342f1c769e68bc7ef05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957117, "uuid": "2111f7ed-c6af-4f5a-bcc9-3d9f58aea002", "comment": "Malware payload (Gafgyt)", "value": "65a563cca6d1358522ed68e9f5ec1b099ece5d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677957117, "uuid": "3c1b4643-6f99-4050-b5ed-dfa4132b579c", "comment": "Malware payload (Gafgyt)", "value": "b411659a6a4900c89bb29915e149d64c19712523a23e417bc7705b3a829d6520236a7b04d5cc2270e63c493c3d486ccf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957117, "uuid": "8cd0b41a-31e0-4952-a1cc-3d520c8611f7", "value": "T1EDB3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957117, "uuid": "86d7afe2-61d1-4754-8988-b4b43dda86f2", "value": "3072:C/4g3Kd1rn5hZmxgA9OKdwwjF9GhsR1Ae:O9ann5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677957117, "uuid": "1c704490-b6e2-4894-bc7b-48b0807ad188", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677957117, "uuid": "3e8da0ac-2a8e-481a-95d9-50f2eac1dbca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677957117, "uuid": "c6c083ee-234c-483f-a647-b382cc028d98", "value": "b448e32063353845e25ff71c34cf05f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6245dd56-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677923166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923166, "uuid": "1e9c89c9-6d82-4244-88a6-48b926676864", "comment": "Malware payload (Mirai)", "value": "a83ad2604cbaddf1517f0a53de7ca240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923166, "uuid": "8fb4ec16-a075-469d-8b25-e85a325a61a4", "comment": "Malware payload (Mirai)", "value": "e8ad0adfb07e3e738365533f3949b36c83f480d5fa45d544444a331f12c89fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923166, "uuid": "1147b24e-f0c9-4278-a87c-c0024d0561c5", "comment": "Malware payload (Mirai)", "value": "f2d3f1635b46a1ff775f54798dccc1e1bd60bbf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923166, "uuid": "a3924da7-7835-4f33-98e7-93c351b0b743", "comment": "Malware payload (Mirai)", "value": "336ea8c543d50c9549a6a96f8dabcf37992f7402c68bb92122aed4466334df034c74f0774bd9e4557c3ff6518186595d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923166, "uuid": "15d5a991-6ae4-4afb-9a2c-ed0adc6e8d3e", "value": "T161534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A96B1E365181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923166, "uuid": "e516e17d-8b06-4463-ae44-2467508f99df", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EM2sC/p9OyDQvSFRMNYL6FV+tg6w7:+5HAdOmGyNtTAdQOyUaFRMNae+aTWdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923166, "uuid": "22196d89-ac62-4167-a104-3ac578ce8787", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923166, "uuid": "bd20e10b-6c51-4416-890e-249bc5446915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923166, "uuid": "130f88f7-9c68-4d08-8ba0-70ed2b2ee6ed", "value": "a83ad2604cbaddf1517f0a53de7ca240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5afc3ae-ba97-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677939626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939626, "uuid": "5870497b-0d98-4518-a902-971bb1906468", "comment": "Malware payload (RecordBreaker)", "value": "ce2edd81e02c06138cdc35c896078bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939626, "uuid": "49803f8c-e40c-4a1c-9d3c-093bd8634689", "comment": "Malware payload (RecordBreaker)", "value": "e9af7f0df0759fc3dd61d34f0db78c556bb1d35df28cd683b0fddc296a8e3146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939626, "uuid": "8fd17b3b-dfcd-407a-a71f-44fcd9763de4", "comment": "Malware payload (RecordBreaker)", "value": "577d58c526b22f5599084260a5f5f8e534bf9fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939626, "uuid": "22698382-cddb-4b9a-bac6-d2690b70caea", "comment": "Malware payload (RecordBreaker)", "value": "9646f943836a78d64422a99848dc4f4e3d1a28c89e4b055b4427243bbc10e24f92a63e03cb406418e3d0866921d7ad93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939626, "uuid": "6ad0a1b5-3006-4c3f-a1f2-77c735d5ad07", "value": "T19634B01232EC9677DA57C9F958E8D6B985FDB2382BDF90CB77540C2A6B406E1303412E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939626, "uuid": "ec3c21f5-a9cc-468b-ad2b-768a06b10f4f", "value": "1f635647f64b745c77efa805ab50ac90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939626, "uuid": "eb4be44c-3cc3-4a6b-a514-c077fef87cd4", "value": "3072:jtoNMbgcbNtTmsu6cScuLHorEpbn3/3KziSHvVUbs2p+YnfEGXAOEBxO:jtoEZTmsnorEZiLHvqY2pzZXuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677939626, "uuid": "e21af6e3-e9f7-45cf-a22c-c1340566e410", "value": 245368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677939626, "uuid": "6d7a4416-12ed-477c-afca-0f1d1dd3e25c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939626, "uuid": "9bc2dc44-b1b5-4beb-a95b-6371c54ff68c", "value": "ce2edd81e02c06138cdc35c896078bf7.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3d81f8-baa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677946216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946216, "uuid": "804f791e-f6b3-4a8b-99e3-b718f89185e5", "comment": "Malware payload (Rhadamanthys)", "value": "55343936a3ea39980a8dc2e8722b2717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946216, "uuid": "aecac3a0-f80c-4ea0-8e60-0aaa549d6ee9", "comment": "Malware payload (Rhadamanthys)", "value": "eb1a9e6f3d48b6f9f1f3b070928734bb06d2eb1e23ffa3169046e287a212845b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946216, "uuid": "4dc27d6f-5ca7-4579-ac59-6c290f660b9a", "comment": "Malware payload (Rhadamanthys)", "value": "4dbd854892ffadf94a2bfabbe5c98613c05bf11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946216, "uuid": "3017185b-5f1c-42e7-ba91-44c7c44030b4", "comment": "Malware payload (Rhadamanthys)", "value": "83aacb926d51679be83ba75b08ea7244e166d3844533013fc3cf97cacce0b209d3ddc1789ea4cae124d96cc4379ff53c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946216, "uuid": "9e0e411b-db33-41eb-93e4-265c8cf56643", "value": "T15F34E01072F19436D1B21D395939C2A02BBFBCA29A79958F73547F2F5EB02C14A76323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946216, "uuid": "6dbefc1e-e8d2-4088-982a-03ea840ef661", "value": "ec008fefeacec89a1331dcf44218edd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946216, "uuid": "dd480458-28f6-41ee-873d-e8a48dc2cffd", "value": "6144:pjo6Vi/0Yc0F13whS2/vZEFxxzyIEvAPZSpZx61C0K:h14sYVF+eF/+cPwF6An", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946216, "uuid": "cbee7821-1a5e-42d6-8d78-7450d1b56921", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946216, "uuid": "15f4dd0b-15a5-4ee8-b66f-79f6a36fe6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946216, "uuid": "99f76d4e-dff4-44cc-abb7-ed69c6e2f092", "value": "55343936a3ea39980a8dc2e8722b2717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e169d50-baa7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677946351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946351, "uuid": "5e132e5b-4f66-4a59-8099-60b48494bed9", "comment": "Malware payload", "value": "531e8335c320c8f3c968fabdd8e79a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946351, "uuid": "a3286651-e660-4f5b-b816-59c06c5b0248", "comment": "Malware payload", "value": "ebd0ff367b52941fef646c6bcc04b2a22e8f6115c653be048d9260f23fabae55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946351, "uuid": "8f85fbe8-22c3-4eb5-a2c2-d7911dd3e8b0", "comment": "Malware payload", "value": "c9a1fc56dc849cffdf7f1901320cf8ab938c28ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677946351, "uuid": "4d84288b-5fd0-4bc8-9dbd-f74a14c2c1b1", "comment": "Malware payload", "value": "df7e2a8aba92fd57cfb942e719c197cb3b99bdf5970601038722c20b12b0b443b53b1925ab4b1be5ccb71bfcc5091d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946351, "uuid": "01a70a09-f0bb-4fb7-bd23-f03232d60b28", "value": "T11FE47D33F2919437C1321A3D8C5BA3A9982ABF512E28794B7BF92E4C5F3D68139151D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946351, "uuid": "f21d88ca-f5db-43f3-b680-e4d313cfd04a", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946351, "uuid": "e9a3ecf9-15b6-434e-94c0-810da556ce7c", "value": "12288:0MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Vq:0nsJ39LyjbJkQFMhmC+6GD90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677946351, "uuid": "0cd816be-0956-48e2-8cad-695042885efd", "value": 716860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677946351, "uuid": "707743e3-ba28-4ade-be61-d41bc9624132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677946351, "uuid": "7242876e-8212-41b7-b456-cd74d58bfc83", "value": "531e8335c320c8f3c968fabdd8e79a16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb40a74-ba79-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677926544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926544, "uuid": "bcd017a0-1d6e-444c-b57b-fe69ea39dde8", "comment": "Malware payload", "value": "625d9e4d1c79c9728cb264af772b42c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "progs.store", "colour": "#F70F29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926544, "uuid": "2922c992-318e-496c-bd81-2722ea74d7df", "comment": "Malware payload", "value": "ed8739ce8e8f7d6b79bf2e22cd31743ce1da874b41a2d4a9efb23326b993383d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "progs.store", "colour": "#F70F29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926544, "uuid": "b22f7235-5fcd-4859-8f15-d2218764e8e9", "comment": "Malware payload", "value": "56c4bae0c0bb31a03dd9681382359aff15d4895b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "progs.store", "colour": "#F70F29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677926544, "uuid": "2a60a9e5-5003-4fa0-b979-c3e865d8d53f", "comment": "Malware payload", "value": "b53352b2a09a76bdb6273d3be6bc416e4a47d03599c42c19e74577bf9dfb0fde2f51fbc76c962bbcba4cffcffff93fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "progs.store", "colour": "#F70F29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926544, "uuid": "e6376773-27b3-46b6-93f5-9a6367e19325", "value": "T18734F108275DBB63C1B849BFD9E3166503A0C17BEA8BE75F7DC94029591C3CF844268B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926544, "uuid": "3522e5f3-354a-4dfc-86a8-ce2ce0753e57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926544, "uuid": "11f2529b-c092-45ff-8161-c41350007c20", "value": "3072:q1/3moQkgU0CwlvwReBFpkVLSYrVEWYw+QeTOUD69qjiwcI/s2o7Pn9SgOStEWLA:yWxNv+eyOq+JTDaq2Jf2mnAgNfSVLDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677926544, "uuid": "d8116a85-a1a9-4ea8-970f-62e1eccf2904", "value": 245258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677926544, "uuid": "5279e1d3-9b71-4324-94d6-42dce257362f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677926544, "uuid": "3439b311-2074-4485-9155-1618e7b18a5f", "value": "Adobe Illustrator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d0d251-ba91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677936934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936934, "uuid": "6341e3a4-2c40-4d1a-9e3b-52d326104318", "comment": "Malware payload (Mirai)", "value": "0f5a92f41a3bf694ce045361f2f77755", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936934, "uuid": "c40c8a40-34c0-4f3a-bca0-536fc5aba601", "comment": "Malware payload (Mirai)", "value": "edc714427b54b5c9de92530c6861e7961f1a894a95d0e39d491588ff89a88eb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936934, "uuid": "000aa2ba-d961-4421-93eb-5ddcf3d8480d", "comment": "Malware payload (Mirai)", "value": "090a598f7074065e93525440a23595f96a0eb7a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936934, "uuid": "6847b2b3-42ce-4edc-ae48-df2dd68489e4", "comment": "Malware payload (Mirai)", "value": "1db08be6d6e63f63007026f307c8d9402b0ac5b12b0ec63e9e8615b65e42b59be5e78a4c80e2b341bb68cf3588a4a24d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936934, "uuid": "efde0f35-d32f-483f-b5ad-d7605b3f5915", "value": "T184330895B8819A16C2D052BBFB2E41CC372663B8E2DF3207DD216F15778A82F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936934, "uuid": "12dffbdc-f111-445a-9374-6b7cd6446bd2", "value": "768:IV+SWCaRbjRezz7bWIEAnxW012+74a+uo9I8xTcSP1t5i/NPYBN5eazB:pSHaabWIR401Ya+/dxTca1t5iGBHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677936934, "uuid": "00d1dfcf-701f-4bfb-bc19-6702c2c4f5ef", "value": 52964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677936934, "uuid": "fe33bf84-a058-4d4f-99c5-cf69781b97f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936934, "uuid": "40b7e466-ce2d-4a1f-9179-ef8c08afb1be", "value": "0f5a92f41a3bf694ce045361f2f77755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0024fc12-ba3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677899808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899808, "uuid": "a5a6bb72-e4e2-4f2f-b04f-bffad8c49339", "comment": "Malware payload (Mirai)", "value": "a58c39562fcc798c7b2e312566b3e44a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899808, "uuid": "a2105070-af24-4d74-88ef-cd7881d62276", "comment": "Malware payload (Mirai)", "value": "ef243c721d1997a7c2d06847880a9104563ba25874fa50b17758a6200011534b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899808, "uuid": "c44718ac-74ae-4d98-b034-89637457fca2", "comment": "Malware payload (Mirai)", "value": "25b46c62b7eb8c3479b05e5010fd40397bad365f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899808, "uuid": "4afa5ecb-c444-46eb-815b-f205801e5307", "comment": "Malware payload (Mirai)", "value": "3b1d3ac3a9463096787df020f4c7c36b11eb67a24dfbcd94c48fc14152e80496fc67df49c9a5da2e6321ef9a19ee7d31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899808, "uuid": "ba05e040-8d93-445c-a3c1-9744fd1d7771", "value": "T112D2E164E32309B3C27025BA916D06E837F712E9C1BF349054316FD5A696F07ABB89C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899808, "uuid": "e0721a43-aaec-4c40-954f-b61023892c87", "value": "768:9vSe9qYQhE5YkvJumQuOzHsLpfRRD4gs3Uozk:9vf9qfhE1vk1gpvcVzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677899808, "uuid": "03de32d7-ba66-44c8-911a-91a9e50d1910", "value": 28952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677899808, "uuid": "086c994f-94fe-4133-85f4-1c51363d184a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899808, "uuid": "bf855d09-40be-44a5-8c86-e8eb8c3a1ed3", "value": "bok.arm5-20230304-0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcc3522-ba50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677908931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908931, "uuid": "76edeba0-b351-4ec4-8864-0a071504e0f4", "comment": "Malware payload (Mirai)", "value": "961400d69d1cbc0a84be52780cf1819d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908931, "uuid": "f435afc9-af8e-4b0e-a78b-4e54c31ecfbf", "comment": "Malware payload (Mirai)", "value": "f00860c0f0945df8bcc65e937cfd74d6de9d91c78a36ec61e1b68aeafe1c00ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908931, "uuid": "ee237a5b-8bd0-43ea-be81-f544d67c2f2f", "comment": "Malware payload (Mirai)", "value": "2a51734bbd8a83c85ccc7caa3e6dcf9fd29529f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677908931, "uuid": "011e7a17-73c2-4405-9336-a260e2df0be1", "comment": "Malware payload (Mirai)", "value": "f0efaec1760dfb88917d2cf1e95900a033abd1418bfdf0bb5c57386e14f146ec399841eee1788b3ce354f6173a7699ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908931, "uuid": "2d5391da-8a7c-449b-8119-cccfb67f09a3", "value": "T1F7A3A60A2E119FADFB6C833447F74E31A25963D222E2D641D15CE9015F7438EB85FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908931, "uuid": "d1077990-971c-4a37-bb47-90b9d1654d71", "value": "3072:lzVf+T5vTHnbA7UDvvRC0fvTtWMYwbZnHF3n:lITlznb7vvR9rTYwRHF3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677908931, "uuid": "9f1525c5-a839-43db-aebc-0af3dd4a81ff", "value": 99492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677908931, "uuid": "a021020e-1c95-4818-9048-2060e19c15ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677908931, "uuid": "db15c091-e7ad-4447-b287-f9d8e8418265", "value": "961400d69d1cbc0a84be52780cf1819d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa411197-ba82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677930588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930588, "uuid": "8610dc60-d742-4d72-8cbe-76e4acf60a96", "comment": "Malware payload (Mirai)", "value": "5bf4e66efb2b72d71f9409879a638391", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930588, "uuid": "35eca1a3-d346-4f07-9afc-bbde8241a80e", "comment": "Malware payload (Mirai)", "value": "f00d0189a3c0f55ca2830d909eb7265430b5688e2a0419969023a40c423df70c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930588, "uuid": "dc950adb-86fd-4ab7-aa39-cd1bc824a590", "comment": "Malware payload (Mirai)", "value": "fbdac30f52f20961fd1ec030c37e8079730e4989", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677930588, "uuid": "874bf2fa-5853-4830-add6-5fcbd11c86f7", "comment": "Malware payload (Mirai)", "value": "372721273d2746c41a747a1298c1d196e7766523e95936ca79a0351b760f4c7fb92344cdf4cc58b49ab4a66c08e878d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930588, "uuid": "f8b36702-bbf5-4be6-9653-e399a39d8cc0", "value": "T10103F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930588, "uuid": "e954db29-3970-4821-a825-f5757e6df99c", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTF/NYwW:svbUG5fPlUlDf4Sycv+PU+jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677930588, "uuid": "1f5bea34-8ba4-4d66-8904-9d12d888a42b", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677930588, "uuid": "d94b374d-7d14-4a56-b984-9f2451bb1507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677930588, "uuid": "60aedd27-1443-49ca-9a74-7b6c31ce0495", "value": "arm5-20230304-1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e7f6e-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902138, "uuid": "2ab87504-4a16-434b-aa49-1d2819d9e9d4", "comment": "Malware payload (Mirai)", "value": "cb3bfa1f4215e2fcc3ea4a7ae0228b85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902138, "uuid": "f3c7ebce-0093-4895-be5b-9fae9aab8935", "comment": "Malware payload (Mirai)", "value": "f117e6deacf3b2bb0e8e89d60961e64be330e423b8f4356ab5e78bdac9da2f85", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902138, "uuid": "4e93faad-56ce-4a20-b553-917450a72afb", "comment": "Malware payload (Mirai)", "value": "52d908ca0a5697d0bbd460a316f6d14154e2d73d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902138, "uuid": "bce8ae48-ef3e-457c-b617-4693510f8ced", "comment": "Malware payload (Mirai)", "value": "3bad404b76657ecc514c0deeed893122200f1c682d33f88be1a90c80aac88c22e4e37a67797bbd703cf066ce3341a886", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902138, "uuid": "f2321106-10c6-4cc7-9f2b-8551430b8847", "value": "T10083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902138, "uuid": "7800e4de-0303-4326-91c5-806481bed7ce", "value": "1536:iVLyu95K8Fkj752dCexuV/8UZlDwfkJ4MYfWc:iVLyMg3Fezxu5VD1eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902138, "uuid": "b044cc73-c12c-43d1-b602-4c7ace1b697e", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902138, "uuid": "03210a98-54d5-4706-a831-d2ffadff1fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902138, "uuid": "92197cf9-7aa2-47f6-b930-e58170c23d9f", "value": "mpsl-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed332002-baab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677948310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948310, "uuid": "8c7ef996-85d1-4e8b-93d4-1bf94e336347", "comment": "Malware payload (RedLineStealer)", "value": "88d394e1f27c6e2512a00544f53889ec", "object_relation": "md5", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948310, "uuid": "b1bd6a9b-ad77-4598-9df2-e2060dbc82a5", "comment": "Malware payload (RedLineStealer)", "value": "f2a55c47f500efa4bb1b41487cf512c38b0f7438ed955656cceb51a2c11c2d6a", "object_relation": "sha256", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948310, "uuid": "9c914410-ab7c-4123-9826-cee010ef03ac", "comment": "Malware payload (RedLineStealer)", "value": "72ef0dff9731ff86dd3493a9b749ad57ba22d966", "object_relation": "sha1", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948310, "uuid": "79965f97-59bd-4fd0-a827-848ef7298297", "comment": "Malware payload (RedLineStealer)", "value": "34131e77d3dc6745f3320fc6cb449c7dad009fbfa17af2c26656960f3f2b50ac9984ba22f1bec7e04c40c6a6d7aafff1", "object_relation": "sha3-384", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948310, "uuid": "6c208563-87a0-413c-8520-9e697f5e0d29", "value": "T102942370960870CFE2892E37ECC5C5C98D9EFAFA51A0B65842459C24A41FF5A73A7D33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948310, "uuid": "14857a25-0841-427e-a2b7-7e4675e38da0", "value": "12288:Z77QgOn0IpbnynlQujHGkSyVjEQbHaoBd/HsA:Z60IKlQDlyVbraoBhHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948310, "uuid": "2bae170a-1ddc-4e39-bc74-8041ae3081e0", "value": 439602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948310, "uuid": "7150281e-a0a9-4fbe-aac5-8573291bf819", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948310, "uuid": "85286c7f-1984-4823-9a32-5196962cf71b", "value": "pureland.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c2fc4a-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677916323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916323, "uuid": "35f472d6-5b29-4943-b262-6ea6fed473f0", "comment": "Malware payload (Smoke Loader)", "value": "c71fe44880b57b069e6a6aa17a40f9e5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916323, "uuid": "5109fa72-839b-4343-9e4d-9ab8675b1de7", "comment": "Malware payload (Smoke Loader)", "value": "f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916323, "uuid": "d22e79b8-d9f1-4279-b971-2bad971c0bed", "comment": "Malware payload (Smoke Loader)", "value": "21f523091d704b6024be3f270c06e716d27d246d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916323, "uuid": "bfdc3e11-816d-48c8-92d8-f36e32e8aa77", "comment": "Malware payload (Smoke Loader)", "value": "aebd1ab59c37d8be195bc64574cfb579ae5e8e6391cca41bc9b7c4279b3b12377ff5af1888e5e4257aaff2e374be9a87", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916323, "uuid": "49dcb61b-f0a5-4979-b9aa-bb4fb23b7e95", "value": "T19524BE31F2E0D832C0722531D971C6F55A3ABC62E87449DB27583B2F5EB42C08A6E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916323, "uuid": "052f4eb0-5a96-46b6-a1bf-f2521802397a", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916323, "uuid": "9eb5fb68-fa6f-44b1-a652-80be56d466c2", "value": "3072:24C8x2RySvUVDwaBQ3Onm3IdAECGFxlHed5huUaTaQIbDCPPjAXPSQ:bNxwySUZwaBQ3OB7FLgXHXKPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916323, "uuid": "b111639b-b520-4b35-9687-5f6229d83737", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916323, "uuid": "f2df6487-25f9-4cf7-879b-47eabb59eb0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916323, "uuid": "02ddbbfb-047e-42c2-9b78-da56ad09c9c6", "value": "c71fe44880b57b069e6a6aa17a40f9e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c37360-ba74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677924433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924433, "uuid": "83cd5cf2-62e7-4221-8d97-3f37795473bf", "comment": "Malware payload (RedLineStealer)", "value": "fb430617074d580d39d5713abcfdc095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924433, "uuid": "d5d059c7-5296-4eb6-8d7a-76e28baf2a6b", "comment": "Malware payload (RedLineStealer)", "value": "f4326903b6446139efb0ee5e3251ca95f1ada0963829deb1547df4c5b6930bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924433, "uuid": "a17db60a-d011-4347-9929-a25fe6ed744b", "comment": "Malware payload (RedLineStealer)", "value": "08d5d42d079a1b60c39225cb2933686d050edc1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677924433, "uuid": "753c6e0b-9924-4f23-a185-aeafe1e19682", "comment": "Malware payload (RedLineStealer)", "value": "f61eedddf6aff8b00c521cf3975d6565d9637fa3f4e55ab9eb118a4ee0443acf15b17a7dcd569863062a4e876788fc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924433, "uuid": "036d26eb-3fc0-4e19-b108-7932eaee6509", "value": "T150F5334DDCA0E9B7D9002677B0B5194E9B7BE721D671E4D2C721DA2FFA30644802F3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924433, "uuid": "411f4da1-d8f2-44fa-b42d-c333dda24f9b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924433, "uuid": "cd4525bb-582b-4d5f-8b1c-9c74b6654120", "value": "98304:E52wmQdKG7qhlBQekY049suZMx8WDj09hKBNUhlbYY:Ep37wdkdXuZMCSKcByhll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677924433, "uuid": "a233ebe3-f313-4df0-b67f-b79784dd6035", "value": 3565388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677924433, "uuid": "aac37fe4-f378-4e5c-846e-8ef099a0217f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677924433, "uuid": "da852e6a-d328-4871-b547-a794b7b52517", "value": "Setup 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4140307d-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948880, "uuid": "c763b018-ef16-48d9-bd0a-20a23bd95a56", "comment": "Malware payload (Mirai)", "value": "c9e50fe2a170138bc5b19ffc1f1e3747", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948880, "uuid": "958008a3-a537-4135-9fc9-03e8e571c18f", "comment": "Malware payload (Mirai)", "value": "f555d259552d0ef02c5030105a2776b3b6b3d9fb7b551ab7dea6e407bc0211e1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948880, "uuid": "50a69810-1004-4133-9bf3-3b12ab9d7253", "comment": "Malware payload (Mirai)", "value": "ffd2710187b2e2a2c90bf901d324efebda7ac398", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948880, "uuid": "aaa2ea8f-83c0-4e67-a54c-b7ad204ee149", "comment": "Malware payload (Mirai)", "value": "0c26f8ba29bea21f70a0389544e3f9846cf073521a513390c926cc08235ddcf3c1898825b8ec0806784e38828fe4e159", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948880, "uuid": "e570381e-b666-4e7e-9cfd-8f7af07fa8a6", "value": "T13E333B03B94280FDC15CC274566FBE36C873B87E0339B6AA37D4FA266D46D611E2E905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948880, "uuid": "4bc43bab-da6d-4b64-911b-1441013d5e08", "value": "768:wiDVAvqjbwNRaNVq5FllnaT7vqXpeFTWMHCVM3lBtQErn6FTEN9Mkv:1JCqjbwNRaPq5FllaiX8zH71j6u9Mkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948880, "uuid": "2287a9e2-7038-4d0e-99dd-55152fd9af9b", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948880, "uuid": "62f1efe8-dc84-4056-9904-c62c696b57b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948880, "uuid": "2755bec3-8d3f-4a1d-a485-c11e13e76f4c", "value": "c9e50fe2a170138bc5b19ffc1f1e3747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6f7904-ba3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677899805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899805, "uuid": "86271391-6b7e-4cfc-b635-f88c7049583e", "comment": "Malware payload (Mirai)", "value": "54ae534eb0485dc3b40f0d1594b88f74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899805, "uuid": "2f1a2c26-92e3-4e71-adfc-d1503229260f", "comment": "Malware payload (Mirai)", "value": "f58c661fa223956609be533de28d2595c87e6879e9e55bcf55a9bef0f79a67c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899805, "uuid": "aec83983-384b-40a5-af9e-fb437deefff4", "comment": "Malware payload (Mirai)", "value": "c3e414935781bd80cc2e10c250bb406a0bae79ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677899805, "uuid": "cc685065-8b5d-4c1c-885d-a0851f3229d6", "comment": "Malware payload (Mirai)", "value": "a409f169caa4eeb48dc4098967e4ceb11552922b84fb708b1f3785d2aa54bc2143d0b41e07c9452fb8d740dac5ab15a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899805, "uuid": "48d8d840-4dee-49c6-ab88-e26347014535", "value": "T10B53022BC960DCA4E0902AB6C176550FB35C9D78B9EEB6E41A78C060FD91C4C37AA746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899805, "uuid": "c07b7f1c-da87-472d-8769-7095bf757f50", "value": "1536:rMljt1lW2rebh/Ss+pOuJds1q8oN8KDiXELQWr7Jk7ZK:rIybh6s+b5eUqELQWr7JkNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677899805, "uuid": "648c5a85-0ca0-4c87-a8e8-897ac032f29a", "value": 65668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677899805, "uuid": "99af1424-0d4a-4898-85f2-0042f8474e04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677899805, "uuid": "124350e9-47af-4801-8f91-36cf91a01b06", "value": "bok.arm7-20230304-0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d30dc44-baad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677948900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948900, "uuid": "3de0fe25-8e38-4597-bb28-ebcbc644455b", "comment": "Malware payload (Mirai)", "value": "d33bc4ba98f96e439817377116c63b37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948900, "uuid": "991bf523-98a7-42fb-a863-13e977bac18e", "comment": "Malware payload (Mirai)", "value": "f6942599b95e3f5f58986e9d3119b07d6b1fa0db048d0af071365eabd718c406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948900, "uuid": "444e4127-cc41-4c3f-bd82-713c0959c9c8", "comment": "Malware payload (Mirai)", "value": "55b3306b4f030c9fdb672fa776bf45efdc0ddfc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677948900, "uuid": "58afc43b-596b-4192-86a7-0cdcbf8ff33f", "comment": "Malware payload (Mirai)", "value": "c33fddf53020c054cbc181c36b4ac0aeabcd2572f9e72bf875d3bb2d1dad0daa425d1d47e0993f51dc919f8f8d404026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948900, "uuid": "4f920ecd-15a7-4fee-872e-c8624883df99", "value": "T1C6A2D054E5896EB1EFDE58605F9292D27FF80FD1A68BC86312C69F11201608B6345EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948900, "uuid": "5954ac6f-8e09-4fff-b7ab-601bd1c02d7b", "value": "384:M/JywWc84Tp2YshxqlDwF/rgRr08UaqngJ/kM4uVcqgw05VxJo:MRxsSVsMDwFIrIaIgJ/74uVcqgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677948900, "uuid": "6b44156d-017d-48d1-9d19-a1a95c96df81", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677948900, "uuid": "1d898990-8008-48a9-9d2b-516aaf1559f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677948900, "uuid": "18e405d9-dcb8-403b-a44d-f477c0d0bdfa", "value": "d33bc4ba98f96e439817377116c63b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a777a126-ba90-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677936596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936596, "uuid": "f25712ad-1dc0-4d6f-b3f0-d9d183e0c129", "comment": "Malware payload", "value": "55d21fcbacd13db52f9d8254626af105", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936596, "uuid": "c3307bb8-98aa-4e31-8244-1f9c2c9817f3", "comment": "Malware payload", "value": "f7116bfdabc870daf6797b861d0b0da6a5196764232614a0a8c36074689c4a83", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936596, "uuid": "49ed4a7a-3a64-448a-9ee5-3f9e94701fff", "comment": "Malware payload", "value": "5692ef3badb8c0be8eed0ace6f2b4b1576d3fdd5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677936596, "uuid": "636d32d2-3bc2-4fb3-973f-dd09daa7275e", "comment": "Malware payload", "value": "97b6b67912b232544480db1197a5faccedca099f52d4a054f42bfcc5d5cca9003e69a148b7f245e12d5085e4a3e873ad", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936596, "uuid": "52e9ca3e-f434-42d1-be63-14f216411a87", "value": "T19DF63332769A8E3BCA6E45B0652AE62F05213E710B2380F7D3D8BD2D08B39D15575ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936596, "uuid": "ca703d53-8a23-45fd-b35d-74407e63d103", "value": "393216:KMF2J0Bm+miVGp4VpXG8rSbYTBkpuXKYAjSHyWo:Kq2JlliVsQCrYqSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677936596, "uuid": "3845d14b-2204-40cd-83de-6623b40623ec", "value": 16714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677936596, "uuid": "1acf0b56-cf66-4506-817a-ea25b3fc113d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677936596, "uuid": "397bb655-7383-4949-a11f-ef6bb57327a7", "value": "B0LET0 VENC 060320234273168 WFTBCLZUJMVFEDSWZXMLWSBRA.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcc01a1-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902140, "uuid": "711cf1cf-a4a0-4aa4-ab51-93700f0ddb1c", "comment": "Malware payload (Mirai)", "value": "8522c47f2bc876b8eb64e07a8cf46cbe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902140, "uuid": "ef043819-f3af-4d6c-bd9f-927889108d8f", "comment": "Malware payload (Mirai)", "value": "f71e08a3e26c01c28ddb34e0f9a216075ae4551bd62affef19cc8913c7a334ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902140, "uuid": "61671f76-074b-4ab1-8c4b-58068af6e4cd", "comment": "Malware payload (Mirai)", "value": "4f6b063e2611f0f0fceb82b444832be8e8031aac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902140, "uuid": "682c26c1-0575-41f9-aabf-bbec4a147e27", "comment": "Malware payload (Mirai)", "value": "2596d78a01907708492ec817e5ec2a164c93fb526d875b8abd1653e2d0dfcdcb224074f9bf41743e256f112f36ef8406", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902140, "uuid": "860dd6c7-0b1e-4e76-b478-fd444e8965fc", "value": "T1B783A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902140, "uuid": "8f607ee9-1875-4f9a-9b02-6ce245e1ce68", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTT7ZDYovZ73x/nL8y8QH:Rakdn2Eo3ePu5GTTRYo99Be037WQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902140, "uuid": "2b33ce7d-c360-40ea-9a16-2219885b84fb", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902140, "uuid": "ad47b1a7-ab6d-4616-a4d5-c6ef8a2ba3ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902140, "uuid": "99bd7a34-dfae-4319-8c71-017e47d9e4e8", "value": "mips-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600a403b-babd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677955804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955804, "uuid": "c1bf3ed3-78f2-422f-80db-beb71ba09fbe", "comment": "Malware payload (Gafgyt)", "value": "e801001ad8bd519faca490173a5a1502", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955804, "uuid": "0ff2200b-d116-465e-9901-f9f59709f8a5", "comment": "Malware payload (Gafgyt)", "value": "f7a2abbfd146528c5de8cd1986581d0e163a802820d76b927d22cbb8e9f492c9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955804, "uuid": "e55a450d-7937-4a3d-8fd8-0a121b92fbcb", "comment": "Malware payload (Gafgyt)", "value": "281454b4eaa324899f2f27271db3b91f94a1d689", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677955804, "uuid": "8fe5d06b-c5ae-4bd5-9b87-de7b363e83bf", "comment": "Malware payload (Gafgyt)", "value": "400b5e52dd3e2907d1c61552466113993fbb94a8e50c4b816f1f2c1f8ec70eb17d39ce46f2dde3dd1567a6d6d9b83918", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955804, "uuid": "3d1b4ec6-9975-47ad-8d50-3ebe86476ad9", "value": "T1F9934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955804, "uuid": "53eaa2f6-c98c-4ac7-a8a4-815a251fc30e", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3HphauH/VPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdHphaE/XVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677955804, "uuid": "82ea0bcb-060b-44c1-9054-a41f69d0e56e", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677955804, "uuid": "2f969dfd-146b-41e2-af22-2784e72d7ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677955804, "uuid": "f5f499ac-c8ac-4651-81e8-43e0f720f904", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651ddc78-ba40-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677902125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902125, "uuid": "ecdcf8cf-7443-4383-9b2a-1b5321c8e7ff", "comment": "Malware payload (Mirai)", "value": "4cf4976af96a27715cab5e2968200b78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902125, "uuid": "cf950db3-3e46-43b0-842f-fdda4cecca18", "comment": "Malware payload (Mirai)", "value": "f7b600563f48a6938e40d4a5527adffba8119866d26550909059be2e3d8ea636", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902125, "uuid": "61247c2d-827a-4065-b8ad-554f9a4075f1", "comment": "Malware payload (Mirai)", "value": "1ec123e0c2ab0401ab9dd24f69b0022850664a09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677902125, "uuid": "37b7287b-0c35-46cb-bca0-a891e97f60ff", "comment": "Malware payload (Mirai)", "value": "fa0a6196e0e8ff55d3612ae1f514a15e96d55c82857828479a122a18c01c4d737495a69914b815cb481d296dbb83c535", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902125, "uuid": "d8b0cc77-41ec-49be-a4bf-eed5966de4ca", "value": "T1FC730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902125, "uuid": "fc75edcb-67bd-43e0-9653-b46e87b5f2b1", "value": "1536:mln25xPBXk1wnnkL7+KE007kHVkyazN0bIqvikNnsvHTGsV5GYIWh:rxpXCMkM/0ja4NnsvHqsVER8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677902125, "uuid": "29756bab-c5a8-4df3-b9bb-bad0693da25f", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677902125, "uuid": "94a12bbd-824d-4183-a359-7e22ef04dce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677902125, "uuid": "4b977aa3-1ee7-4352-8305-be6f83fa4c60", "value": "arm6-20230304-0355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700c4e83-ba98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677939939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939939, "uuid": "39e24c4c-cd90-47a0-8d4d-96ac57658fa6", "comment": "Malware payload (Mirai)", "value": "32b365458b0ad00bbfbed45b62120eb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939939, "uuid": "7f908579-cd85-47aa-bbd0-688723c418be", "comment": "Malware payload (Mirai)", "value": "f7e43026bdb89204140968e7fb1a4000d44452ae873b18704a206799453acff5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939939, "uuid": "d9ce9902-286c-48f5-9d6e-be43ca0d524d", "comment": "Malware payload (Mirai)", "value": "531a6d7770bacd25773e305c1053c082c845e88f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939939, "uuid": "17dffc14-ae21-4a85-ad32-fac897ef2955", "comment": "Malware payload (Mirai)", "value": "a12cc8673792039e997b65d54e0431800ee7814715ab65aab939d7b2bb45b148300eb44121c68f4134276844cb71470b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939939, "uuid": "6141e1e7-f8d4-43f4-add0-56a02ac21f21", "value": "T100B2D16F75A0AE9ECB8DA87D119C11B18AC1B1D131470B18D330CEC9AF27897E89F076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939939, "uuid": "0abbdb08-22fe-4b8b-a24c-1a0d03bb3c59", "value": "384:+HlO9opPmSphUOhmLPHjKjGFIz258chw/S55FTOLSWv/xtJh0n8rkrF9qemTRWG3:+FO9WmZiy8XS55sjJG8rIDQWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677939939, "uuid": "4f379b48-3d6b-456c-9f50-f642605e205a", "value": 25664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677939939, "uuid": "a0c39650-df35-422d-be6d-97acd8cca158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939939, "uuid": "5e80655d-22fa-4a88-8c3b-bf9478937a06", "value": "32b365458b0ad00bbfbed45b62120eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cd8b58-babe-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677956110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956110, "uuid": "cd30ff61-3573-47c3-a734-1e5057659deb", "comment": "Malware payload (CoinMiner)", "value": "f99422c66a010e0d293cc62ea636560c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956110, "uuid": "cb5a6f1e-4deb-4802-9729-bd98f1f82701", "comment": "Malware payload (CoinMiner)", "value": "f80fb68e43d64a69a23431326bd80179f0f3631962ab9ecc8ebb0e0354d105c7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956110, "uuid": "0ed437c4-08ee-406e-8bf1-43e5980c0f7f", "comment": "Malware payload (CoinMiner)", "value": "195f2ce63f7d4aaf62d62fa85de027df10c28e7b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677956110, "uuid": "34383b7c-9b43-4c12-8375-b86910866293", "comment": "Malware payload (CoinMiner)", "value": "b3a1b415d933fbb9086b9333b90b86d2e61176268b6a960bf7fc53d1a7b5857547c52f4cb6756fc2863d1e1e9f318f2d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956110, "uuid": "9d5ea0bd-f6ef-41e8-b56b-e4962a7c08e7", "value": "T19253319C765072DFC86BC876DEA42CA4EA61B47B570BD243A05316ED9E0D98BCF050F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956110, "uuid": "e09da297-bf06-44a4-9c16-0903f5d19dbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956110, "uuid": "e3415aca-231e-4f00-bb7f-ebb4db56917d", "value": "768:cDVW5uhmv9//zzggwyx9rIrQwJYGMbAJAmQvmbAOjPQZIuySRAN:mks89DzKyrzwDMbAqbmMOjPE7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677956110, "uuid": "1b616ce7-bde2-4390-91de-46fc81e75045", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677956110, "uuid": "1073452b-6d6a-46ab-b212-60702f4bac9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677956110, "uuid": "6799be99-0604-4ac6-9ea6-afc1d55ed009", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b15b1d6-baaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677949648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949648, "uuid": "45a32a94-498e-417d-a5d2-8624d48445c2", "comment": "Malware payload (Mirai)", "value": "4217b94de9aa2d10f1a5cb93861e9998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949648, "uuid": "727e559b-afc4-4a4d-8bb9-54c9198ce8db", "comment": "Malware payload (Mirai)", "value": "f93bf6e09bd6a80fe24957621e080509da7bc8febf74a4e12de09626cac0370e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949648, "uuid": "89334e7e-8ea8-4311-b87c-a4fe8fc1b068", "comment": "Malware payload (Mirai)", "value": "7ad8642a4652074caca4afff2505b0b157908772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677949648, "uuid": "21426032-5a14-4dd3-bd64-04889487dbc7", "comment": "Malware payload (Mirai)", "value": "796b8871ea7b925b0df3a55f9a0c6040cf52e3b62f2a32b74d92e2802341a7ffd86a95670be202d7daf6ebc2ecd379f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949648, "uuid": "d768c5ed-318b-490d-9bda-b690c74626db", "value": "T160332BA6B701AD3EF99BEA7F84130A09F53077950093073B63BAFD935D322945D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949648, "uuid": "469e2530-d8c2-4d60-b337-f5002139b8ba", "value": "768:eHe/5jVosLZxAPmhr6ZcJbpwshpcr4EI8uGQYzx9DBw/a/gT8IDC2/:KEjxAPKAmtLtEI1GQq9DBwa/a8IZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677949648, "uuid": "9b7f79f9-3fe7-47f9-9924-249e12686faa", "value": 53168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677949648, "uuid": "9fe67abb-b2ab-40f6-8dc4-d7d6a6bb7f9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677949648, "uuid": "e5e00d0e-c0ab-41fc-ad60-4d3b962fe099", "value": "4217b94de9aa2d10f1a5cb93861e9998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1512fdb-bace-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1677963322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963322, "uuid": "1ee9e8ec-9250-4958-989a-d5f661279cee", "comment": "Malware payload (BitRAT)", "value": "a55abea61f25414c01c29d001935c33d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963322, "uuid": "13fb03b1-b5ee-48d8-866e-d700a176075f", "comment": "Malware payload (BitRAT)", "value": "fb014da9ca6b3a47dc1b6a41baa61a9625e78c19d608eefdb495cc0fa9653295", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963322, "uuid": "1fbcd7d6-c83c-4795-a33e-4497fa0f557a", "comment": "Malware payload (BitRAT)", "value": "89dfb5a898440ac55e40d73ee1b60a9c5aaa4700", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677963322, "uuid": "4d7b7974-de5c-4800-9d8d-640fab38230d", "comment": "Malware payload (BitRAT)", "value": "b7f757d06acc49356a821955fc309d3e0f8f84b95fef14fe33b0c338dbc2b0224a674675b05860dee4ce76cf68cdeb9c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963322, "uuid": "ba721a31-a1f4-417e-83cf-2230ecc27255", "value": "T1207533E1AA96D739F13A8C7CBD561903CC79E671352B06127EACC4AD60FFAD21808C57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963322, "uuid": "f64655a4-9e46-4e26-9b8c-ee6cf5322751", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963322, "uuid": "37c14da6-0503-4953-900b-27514a0ccd49", "value": "24576:udRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkznHv/A0jT1v9:uXDFBU2iIBb0xY/6sUYYCHnAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677963322, "uuid": "2064046e-a85c-4b68-8d04-d0abc81bf541", "value": 1552896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677963322, "uuid": "f068bf89-e6c8-451a-bfab-f4431a9d6628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677963322, "uuid": "f4238de0-7bb2-44ea-8c60-6bd73ae33a25", "value": "a55abea61f25414c01c29d001935c33d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c09c81-ba61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677916305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916305, "uuid": "5c162f0c-2b3b-4995-889e-31a123d2a6aa", "comment": "Malware payload", "value": "3ace227a334fa18636c42ab18638abf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916305, "uuid": "21e5710a-5f1b-4fed-a042-c56c71ecbf49", "comment": "Malware payload", "value": "fd107620a9bab6f816dfd4583119ae4f88253a901a46c1ed37e97ba7de7fb613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916305, "uuid": "54a3937b-41bf-4c18-bab5-0b464da5af71", "comment": "Malware payload", "value": "4f50bc66968b5435f81cee360a3cb1999e45ac60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677916305, "uuid": "c7684ea2-1a1b-4d18-b49c-95da85c827d0", "comment": "Malware payload", "value": "1c46177df42a984695480a2328b054cf65021bd7d67f73c0ba4b060af5b5164ac9c4c97baeb1172be849ff632345f68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916305, "uuid": "a730383a-48ed-4649-877f-e79a8c95b65c", "value": "T1C6F60217ADA8CC68C59394331092C397D20AE18DAE0DDB9F13B11D45FEE096B5B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916305, "uuid": "5cefb4ba-0cba-4711-abc5-3356024738d1", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916305, "uuid": "a0da0fb8-3f12-48ea-830c-7c136cb39482", "value": "393216:h9DNFabhV8d9LNJ+y3k2woJuQFkyRmazVNEJVZOUcryo8mRHVG5xR:rDNFwVeey3kZoFVR8qyo8mByR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677916305, "uuid": "b0fd69c7-3348-4d5c-9e86-9c1208b1b907", "value": 16216226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677916305, "uuid": "a2733dc6-3ab6-4ac8-bb38-b61162ac3a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677916305, "uuid": "cdb31aeb-27bd-4414-88e3-022ad6777218", "value": "3ace227a334fa18636c42ab18638abf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7728c77f-ba98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677939951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939951, "uuid": "48fd5965-72d6-419e-aecb-277da2c50115", "comment": "Malware payload (Mirai)", "value": "b75675a279f714345781a5eb1159baf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939951, "uuid": "59a12cbd-db50-49c7-90ad-6e4a3b425aca", "comment": "Malware payload (Mirai)", "value": "fe64b28278ee8c09b3c092a2bc5d1287ef02b061c8a9b20448bab1a2dfbcee18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939951, "uuid": "e7057533-8be5-4c94-8496-0f1161e9d0dd", "comment": "Malware payload (Mirai)", "value": "37104df475437bd170d581d5614d42d933c6b197", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677939951, "uuid": "db54314e-abb4-458b-8b7b-c3e451f22056", "comment": "Malware payload (Mirai)", "value": "a764d6b8debebac377a5402d94ed09953721fa4b77982c945f0c077a14fa4a6b8918b43cee56db86f0982ad28f5368c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939951, "uuid": "4c3a1125-689e-4689-ab24-be67512a2067", "value": "T1C2C2D1635F13A473E8709BB97E69468320454BE9F56E3A222DB40114AFC22CE6BF45D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939951, "uuid": "b2c17695-3f35-444e-b8e2-09d28d8c7b1b", "value": "768:Aj+R6m0o+isNRUXxQUAmOHbFcHTs+y9q3UELEJj:m++isbUimmFiTs+nL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677939951, "uuid": "2964418e-77b3-4567-b46f-1a8e5bc14b54", "value": 27836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677939951, "uuid": "3d392781-c914-4ff8-bb8a-66c5e6dec781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677939951, "uuid": "2be2fe47-fe9b-4c9e-9b38-e037415f1360", "value": "b75675a279f714345781a5eb1159baf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a425142e-ba87-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677932725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932725, "uuid": "e8a9bf6a-5f9f-4e72-99d9-26b27bc47ad8", "comment": "Malware payload (CryptBot)", "value": "5efc3f0cbde93b03c98bf94804927377", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932725, "uuid": "749a5f3d-b437-4952-b6ef-35f24f4cf953", "comment": "Malware payload (CryptBot)", "value": "ff11e869a01559bf8b75131241b6cf5d670612d09f6ee89038486835f4b0feab", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932725, "uuid": "dbb6face-51d4-4834-bb9f-0715e25d7f71", "comment": "Malware payload (CryptBot)", "value": "ceaac0f3cf5a148408020f4fee3a83420bcbc1e1", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677932725, "uuid": "03ccd943-ae51-4af6-9866-ba8ae39975dc", "comment": "Malware payload (CryptBot)", "value": "b7732b72cb454ec43ff311d9ffbcd004cc90941812735e6a4a141863593f996f0fd7c7839b7d20afc93617eee4d34b33", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932725, "uuid": "3c08ba30-7d96-4bbd-b31a-ae81a812933f", "value": "T191050121F9928079D86212798819363077353F314A2A66E7BBDD3F2DF63C962E712353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932725, "uuid": "84556b86-4537-4b4e-9f7e-84cec4608d2a", "value": "24576:COLO2HUUAHZNkrfnggktF6lWxj0q5jBiQ95JQMH:fLO5nHMbnggkLWWb5R1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677932725, "uuid": "7b308af5-7177-4a5c-bc48-d08aab4b80a8", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677932725, "uuid": "5abfd4d1-1d7a-4a15-b71e-47e1f774e027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677932725, "uuid": "96570239-d658-4be7-9618-31a6c18ff8aa", "value": "5efc3f0cbde93b03c98bf94804927377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47935106-ba71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677923121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923121, "uuid": "fe6b88bd-d0f8-4948-b536-07abc7ad01f6", "comment": "Malware payload (Mirai)", "value": "07aaef5db51f163a9673b97c11833608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923121, "uuid": "c274f31e-8eff-488b-88c4-646d3918a48d", "comment": "Malware payload (Mirai)", "value": "ffe64af3e11a300859c9d769c7ca5a863d414fe463ee3f9be80b5ef07f8f47c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923121, "uuid": "335c6049-d376-4de4-a95e-392ffc4c7b25", "comment": "Malware payload (Mirai)", "value": "b1f7a5f79d58a8eb79d15ba8c5da2651227a5575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677923121, "uuid": "1ae332bc-d8f8-44b5-8b89-9bd2add9deaf", "comment": "Malware payload (Mirai)", "value": "91892cc18777c5e091806d9f77bf263b8edf2603ae5837ee1f4106a8e8f2954858cf3716a39ded8921795e0310d3181e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923121, "uuid": "eb0d2d48-32b2-4f15-980d-bb9705eff2b8", "value": "T183633BDAF801DD7DF81BD77A4453090AB530B3D502831B3B63A7B9A7BC721A81D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923121, "uuid": "b423e656-fdee-4b83-9755-3331b942408a", "value": "1536:fAgVFTxE3oFDYrly8VhyCO1sxyWbxdJiLU11i+VQ+K:fAQFTO3MErlWCO1GySx/o+VnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677923121, "uuid": "74fe9545-c02f-423e-89ae-3fea2ee81b4f", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677923121, "uuid": "b0835341-8709-4c2f-94f8-ee7c814dcd0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677923121, "uuid": "a66fc417-efca-48ac-a30b-454f2ada8a85", "value": "07aaef5db51f163a9673b97c11833608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }