{ "Event": { "published": true, "date": "2021-10-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-10", "timestamp": 1633910581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c7d61280-881f-4913-8c37-a1d7f334f929", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1a6811-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884250, "uuid": "54f05cdb-66af-476a-97f1-7e240352cc09", "comment": "Malware payload", "value": "75b3de3f46c72ae1010e729db8d2f133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884250, "uuid": "d45336d4-b572-447b-b396-d3579fd02c11", "comment": "Malware payload", "value": "00f35fb7d001a28d495fced16b2893497bc54586808405c7081a452b8fe6a624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884250, "uuid": "d0be6659-cde9-4d23-b43c-e82e3025cbf1", "comment": "Malware payload", "value": "cdc10c10ee2c3578b65a1f90cf47e61eb852696a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884250, "uuid": "e80b9bfc-c78a-4f36-b0b6-997074780e83", "comment": "Malware payload", "value": "2bcd0c98e2575f583da175e51b5707e30cf9d8ce3c4ea379a941f745482653b0e2a37e050f72b89351e643d607230336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884250, "uuid": "d534f5ea-aad1-4236-ad67-54cac0e79f4c", "value": "T1E96302302E120C71A4B06C31F9DA0457871A5DAAF55238A9621E5DBCCEFB3D247F94E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884250, "uuid": "5f0c5849-bcd9-4171-9e8f-030c20fadcc2", "value": "1536:dEwNkjRusn5lRHjTXoTo9lhOhJZA6ixZV:+wNOssXR3Yk9ll7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884250, "uuid": "2f0ed4d3-b3ff-496a-9fce-01049440093a", "value": 70604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884250, "uuid": "ab57724d-08a2-4329-844a-c1c37fc36ab4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884250, "uuid": "a38e1fa6-e2a8-4747-9b23-b1d87c92e134", "value": "75b3de3f46c72ae1010e729db8d2f133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57a497-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866564, "uuid": "e1a2e139-1e1b-4486-b877-5a41fd10b1d3", "comment": "Malware payload (RedLineStealer)", "value": "09098221663beee11dc7b2c8d9776db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866564, "uuid": "ffe46934-8919-42b9-85b8-b46445c0b40f", "comment": "Malware payload (RedLineStealer)", "value": "016c7bf3a1ab43f72a3a498ee4f38a3d45db321cb7eb33c2f48ec885024eaca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866564, "uuid": "64739028-8362-4cbc-a768-dfd8ede487e4", "comment": "Malware payload (RedLineStealer)", "value": "62fb08c5dbb4dfa3ba577b5ddb5ab64adcd722b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866564, "uuid": "9b9379f7-6999-4e3a-a97b-80fd766af69d", "comment": "Malware payload (RedLineStealer)", "value": "a314473b7555eb285f594a5b2a34092c2212188ba5aa8f195fca71703c1f93645ccaef3c8c7645a9c1662a9e5535392c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866564, "uuid": "cec14f6e-52ff-43e4-82c5-0cb6ecadcd5a", "value": "T1B7E4E018F7A0C035F6B216F4897983A9A93E7EA15B2580CF52DD36EE46346E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866564, "uuid": "a8effc0f-2423-4c1a-9d42-db5ef3239743", "value": "d65c67dd6f4a95898a66b39f504dd200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866564, "uuid": "bb60305f-cf95-4e08-8eca-cdd85ab9582f", "value": "12288:2uSHJrM4pHUBsAFyShp5pyHIOnHy8ZpFeb8Ku4NnRpnVar/3DAgVOIXDh0:2uSHJYyisSyShp5XcDC8KnJnVarLAjI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866564, "uuid": "97bdc213-5b5a-4175-85ba-fe3e4f0f4c25", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866564, "uuid": "19cd0c6d-8ad0-43ef-b0f6-c5db0e4e9660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866564, "uuid": "4f8928ad-7dd3-4d0a-be51-975b26d90788", "value": "09098221663beee11dc7b2c8d9776db0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f21df5e-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633866540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866540, "uuid": "bb28c946-2292-4fc2-a1f3-39890772cb20", "comment": "Malware payload (ArkeiStealer)", "value": "271c8cd98ea973ac6f624d19208659fa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866540, "uuid": "2237d6fd-a046-4b52-9b39-e954b1536c27", "comment": "Malware payload (ArkeiStealer)", "value": "039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866540, "uuid": "00904976-c8bf-4da9-a4ba-79f337732918", "comment": "Malware payload (ArkeiStealer)", "value": "23f8fe53a722a3684dd81e652ce1612940041423", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866540, "uuid": "aa482169-bbde-45f3-996d-18c3b9722c3c", "comment": "Malware payload (ArkeiStealer)", "value": "af211124fb40dc8d777cf4d70981c22303fa42dc53608a194fec49af8a27d1fde3b0292d1a404f1d0012d640ba0c7a6b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866540, "uuid": "902a3b65-f50b-4f87-859d-15766fff789a", "value": "T110F4F130BBA0C03DF5F256F889B59269A53A3DA1AB2444CF33D026EE5634AD1EC35717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866540, "uuid": "db76617e-b520-4461-b3ed-29928d578c80", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866540, "uuid": "ea8478c7-d3bd-4fac-89d0-e0a905ee01da", "value": "12288:xq1/Y07v7hWoxIGa+05PJp6IcYHoPLOVfnvi8NnK14z1VG9Fu6fm0A8Fu30jCFa:xq+K7hWtT+0hb6WITQxEUM9FuSNAb3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866540, "uuid": "3edd4fbe-4465-4f2e-b8af-3e45139c0bd8", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866540, "uuid": "b08bde07-6c50-46ab-bc08-2529628a8eca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866540, "uuid": "5154d998-c586-44a4-b7e1-c4cd45476b94", "value": "271c8cd98ea973ac6f624d19208659fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade55106-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877544, "uuid": "e4a2fb3a-1dbb-4e62-8144-c569aebf2f40", "comment": "Malware payload (Mirai)", "value": "e0db9b215d7472e80bb410f7a10414d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877544, "uuid": "4712a010-3805-4bbf-b85b-a8b1bd42c028", "comment": "Malware payload (Mirai)", "value": "0526b4b30ceda688d92282e0a2a55d17e3309e9a9d7a2b9d5c46adef04d56c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877544, "uuid": "d03ce680-ce6e-4233-985d-95e6df67bed7", "comment": "Malware payload (Mirai)", "value": "6791760dbf0739e933fbb5581b73ce45639062cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877544, "uuid": "9ab4b685-ba92-4d6c-a07c-9a87839225fe", "comment": "Malware payload (Mirai)", "value": "441ed500e695e265a829419af09d1863e063efe45ddd55b3887845176768bdf587b6138a28ec7e6e957b4fd7fa376aa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877544, "uuid": "aadd7fbe-7549-486f-b964-50763b0bb84a", "value": "T13BD2E062EEE8C91CC25D013604FF3F86D914D5EA56089AA7AAF5F01B8895F0066243EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877544, "uuid": "b12514b2-1129-4df0-8a86-caa9789361b4", "value": "768:AJ55ogTmYr72RTuM3WxHaG2Lo08nbcuyD7UHQRjQW:o5oZYr72sXB2L18nouy8HyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877544, "uuid": "3e294e57-ac06-4b0c-adb4-78959fcffb1e", "value": 29692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877544, "uuid": "b5d3dcdc-e8bd-4b70-99ca-ed564cd17f41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877544, "uuid": "46a5e512-abb8-47c0-94fd-71f8b57cf219", "value": "e0db9b215d7472e80bb410f7a10414d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9d6d29-2a24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633909804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "c700aae8-9640-4a26-81c5-40e6e275f54d", "comment": "Malware payload", "value": "b6fa321240c02c9dd6c1b5d486d9d2e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "31167c16-384c-4b7e-882a-282ad8e14e8e", "comment": "Malware payload", "value": "054f19ad21f9c56d8322b89c0b858dce6e07a1d9e6000f0630d24a2b1e44f69b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "35443e1b-c333-4910-8204-8ec59f9d9f90", "comment": "Malware payload", "value": "b5cdc7b5eafdf907602f7422fe889c443c8fbdcb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "512b855c-d477-41a9-adf4-fe59216707d1", "comment": "Malware payload", "value": "64293885fa06cb55965666ab1c4b6b6e576d4a930134df16ed2e0f12812891c67f5fc0e237a04aa70aab6eaa71124322", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "18fc8fa6-ad7f-42eb-9a46-2f6126f3e90e", "value": "T12003F133D20E5CB5D0E04DB2BCDB065963E85739DEFB302298040F9CA6EA485CDB57A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "192b50c3-23d6-4708-9e44-bbc35515f114", "value": "768:HbnGKgWNh6a79rdz7a0/lZtPTyNWkFfZ2gt5jTpZX7s+gR6XJzXtwFv/3Ueuy:7nGKLhNBdz7hdWDZ2gXj9ZX7s+hZzkQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633909804, "uuid": "832fc112-6b54-4616-a465-2239f0fa08ba", "value": 38520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633909804, "uuid": "fe6f3e8b-c879-4651-a12d-6c0117b1646f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "92c9c22f-1737-4316-917f-8138342a76b7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0112fe-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883906, "uuid": "adf37f6f-b445-48e6-b8d8-c0212c23d3ff", "comment": "Malware payload", "value": "68fccf5413134642d87ff22cc125fe07", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883906, "uuid": "7fdb8e72-2086-4ac0-b67d-0e666d11babe", "comment": "Malware payload", "value": "05d8b67cc42a50c1f378306a2db89010bf7bc75893e90efbd27f063e1ad6843c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883906, "uuid": "c1009d1c-5ce8-4a0b-9967-d4d93616c42f", "comment": "Malware payload", "value": "b324336e48e0d6c24b9d99f1e323b3b32e1557f8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883906, "uuid": "1072aacb-faa3-4ef3-9d84-b5856b6fc991", "comment": "Malware payload", "value": "e0ae961caf5c36fa98fb916b5fb9b1a006614c7474a17576dcf552529fc999df7bf0bcb4be4daa16b39dbe91c9dc4fd8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883906, "uuid": "dcb607d7-553c-4f67-ba2d-efef659a9bdf", "value": "T1DD433B375692CA7BC0D757F517D796218133B8391F236209B3D8BDAA3F269C82E59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883906, "uuid": "72c19fe2-b7df-4518-96f0-65444fdd566d", "value": "768:UFmQ1KeSZaLGjuL3GoxVbsVFWnyVZSgHo3Gk7IfWXYYYnC8439qS/DDrWMCLsZ:P6/HGSDjbsVFWmSg+78ClKNsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883906, "uuid": "a55a73b0-c98b-4b69-adfd-f54c9233b8b4", "value": 60197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883906, "uuid": "5cf56c14-e9e7-4e06-a1b1-cc659cff936e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883906, "uuid": "efb75c28-f935-442e-aabc-32b8004d81cf", "value": "68fccf5413134642d87ff22cc125fe07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c19e2f-29d3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633874816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874816, "uuid": "a289f223-62ea-4adb-8ba2-6cc5b71ddf4b", "comment": "Malware payload (Mirai)", "value": "f0d0ef067b784309357a630a0b787f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874816, "uuid": "4588f98e-cd44-4b1f-836a-ab157fd7eb26", "comment": "Malware payload (Mirai)", "value": "061c8ba1c03e26c49f2c5970b177eb0d3368a55395dbfef01dfb65acffba2541", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874816, "uuid": "b6243300-3266-46c5-85d4-eb82846d46eb", "comment": "Malware payload (Mirai)", "value": "c1934d159f1fb9726f129595e5a654b18ac54b54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874816, "uuid": "3fa786bb-9130-4e4e-b81c-045ba4a9dfa4", "comment": "Malware payload (Mirai)", "value": "8c15fadf5440b4b75304a1dab388672abc4d73c1a0ad72b87b8fd4ca864efb939189cdfc791cba6672d218d6b122968c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874816, "uuid": "77b40dc5-e4a5-4c95-93f4-8f13dc0b5f40", "value": "T1E5432925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874816, "uuid": "91187527-42d9-47b1-ab51-7f4bfc6f3c83", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDI:eL0AxvSHfymp0xgunvCkV6vTMDauX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633874816, "uuid": "9bbf7747-599d-431d-ab60-6e791d2dcd24", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633874816, "uuid": "90fe27b1-3b05-42e7-81df-ecaa3af805de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874816, "uuid": "af69331e-4f6f-4280-95a9-e777062c685a", "value": "f0d0ef067b784309357a630a0b787f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e430df98-29ca-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633871193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871193, "uuid": "3456efe8-bb37-40aa-9b6b-554b55c4a150", "comment": "Malware payload (AgentTesla)", "value": "f8b96f721fc20f61ae9becc6b8859d4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871193, "uuid": "0001ab95-7053-4a3f-9da0-e789654028b0", "comment": "Malware payload (AgentTesla)", "value": "066a2a8fc33e9061317c324584fa20f45359b743caf41d54885554d1fe9b924b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871193, "uuid": "e8ccab2d-a276-452e-9309-8dad29cc4cae", "comment": "Malware payload (AgentTesla)", "value": "cbdf4e9d755539f7148d7fc9183a9b7a15a2e0d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871193, "uuid": "1a6f5ce0-85ff-436d-a198-adb0bf31fbe0", "comment": "Malware payload (AgentTesla)", "value": "fe4e1d00568d0b5b85091d186031e4f308f708d71c3441a4b445b848a540039765ff70082ba88730d80d5cd1384f0bb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871193, "uuid": "3e867105-adf5-40f3-a6dd-cbd69e5f001a", "value": "T18AE4D0242AFA516AFD73AF740EE0B496BF6EF7723A025439D01303970623981DDE2579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871193, "uuid": "6c8269b5-84e8-4d00-8fb0-35f1f888cc26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871193, "uuid": "3bb26575-1c0a-4ae2-81f8-5e77edbc026b", "value": "12288:qhvJIyDzxssh7SFMktGtqB29Ie7xgaHih7INeS/LJgDSs0:imyDF5lSqe0qB29Ie7rHihsNeeVvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633871193, "uuid": "239d4ea3-de47-4cc8-9c6f-bd9a968860f4", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633871193, "uuid": "39142916-dafc-4b00-94ae-3a28208ef845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871193, "uuid": "6691b88e-2a58-4823-a94a-52d40c92986f", "value": "RFQ received Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffc0da3-29f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890379, "uuid": "32a16ca2-8017-45d4-82bf-cbab2136fa94", "comment": "Malware payload (Mirai)", "value": "e3e4831a13f4512a0ca8df98f74ffd07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890379, "uuid": "d8914059-eb1d-4c11-b5a8-6633ba06bfe8", "comment": "Malware payload (Mirai)", "value": "06716be091974d5477ff2b0513a5cb2b1a31472e11352158e7d9899ad9ea33fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890379, "uuid": "febcc2f6-2024-48e1-b5f5-4b5301b5ab08", "comment": "Malware payload (Mirai)", "value": "e63ce2ef539055615991d073dfbf102b0211d823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890379, "uuid": "8d20c032-2c12-48ee-a62a-fe859a66642d", "comment": "Malware payload (Mirai)", "value": "bdd2490b8bf3909f5aec73fa6656c25b7288d8a8a75367da03e846e963e39c9631ae1bec248a258a4a6f37ead6467468", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890379, "uuid": "c44dad85-4b77-4899-85ba-34d34db9bac8", "value": "T167D25DF6C42E6E48E2194274A4608F345B53F819E2677DF6094B82668407EFCF62D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890379, "uuid": "cec6d481-18ed-455c-b88d-ccf83666baee", "value": "768:okre7Iwxe7oe73XlEy3MCdJon1WCaPr10H:7rKJcn8H1WCaPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890379, "uuid": "a4999316-7919-41bb-b0db-985ce3d70111", "value": 30584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890379, "uuid": "5115a17b-8d28-4f23-a08d-d744b8044e9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890379, "uuid": "2da7bfcd-bed9-4790-b9a0-7f820a8bc368", "value": "e3e4831a13f4512a0ca8df98f74ffd07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c7701d-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633862545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862545, "uuid": "120801c7-1ead-46a7-bdcf-2bf6bce45241", "comment": "Malware payload (STRRAT)", "value": "cd1eea1f3780db849490951d4023cab7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862545, "uuid": "3972313a-62c6-4213-bf05-a089a4b3dd98", "comment": "Malware payload (STRRAT)", "value": "068162e2a6c7c192197076d1eda26f6e083b81bdf35b809e83939774ad8d5497", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862545, "uuid": "c3feaecd-73e6-4494-bdf7-98a9e7e5cad3", "comment": "Malware payload (STRRAT)", "value": "721427fd4e26def26b9c69fdf20f3c7de4f6e7d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862545, "uuid": "fa5732d7-a8bf-4e4f-a91f-84c9e95d2945", "comment": "Malware payload (STRRAT)", "value": "729332c070c6ca134bc056020fbcd08460f1917d411076c4792ecd0c96cc60911511ac6d12d599b35f03b257c276d11e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862545, "uuid": "5acf4568-e306-4629-8269-6bc8f9ce505a", "value": "T1E004C01CB94BDB125B0B770250F9039F3EE70149D5360577FEDEAC0E7FAA8084216AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862545, "uuid": "e4a8fc25-5769-4d9f-b544-2cd53c44d3f7", "value": "3072:IccZlnZMYOKWWwI98+/mMrdqqt3zH1z+/PcZKoTshqkS5s:3ulZMYOxncdx3TUMZKl25s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862545, "uuid": "fdacf802-cec8-4918-bf44-22a637dce131", "value": 187792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862545, "uuid": "0c7e1b3b-3ebb-49bf-869e-b646f4099c7f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862545, "uuid": "dee44cf9-1f16-47cd-8cef-8d67fc684cbd", "value": "Documents and Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91aed69-29bf-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633866449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866449, "uuid": "950f955f-637a-46ed-b009-4230d74bdafd", "comment": "Malware payload (AsyncRAT)", "value": "fddb915231bd05bdb40250bd9ca9327a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866449, "uuid": "b7e8b3b6-f7e3-440a-bc25-480fac488341", "comment": "Malware payload (AsyncRAT)", "value": "06e223bb2af0e00e3c5c7d2a0574e0cf69716f82432665221d49f62a8613b5ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866449, "uuid": "5fb428fc-0738-4909-8b28-f665ac60131b", "comment": "Malware payload (AsyncRAT)", "value": "95e69dffccc8c93611de153fd9993faefc4b0f5f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866449, "uuid": "39b8f289-216c-4d9c-a28f-659fca263e36", "comment": "Malware payload (AsyncRAT)", "value": "cbfe274854de4ddcbde88b7036c1feaa5d1afc2f1cf39118100cf5a9dc80e16c40e811368a01b2facbf6b4a79a330838", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866449, "uuid": "f497d93f-400d-48a5-8607-8122b3e458db", "value": "T1B084025ACFAB00C6C28BA5749209E856C01AF802940DEB773DA48F6D85979D4537FECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866449, "uuid": "c8fd6b2c-f31b-4daf-b1c0-8ad7aebd4d7d", "value": "12288:r7Tjtsfs/76kiLn7AcCkNNmONeWR9yymNk4:r7Fyy76kir7JC4LNegky8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866449, "uuid": "55945792-098e-4689-b7be-7df3d9724c07", "value": 397742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866449, "uuid": "0e781735-896a-46df-9141-4b86d38bc858", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866449, "uuid": "4145ac4e-1b4c-44bb-9f02-7adb8cde2c6e", "value": "ORDER 002110109A.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c72ccc1-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884279, "uuid": "8b285cda-fee2-4425-bd08-fa9ab523d2fe", "comment": "Malware payload", "value": "6824655249dd6ba68298a62f01eaa129", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884279, "uuid": "e73a9a69-3c48-4774-9f08-9446e3235254", "comment": "Malware payload", "value": "075b0f9d98ee84207983b9923aa5a65964e956b46db73055b4ed43e9d97c73e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884279, "uuid": "025c9184-9452-4c2b-ab25-0485b54e0915", "comment": "Malware payload", "value": "8066fa03f293f9ba678798b982f3342f96301ffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884279, "uuid": "bec1aeae-2c5f-4787-ae5c-ea914c0b5057", "comment": "Malware payload", "value": "c217a2ca0b24c15bbdfcdaeddd406b9355edbc6dd6e6c21ba8239a459ae5fc10eeeb7816f02159664da39db41dc3eb05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884279, "uuid": "9f2e4094-cbdc-4ac0-a0d7-3aec140a4bfe", "value": "T1F7A31996B800EFB6F40EE77604D34B247270FFA65E93163273177966AE362D42826F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884279, "uuid": "34f6b9a3-ae21-4aa7-8ad4-7e2d997d614a", "value": "3072:dDbLrqYQ1FsAqbce0yA+rAxmm/Npbxs1n6KNH:daYYFsAnyAgAxmm/Npbxs1n6KNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884279, "uuid": "14b350c9-5d9b-4e10-a681-8303af758209", "value": 101549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884279, "uuid": "851e9977-b44f-4fff-91f2-06270d27835f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884279, "uuid": "b5729ea3-7116-4ed7-9ee1-b1067355b4ba", "value": "6824655249dd6ba68298a62f01eaa129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473eb910-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884244, "uuid": "63b1f56e-9872-4cb3-bfc2-fa417aae7572", "comment": "Malware payload", "value": "7c3c7dcc111bf8fbf3b1594ae268658c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884244, "uuid": "3fc9256d-1fb3-47aa-a972-eebbeeb86618", "comment": "Malware payload", "value": "0847d8153b31278fb82e2cba4c656f3a2cf6f36e4e1ac0406913400140ab3eb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884244, "uuid": "3902982d-c361-4e65-875c-a9310c7c075b", "comment": "Malware payload", "value": "a636e68067fe461fc1df678b837319a4e2f00760", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884244, "uuid": "e9614d96-1867-4739-9b14-5136270dea0e", "comment": "Malware payload", "value": "e849f598ae1211f8bc3bd5fbf80026766679fcf19babb957c652340d01c94169126235ad25072a8a74561e7e187e6b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884244, "uuid": "2187073e-6fd7-478e-89bd-5a1d176e3bb2", "value": "T10A03F1D0AD26F972F3D52C2AF67D808621A588A9FE3AA455D1508D3CD1E3C9233FE254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884244, "uuid": "67433444-88ca-44b0-b312-fc85b549ce60", "value": "768:Y62ReiH0tC1CgjMZCGbnRwqoU5tPCBhq3UKpoImN9i03:YBH0ibj5G9wqoUX6BhK2ImNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884244, "uuid": "eeeeb2c9-a395-4de8-a202-c2351fa699a1", "value": 41280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884244, "uuid": "942444cc-a5ec-46ae-82ae-6c9f8c6f03f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884244, "uuid": "5dd3b8ad-a80f-42a1-acc2-4c3e668e91b1", "value": "7c3c7dcc111bf8fbf3b1594ae268658c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a427f6d-2a0a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633898449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898449, "uuid": "a68a1bf7-383e-4da1-9853-343d5575627f", "comment": "Malware payload", "value": "26306a3240db2d68dd8c9d95f220dad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898449, "uuid": "e567a845-8069-4512-afec-5e0c4dad08ac", "comment": "Malware payload", "value": "08b23a1c44280bf42f9f68339ca378b08c37a8e7b64704faf0001b07f0e5ec93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898449, "uuid": "14d2880c-e867-477b-8570-ba32dc98c38b", "comment": "Malware payload", "value": "2b45c31f8f83166876e6e0059718e892dec5e978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898449, "uuid": "3cce64ba-2df4-42c2-abd9-5a4fe47e14d8", "comment": "Malware payload", "value": "97e33da72c522bc4a0744138d794da882d5fa5c9b95c6c26eb074fe5554e825b62512c220c9b25d45fb84019957005f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898449, "uuid": "2de6e60f-20f1-44d9-9818-f5d58e4caf60", "value": "T11C747D30A7A0C034F5B316F949B99269A52F7DE1EB2890CF52C52AEE56367D0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898449, "uuid": "6a25c166-a740-4fe2-a5fe-36c2902cba4c", "value": "d8470aebc2200bafc1ff60318f406103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898449, "uuid": "dc2a3075-a370-42eb-87fb-4a64a04977bd", "value": "6144:nJVtlUZNHoS8f0K3LoCUdPvNZZCnVHDi9UHu:EXIvf97oCU5vBCVHD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633898449, "uuid": "0483beb8-6b3d-4ce4-80be-ba3c5694dde7", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633898449, "uuid": "3e268c3b-f793-4114-952a-0c57812c89c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898449, "uuid": "e25f0638-3cfb-4007-8778-6439f9e54efd", "value": "SecuriteInfo.com.W32.AIDetect.malware1.22254.21383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c628d6-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633866531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866531, "uuid": "7e728469-ebd6-42ed-a2e1-f10106f91da0", "comment": "Malware payload (CryptBot)", "value": "0ee1a729d1a6c71cfadba80a7a166f93", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866531, "uuid": "2624b77f-7893-446d-84fa-6a92b43f8522", "comment": "Malware payload (CryptBot)", "value": "09185e4fe865342754563f1c4198c13fc8f0bc6854021bb3b75bbf48021e0a34", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866531, "uuid": "4a35b951-ddd4-45cf-8977-7be9828bd16a", "comment": "Malware payload (CryptBot)", "value": "1379d3377cfe5617234b225243b8c57db0e4e1c8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866531, "uuid": "0cd7d00e-4948-4d20-adf2-ede36b6ff1ba", "comment": "Malware payload (CryptBot)", "value": "600d50c2a9d696b09153767d54817564e7a9262c9e3aacae438d1b126918257a682207691e922cd22a46208b9a4675c9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866531, "uuid": "33251496-fb9c-4b7f-ae8c-b8b748ac9ba0", "value": "T1EB94AE30A3A0C075F1F216B449B992A9A92E7EA19B2464CF52D426DE57306DDFCF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866531, "uuid": "920c6da5-e7c0-42d3-b4b8-a722cfd4d273", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866531, "uuid": "8a980c21-73db-4cfd-96da-65faf33a9fed", "value": "6144:JIrSoNdo0gKprnb8xSxcDOW1Ga5YQXGzteOiw2wszZDPJReqDd/SYQK:uN0dQFxUOMG0XGztebw2wsdDuqDd/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866531, "uuid": "4ed4a1a9-2c53-4875-ba51-d381d63aafbe", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866531, "uuid": "37aa5f84-1f0b-458c-b99c-e61b55336fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866531, "uuid": "89f659cb-284e-4143-bcf6-68a4fe6f6b25", "value": "0ee1a729d1a6c71cfadba80a7a166f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5045f19-2a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906332, "uuid": "2d0590df-7706-4b1b-8776-3c2af1a80a4c", "comment": "Malware payload (Mirai)", "value": "5651db4c96bf184aee53b47e69644efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906332, "uuid": "6de6d06f-d485-46d7-858a-109b7d905510", "comment": "Malware payload (Mirai)", "value": "095b600ab4d5a0e1fef2c5b3f6b4f016df617025092218efadc0390d1dba3a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906332, "uuid": "d0d0621d-4995-4d9f-86d0-7b9f01e90025", "comment": "Malware payload (Mirai)", "value": "5f795b6fe15a8d11542ee77b30e5188366c05013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906332, "uuid": "b3ea5470-cf5c-44af-98bb-c76a6da9acde", "comment": "Malware payload (Mirai)", "value": "92bd9115bcf52b4322eddbb0f604dd02cf124fe8e840081c9dc99119a0fc381d1ecbef389a219c20a662cf7790d76cef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906332, "uuid": "008e4879-da62-4f42-8d83-d1c3d814d4e4", "value": "T118335B21BA7A1E17C0E8A57A22F34714B2F5574E25B4CB1E3D720E8EFF20A40A5536F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906332, "uuid": "eb0a6e63-f292-4c85-8794-50e51058615e", "value": "768:0boYLl7g492p7dlUIOQuRxYKSPp/3a7cgk6xO+g90K:0bBLl7g4Qp5lUIOJYKSPoBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906332, "uuid": "629ae12f-f4a8-4a07-98b6-46660a84e79c", "value": 50184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906332, "uuid": "8ae7b9a0-ff22-4b70-a384-9b3716541579", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906332, "uuid": "483d8180-12c6-4158-aac8-88841cede7b7", "value": "5651db4c96bf184aee53b47e69644efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93544954-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843140, "uuid": "9b6676c1-bd39-491e-b7aa-4e7d00a159a7", "comment": "Malware payload (Gafgyt)", "value": "fbf0d4d4085740a0705dfbdb6d83605f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843140, "uuid": "dbfe9f60-11e5-4762-a725-955a7d21d384", "comment": "Malware payload (Gafgyt)", "value": "0b3b62886aba2426e5be3968fa20e55ce3a15e9323db890591e03a62ce0c4055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843140, "uuid": "310b479d-bc11-4176-90ad-dba1a3efe5b9", "comment": "Malware payload (Gafgyt)", "value": "0237bf28a9e7c55f1b59dbdf2c3cf7909b20d247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843140, "uuid": "16158797-7b5c-4e30-8964-3bafbdf719ba", "comment": "Malware payload (Gafgyt)", "value": "977dea42d3881f91fc03f4cd255f4261f69070c9bc992e4e6b84aaa1a63ab4d05c2c77a84d73da290f4915eb92d1c60d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843140, "uuid": "75c531ce-3d1b-459c-a053-bedb50066e9c", "value": "T1A0044A09F6404757C2E32375B68F434A37228BE463DB33065938ABB43FC27AA5E26D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843140, "uuid": "2bf4bd1c-0073-463f-97ff-47b5a9e181c8", "value": "3072:anxAJDautWsDx+7b31IAVIyLFhCj8CQsfM/9DfmmwGBoW0QL+n:ansDautWs1+mAVI8Fha8CQIM/9rmmwGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843140, "uuid": "7b7921b9-ed20-44f9-a828-f833f925f35d", "value": 177998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843140, "uuid": "bf18a0a8-3192-4fb1-a35c-f8d95c94b9be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843140, "uuid": "20a06c6f-96b4-4f5c-94b8-bd804e872522", "value": "fbf0d4d4085740a0705dfbdb6d83605f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683f1cb1-29d2-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633874421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874421, "uuid": "ecc66377-b6da-4d7a-9c11-c6e7a0e9714b", "comment": "Malware payload (DCRat)", "value": "ea800644b9dfd027807447fdd98241aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874421, "uuid": "d1bfa450-f85c-4b2f-9078-b662867e7d91", "comment": "Malware payload (DCRat)", "value": "0b5a4d65bd3424391e5f9bc5b6247635b8097005edb07f35eee3aef1d73e1b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874421, "uuid": "0d6585f9-a48c-4648-9ad8-f096ee063075", "comment": "Malware payload (DCRat)", "value": "f58691787bff0e729a63f001a378bed12fd0a899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874421, "uuid": "3d2049fb-9e3b-407a-b6e1-8925f105af74", "comment": "Malware payload (DCRat)", "value": "5982598b391b2daa40585cb5efeaeb30205e532875cb45bff82a0d7cf118565ea0a1450ec84da4de1d1cc99d9fa2d426", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874421, "uuid": "222ea23e-8838-4c2b-88b8-89821b15fa56", "value": "T14244F7C87B4894E6D56CF53884A2E2701730AC3A2BD0CA6F35C57F8B7B6674169D026F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874421, "uuid": "ddce07fe-bde2-4257-852b-9a7e9f116733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874421, "uuid": "1a7598b7-9df5-42bd-9fc6-8a65a169db94", "value": "1536:OE6rDfeV86vw0aioiPpRyBW1YVqexCNIBjTbUraEhkwamw02sF:OLrDb6vwcoiPuBGexCUYaUnamw+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633874421, "uuid": "a919e5d9-d498-45b0-851a-a000162cf810", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633874421, "uuid": "fab89cda-2141-4521-bb4f-f5b87f185164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874421, "uuid": "97fa5eb3-1f67-4879-bfa0-c4a37f20aa38", "value": "ea800644b9dfd027807447fdd98241aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61696dc8-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851646, "uuid": "697c2844-841a-4bb7-9cff-67af1ed92d3b", "comment": "Malware payload (Mirai)", "value": "4a47b126dc55a96c2151fd2f61a45cd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851646, "uuid": "2156a132-3737-4d93-857b-9f212916563c", "comment": "Malware payload (Mirai)", "value": "0cb91ba70648b7e3613224d2a6e058dddf421f7b049b86f432303e661cdb32dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851646, "uuid": "51a71e76-dd3e-4959-9a58-d1d029b401fa", "comment": "Malware payload (Mirai)", "value": "f252483cbfe40c03e7faa4f7bdfe2519d3385c70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851646, "uuid": "599eeb13-3ff6-4f0f-8512-8b1747ecb944", "comment": "Malware payload (Mirai)", "value": "1351eb9d8aaef9edfba102c1ed4f8521629eea579ea9cafa5004c69d40b51ea806ff83291b72a9e38b469cb95812a6b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851646, "uuid": "18d1dcc3-b07f-4fd3-b62b-e4cf0c4e1b12", "value": "T16EB2E1C9AAEB27C3C251D332E0BC495DD6771AC00746850A2109B24EA39760E8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851646, "uuid": "ac05a240-8dbe-4e3c-addd-b5dee487955f", "value": "768:R/QOC0Yhn6ROHWF09cwNPFCnNBxcTAicz:R/nihneF1wKNBasFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851646, "uuid": "4f20215b-27c8-4e4b-b95f-9f5979cf276d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851646, "uuid": "d51fa2b0-6723-46eb-8d88-3023b0bda11a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851646, "uuid": "b3832525-18b2-404c-9d87-e92a1260bed5", "value": "4a47b126dc55a96c2151fd2f61a45cd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d410ef-2997-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633849177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849177, "uuid": "98f1630f-b67a-4c43-aaa9-a01508d64ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "7f75a14aa2bc8624b7e38f853e0c99f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849177, "uuid": "b244a1be-7132-4cbf-97de-7699121fdab6", "comment": "Malware payload (SnakeKeylogger)", "value": "0d515d42ef9a899209f86e59ebf4b9cb38ac2a7f0627736b4a2ff23ed47f8a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849177, "uuid": "9b06d271-4544-4ce8-ac61-f16afb4b1fb1", "comment": "Malware payload (SnakeKeylogger)", "value": "75e0fe10985ebce798d24f9ecf9f58e51e7a3ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849177, "uuid": "b207b6f8-070c-4456-a4fb-3693591886e9", "comment": "Malware payload (SnakeKeylogger)", "value": "1a08e972b2c83248c65016210413b5b8692c44810c1a76f8a960a2dcfac1937ecf62336244ee8f19943151927df4fde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849177, "uuid": "75dcebbc-78b5-46fe-8864-3c8733b14178", "value": "T169B4E03CD7634B05CE788BF2381CA25143B669A4938EEBBC5C94B8F93D677B59520807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849177, "uuid": "c6acd114-2187-4321-9fb2-8fb36c0ea996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849177, "uuid": "7c9c9a60-cef4-4f78-bd24-58805fa0b4df", "value": "12288:QgqIoUG0x1/YiZ17qVPsSYsZ6v2c2y9NDN8wF:iIfFYY7qVPsmZ6vsip8wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633849177, "uuid": "b0a9cfb4-1ea0-4a36-9baa-a07208ecf633", "value": 495680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633849177, "uuid": "776107d3-c55e-4ae6-89ae-55240ac89360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849177, "uuid": "80cc7c4f-8445-4319-8910-4a21742876d5", "value": "7f75a14aa2bc8624b7e38f853e0c99f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593981ef-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856356, "uuid": "f3b2e68d-cad1-4aea-b432-3c5f8c92119b", "comment": "Malware payload (Gafgyt)", "value": "912fc14ac5b19d95153f5d7e4420ca11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856356, "uuid": "6af971bf-a383-455e-946d-16819af339ea", "comment": "Malware payload (Gafgyt)", "value": "0e81f3d62c18b118b13ceb0fbee402c5baff8b4a84543a31553a35b67b0de2b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856356, "uuid": "62e5a299-68aa-4070-a569-9d447d9b0e93", "comment": "Malware payload (Gafgyt)", "value": "7f921967e66ea1eb987fa2834e42054ebd3f188a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856356, "uuid": "4f9fb348-b43f-49a7-a551-b6c3107b3efd", "comment": "Malware payload (Gafgyt)", "value": "baaa445b7cd09b4abca421e51f0892fb5885760a25cdf9255e9bb984a84dd1f7a83ff8ede67868af98ec6f61fe1a3a22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856356, "uuid": "7ff4db52-65d1-4609-ab72-fca84e6d4cd2", "value": "T1BBC31A05FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856356, "uuid": "94c08296-16ae-44c5-8e25-b68087e05a2c", "value": "3072:KJDZ+6lJQTnoo3TK9vmCL4Xg45hLLUNu+C6JAPbqojwQQRh6RYAvZR:2mCCg45hLgNuUojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856356, "uuid": "17f7da28-6645-4fba-b09f-5a85deb6cd38", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856356, "uuid": "4014920e-d727-4f23-a1a2-12eac0b46d9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856356, "uuid": "36b06e95-27c1-4701-b382-b2148c848bc6", "value": "912fc14ac5b19d95153f5d7e4420ca11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3793d229-2994-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633847710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847710, "uuid": "a06b570d-e82c-4c6e-b005-167138d4cabd", "comment": "Malware payload", "value": "cf8adaa1f5e7c221208af61fdf1e5f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847710, "uuid": "9f1f1938-7bb6-4fe4-bdac-47f9550be938", "comment": "Malware payload", "value": "0e9ab1c4d37cf8181d65b97b6ffce6beeb7dbb27ad50c2d25b3c2f636741577c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847710, "uuid": "9a01ff5b-3746-4600-95ad-30d53626ebfc", "comment": "Malware payload", "value": "d4096c820cdb29df335010bf5f9cd093738dc951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847710, "uuid": "a9637ffb-f05b-43fc-8a49-845b5dbfb7a3", "comment": "Malware payload", "value": "3abd66959b9709fda995d6599b8cbf81d88b61d5e5fa33b4da6cb4657c50faf1feda227262f050d2872de16591407b0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847710, "uuid": "4b948353-7159-40bc-a232-63fe32bb788f", "value": "T1E9F2F12390598DA1FBEF5AFC0994EFD452D50BE19FA20F4252796254CCA02C3E52F9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847710, "uuid": "03868f2b-f47f-4224-949c-073a968d4ea3", "value": "768:KOOz8lPPpQDMIfsvpmhA4SHr6tB56GSwBr8n74qZub4uVcqgw02TWXI:FOaZcIRmmFHeL9rw74q24u+qgw0cWXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847710, "uuid": "1f6ede4d-98b2-45b1-80ca-75896e52a861", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847710, "uuid": "81caa493-b1da-458a-a791-2764716c7b0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847710, "uuid": "abb79133-79dd-47bb-bcb9-5579faa459f5", "value": "cf8adaa1f5e7c221208af61fdf1e5f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01761e9-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902942, "uuid": "dcc6b174-3a02-44b8-9abb-ebe4331ac518", "comment": "Malware payload (Mirai)", "value": "1888942d50c1b9bf902598e33ef449f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902942, "uuid": "8f22e040-9949-4282-8cbe-55d1e130ccc3", "comment": "Malware payload (Mirai)", "value": "0f321f34cea54887439d3a079b2bcae0dcacaadb7ef2e6b65ed617de16fca661", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902942, "uuid": "83cec787-708f-44c9-85f6-121fa2ad56e2", "comment": "Malware payload (Mirai)", "value": "2e49d024a439d063f14f8d4b02a5ee2fc7155021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902942, "uuid": "3f8e4e02-9224-4a18-b930-9637ff68ac81", "comment": "Malware payload (Mirai)", "value": "96f16935aa57bf777c83c9c5a4cf7d613319a4971a366edf803e0e52620b77d18c3eb57b363b5a5d9e4b2fc375095a18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902942, "uuid": "9077d076-a8a9-4a45-9197-916087d06a3d", "value": "T179539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902942, "uuid": "c82c2c20-7fb1-4632-a0bf-677973723156", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJUa:BjiBGFOdOT1Rhf+Kn1cY3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902942, "uuid": "36ad8c9f-0db0-4c46-9f9e-3dc3becb3678", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902942, "uuid": "42a37677-15e6-40d1-b149-67cf70a87661", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902942, "uuid": "b84d7f25-8252-41b5-b332-fdcfcef3774a", "value": "1888942d50c1b9bf902598e33ef449f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9672372-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633866826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866826, "uuid": "b7b32482-10bf-4201-887d-69d8b1b725b3", "comment": "Malware payload", "value": "640cbae71b7b7d21aff3c2cd0d8bc7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866826, "uuid": "0c1a17c5-2ff8-47a4-b282-76f24a199165", "comment": "Malware payload", "value": "10956afc6e95f3b949ec514b3eb9d9ec86e3cb67581ab8915388d51dcea2b4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866826, "uuid": "314e3d56-4de7-4806-b299-5512e912ab56", "comment": "Malware payload", "value": "3a3fa49dfab8a858104051efde058172251099ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866826, "uuid": "723b0ebc-455a-4605-b354-95461a261f37", "comment": "Malware payload", "value": "818de2e8957cdc0ec5244e7f2b3f8b3291faa8fc0012d7788f91b0980934b7ebc4309b287da7a171006f68135791afbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866826, "uuid": "ef7a4094-f99b-4dbd-a54e-6fbb594d5312", "value": "T1B214F131A4C1D033E947997A856A87B58F397872382A9ACE4FE25C715F30AE3C715387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866826, "uuid": "1cdf47bd-bba9-4c4c-b5f5-8a5c517f5454", "value": "3072:UORe48R1xLPA74y/KqMb1pX2Np47fZdqvLi95lgK5os750wZxu+AhGd:UOX8R1xLPA4y/KDOpAeG9HfRHAYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866826, "uuid": "b91a23c2-11ba-48b2-9cdf-07eaa4fa8387", "value": 199549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866826, "uuid": "c8eb9adb-bd33-471d-81cb-1c057bfd9547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866826, "uuid": "67ae92b8-6b94-4db3-ac10-37df19bdd23b", "value": "640cbae71b7b7d21aff3c2cd0d8bc7ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0ab34b-29db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633878158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878158, "uuid": "393c5613-b105-4f6c-80f5-e057895ae61c", "comment": "Malware payload (Mirai)", "value": "3fa6a038588757585e85855ddf7b5455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878158, "uuid": "c6acc7a0-1412-4fbe-96fa-95a80bb80351", "comment": "Malware payload (Mirai)", "value": "10b473b7220654afee893154a7ad69d789ee1f00997b962af6b00d93401475e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878158, "uuid": "f2ed1ed6-5970-4513-9dc9-11769c1803e2", "comment": "Malware payload (Mirai)", "value": "53a275931138b5534d22c840b8967043061e2507", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878158, "uuid": "e055fdd1-b4b1-4ce7-a6f8-1c31e0dfc533", "comment": "Malware payload (Mirai)", "value": "65462fdf2cf2a7f4d3cb9d351b9ef7042d5058178bc2928fa3af92f47333f4286da2f7a6af03a9a71e513ff111188173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878158, "uuid": "155c443e-0356-42b2-b511-ddf6487d0396", "value": "T123F2F163D6478A8EF80E603255EB65021F24CA0551CCEAF64D41BA3AB9C0FB491397F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878158, "uuid": "657916e9-b55c-411e-a72e-ea41d26fd478", "value": "768:I2wjWy0SD4ogmYNX5XBEdWvTZaiU9e+JUEdyqyjlh5v4t4fUnbcuyD7UHQRjx:I2qWy3D5Id5R48ZWPnOn5v42fUnouy8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633878158, "uuid": "6f9b857e-38b9-4c7e-a3ba-0edd57729545", "value": 36324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633878158, "uuid": "63b20739-b886-43d4-b9d4-ee3985a96d94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878158, "uuid": "73b2dd50-d6ad-41c5-89ad-543b1b4e2809", "value": "3fa6a038588757585e85855ddf7b5455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed932dc-298a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843454, "uuid": "afec3693-0ea5-4e4d-ad22-3ad8156f60ad", "comment": "Malware payload (Gafgyt)", "value": "b6cf65cc4ffd119321892a3fd4b57357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843454, "uuid": "53ce566b-d819-492d-8d3f-4e2d7ab1e71d", "comment": "Malware payload (Gafgyt)", "value": "1130ee47ae94435dcb1a55ec2de4911cc6e6b32fe6e6a07418d9122acf47929f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843454, "uuid": "2385f2dd-aaf9-4fb2-a895-d27625759c46", "comment": "Malware payload (Gafgyt)", "value": "05757076917443b485dc110083800f818994cd6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843454, "uuid": "21a7fc6e-4def-4ac6-81a2-7f5da0f2826c", "comment": "Malware payload (Gafgyt)", "value": "d784c2e50461fc842ae99b5f73cc0cad6c6fc438acc3f034753ab16a0796d123c0057b088cb998c6d377e0e2a23bb549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843454, "uuid": "26f1ce95-2edf-4c73-b0be-164f60ae5826", "value": "T148632A026741CAB3D4431AFA06E75B250633F83A1E16DF56F32D7CF45B15188B22B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843454, "uuid": "ad8ef31f-760f-420b-861a-9bd7e23235a4", "value": "1536:zLVYPCpH1jUdOn4JymPWBSgSh1MtN0r/NbHBDSDmd+l2OZ/fufYEZ:zLUCpH1gdikrEHM1ImrVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843454, "uuid": "9734a705-8cab-4aa9-b702-96dfd4ddff41", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843454, "uuid": "e5a6608f-38d7-4de6-bb53-c3b7f58702a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843454, "uuid": "32d8e6ea-45b4-47af-bc8d-640707c0bf4a", "value": "b6cf65cc4ffd119321892a3fd4b57357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec2633b-29f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633889786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633889786, "uuid": "335c2255-b446-4500-8a51-dfedc885b5df", "comment": "Malware payload", "value": "96d0b6218f91c8aa8a978e2745b2e53c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633889786, "uuid": "8c8645d7-431d-4bd2-abaf-1e9fa1fcf8de", "comment": "Malware payload", "value": "12439fc7c876b8bf881db4e97ed57827c1c4f2fd0ebccc29a4e197b19c80488b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633889786, "uuid": "e2a17811-677a-41b3-bb3d-a1cb30c60e06", "comment": "Malware payload", "value": "667267a6fa54747d4230f6dce23c91ad49603bb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633889786, "uuid": "04f91d5a-e0f1-4919-ab29-aa6007973201", "comment": "Malware payload", "value": "396e6ca812e49aea50a54c8f9acf4816c9e100282fa9b69f393255301ae40056f8a1c666da14953e50d7170ac1c66fae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633889786, "uuid": "fcb1c7be-e95a-4c09-a01f-ca5842f39d41", "value": "T120A5334929F02306E8E69EB551901FD66DC7306AD111D2CFBE793EB0FB29066508E7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633889786, "uuid": "4ee9242f-2264-4080-8766-922c3764b57f", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633889786, "uuid": "f477542a-96fd-49bc-bf2d-614cee20cc55", "value": "49152:bU6Rp0kaHbMEeC7UIf+oJMklUK810/9iS21PN4MA5fs+h5e37CdW:f0F7Deq5+GM/0lO1PN4Mqs+h5e3Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633889786, "uuid": "c3c929fa-3a07-49bb-9e2c-19fee39c287f", "value": 2204672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633889786, "uuid": "027ec391-75ab-4db9-a1bc-11b9e5cfb72d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633889786, "uuid": "c55edc5f-c8fb-4e2a-8a92-32bdcde1b167", "value": "96d0b6218f91c8aa8a978e2745b2e53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21186605-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853256, "uuid": "2ff84599-4db1-49b8-ab9b-63a830d72182", "comment": "Malware payload (Gafgyt)", "value": "818d774508f927652a03f81e50150a52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853256, "uuid": "d4fcb8a5-e4d5-4ba5-a0ed-6972eecb2f31", "comment": "Malware payload (Gafgyt)", "value": "13d38ada635b90ddb7b90718caacfd9c326bd7b4b6e4d79b474a4dcb43011002", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853256, "uuid": "cd7b65cd-ef46-4478-920a-d0fde25a98e4", "comment": "Malware payload (Gafgyt)", "value": "95b95657b9a90d5d988682ce3e3bc56d642fcfe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853256, "uuid": "7e6478b1-67b5-470e-8d92-93afe7cae1e3", "comment": "Malware payload (Gafgyt)", "value": "ac8d943ddc7af26f433974ec4dcaca3cdd4aa3f27f9ad0f8aab76814196a9ab8ebb847e90743d3583a6d89c985fa6c06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853256, "uuid": "763c9ca7-3540-4f83-b090-79b343d53464", "value": "T111B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853256, "uuid": "3a49785b-d89b-4eba-a14e-1cf774e1de24", "value": "3072:pC/4rdZHsXsZwwR9lNk5mm/QcuLmHniPNb:pCwrvHwsZwY9lOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853256, "uuid": "169df47f-c915-4184-a788-8059a4102b1b", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853256, "uuid": "41ae5f27-3784-426c-a337-c62389409ea6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853256, "uuid": "86e6ca8f-98a7-41ca-8c38-e93793ead75a", "value": "818d774508f927652a03f81e50150a52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e2c7e3-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899173, "uuid": "823c4d2e-83cf-410b-8b32-267122b4092d", "comment": "Malware payload", "value": "d0dd45ab89552a703fbb6fb1bff0c3c5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899173, "uuid": "41486dee-18df-41b1-abc4-01d9f909cedf", "comment": "Malware payload", "value": "13eccf22dbcace01a5f11f8708570838ed9bf9376c026a9687274bc92848ade1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899173, "uuid": "d0ab5421-c000-4c91-b170-57e4a25a9dc4", "comment": "Malware payload", "value": "ddf726e42fc3d8520cf9df6ce26599f30b7cdeae", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899173, "uuid": "f6907951-4716-43c5-98cf-3bd3f295adc6", "comment": "Malware payload", "value": "8c5608b2ec262e4c5d0bd364e6d2085bbfc801baaadaad086fd092842b79e2965e09a1325b6514b491f4683a330b39cb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899173, "uuid": "a5380044-c65b-4097-a929-b7c5a4b5b124", "value": "T1B1935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899173, "uuid": "33084d5b-dba4-40b2-a7b0-85a0827e8fd0", "value": "1536:W7uJtxNeVE8zVVatlvhE1hmkJ0S36W6bWjK3AyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKQifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899173, "uuid": "921987e7-23fb-4a64-a5dc-f4e75fb36f6c", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899173, "uuid": "595e7abf-19a2-45c7-9f44-301a48f104e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899173, "uuid": "44346cd1-7080-4aef-ab51-3683abc513e7", "value": "d0dd45ab89552a703fbb6fb1bff0c3c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa510a4-2973-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633833658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833658, "uuid": "336e68a0-4c5c-462a-bc97-0a0c389e29de", "comment": "Malware payload", "value": "78137e9844b8aba85403659bc74df19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833658, "uuid": "c5302fae-b82a-45b8-a0d1-da4f406aa9ac", "comment": "Malware payload", "value": "14ec3cd1a6d71fa36372faeffd203470f27393dc3b4d41db61db9c6ed085ab08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833658, "uuid": "52145a0b-89c7-4748-a9f7-e9691bbd72d1", "comment": "Malware payload", "value": "dcc592dce25949f5349fecce47c6f60e814b9255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833658, "uuid": "882b6b07-973c-4d79-acba-dbdea8f18588", "comment": "Malware payload", "value": "8c0b6b0edb635e4a04fd174ac023c852192bdc12e9417de66536473f58b436b503ca33e5a25371401402751b825b5c3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833658, "uuid": "5a6f6947-4e40-46e5-8e25-fc412a2efbe3", "value": "T18253F27A523A50B1DA705838FE99B0C19F2D2FB882DC703A3997467F49D90772FB5881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833658, "uuid": "5e756f71-e29c-45b4-97f1-92b2148d21c6", "value": "1536:GPW38mJejTZWTBmSuprmeXXws3L0qTzmUflV:5JejUToNx5HZL0UzmUflV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833658, "uuid": "f20b6ce3-73f8-413c-8eb4-280276e4eead", "value": 63824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833658, "uuid": "84055e22-5343-493e-8b63-aec633635008", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833658, "uuid": "fd9815cc-033b-4b59-969c-9f3c8bd8ed94", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.1755.15083.7984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34109d3-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842764, "uuid": "2c28ba4a-7125-452a-a52e-deca9a541435", "comment": "Malware payload (Gafgyt)", "value": "7f72e4448d24d5dceedb2272bdfc6639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842764, "uuid": "ae2de2a7-dc85-4ef9-bf49-a466c474acb6", "comment": "Malware payload (Gafgyt)", "value": "1566b6e93d8dff39bfe2af1ab9ac7f59327dc1b5985a0f3b2f048fdb8f216787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842764, "uuid": "c9e88df7-c419-4919-95c0-3b267361a455", "comment": "Malware payload (Gafgyt)", "value": "c98c8517c5213a59b2da3a08e24e0eaf1e28c287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842764, "uuid": "26d19d6e-f46e-4d21-812f-312a04246111", "comment": "Malware payload (Gafgyt)", "value": "ee88162a57f75cc7c8ca2873af727070f52479fb4820678285e1b196b105597bb10874d4c10a9505fab1c0fd4c06494c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842764, "uuid": "84f1ce8f-b133-46a9-a843-a054620e13dd", "value": "T1D6C3F705F8014767C2D327B6E68E4B8D3F3557E467CB33126A385EB42BC2B992D29D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842764, "uuid": "871259c3-1a9d-42bd-9b3f-0fd4d1ca75af", "value": "3072:posaWhJgdWSCQ4T/FhSWT6iGToPTbTmVZqQ7Dk4EqXj5e:JJrgdWNvT/FhhT6itTmVZqQ7DXEqXj5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842764, "uuid": "6dc9f079-d9a5-4b96-8f33-1053e42c56c5", "value": 118931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842764, "uuid": "1cc8a377-86d7-48db-a21d-e914993c5109", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842764, "uuid": "4451e6b0-15d0-4e66-9a79-f1cb8d766d13", "value": "7f72e4448d24d5dceedb2272bdfc6639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8259fa17-2987-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842252, "uuid": "99a7a9a3-7e97-4042-a93c-79cbb44e0a33", "comment": "Malware payload (Gafgyt)", "value": "a806b2897e7e41b66c65a173ab067890", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842252, "uuid": "36c8ca06-7bc3-4948-8474-4515bb1b4300", "comment": "Malware payload (Gafgyt)", "value": "160906ab6aa841f293691656e76ee377ae6ad094773bc55dc4c1bc3dde5d7829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842252, "uuid": "ffd8bcd1-5279-49af-808e-81e7e9f39ef8", "comment": "Malware payload (Gafgyt)", "value": "2d284eb9b470998ed48ac5d9d2c0b6a94ca5d09d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842252, "uuid": "d002ec5c-1650-4b69-b5ae-759a9e7d1614", "comment": "Malware payload (Gafgyt)", "value": "e138875a0ea13b5c7dc6319114252aa11bc782f88e0c51140725b13ede94dc1da74d1ebcc8d319e7f18e398988c6d8e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842252, "uuid": "84234c7c-8404-4ea0-9dd5-05e3de9beb4f", "value": "T1E9A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842252, "uuid": "a82a92f2-208f-47b4-9394-3f02c3c21b6a", "value": "3072:1Sd+e6mKaGP0NdD3PpShtKmZuqQ4DPwXXtse:C6mxGP0dD3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842252, "uuid": "33ce0b93-a570-4d10-ac74-d58780692c9c", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842252, "uuid": "bb735e51-f4ec-4a9d-b50a-5549956def58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842252, "uuid": "9f25fc8f-bb68-4f46-b6bc-85729d8edd3f", "value": "a806b2897e7e41b66c65a173ab067890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6933fa2f-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856383, "uuid": "4c508aff-cf5e-440a-ac26-8ca738ffd2da", "comment": "Malware payload (Gafgyt)", "value": "9ba9fa4809f23172aecddfa3d7b547aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856383, "uuid": "b61c9671-5da6-471a-9a98-f8c0f1476737", "comment": "Malware payload (Gafgyt)", "value": "16e1d358ef6ff630b83d7bdc06e60a803476e2ca59f7a736bdc05f8a75fe143a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856383, "uuid": "c1c60300-7b5a-43e1-94c1-9c56cbea4ffc", "comment": "Malware payload (Gafgyt)", "value": "1b03e8ba8debae816fd543b108cff9bab84252be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856383, "uuid": "1dca12cc-c2a4-4433-90ca-c326b59574e2", "comment": "Malware payload (Gafgyt)", "value": "d0468bee1eb95cd908993607c97f75ae533b6bfdbf50fc583686effc5d2a3c482a5287a868f5b38ae7022eafb1588f77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856383, "uuid": "9b2fbd1c-10ca-426c-8637-ce8d87ef3ca1", "value": "T183C32997F800DE66F40AEA3605D70725B630FB724E531A72B35739A69E362E43827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856383, "uuid": "81c5796f-a4a5-410c-b1ac-c2fcfb9b084a", "value": "3072:iAL8sBfxO2+twsZSM+yAuNJ30DCTLKmvI0PDGnSQNER:iAL8sJxO2+twFyAoJ3KEemvI0PDGnSQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856383, "uuid": "692ee1d7-59d0-4628-9289-18b9c9b8e77c", "value": 118306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856383, "uuid": "fe20e30d-6364-4a96-ab6c-011956e6e393", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856383, "uuid": "99681708-cde6-42e0-869a-9052053b6e24", "value": "9ba9fa4809f23172aecddfa3d7b547aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffededc9-2a0b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899156, "uuid": "e49a2d22-a640-4883-9e91-40d694021531", "comment": "Malware payload", "value": "0aaa974ce105dd9ec1fdbb2cf31a3ed3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899156, "uuid": "1ed7e7ac-6921-403e-a573-bd0b1f643320", "comment": "Malware payload", "value": "16e89ec4fb86e5fbdb6b44eea2277a87d937a5aad940830741e023a86ed32f80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899156, "uuid": "5f125133-10bb-4e9e-9672-e8c8a1852843", "comment": "Malware payload", "value": "da8ede9ba58fb3644439db459ee3feb128b3021b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899156, "uuid": "60806fde-049f-4d0e-a6fa-596e24b8538e", "comment": "Malware payload", "value": "614578d3e0c08b3d2c9d6c82a6a01e9f77c1a559edd41fe06119409710ba43d431a8d928d65731335a9aa67ea34883f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899156, "uuid": "27f73fbd-6661-4c72-9fca-80ac89e2b1b9", "value": "T1EB933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899156, "uuid": "30c16491-09bf-41e1-bca5-4a525ba3373c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Gl4umXxVqDrstKfz9e:Q97vk51RcG7Aol4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899156, "uuid": "6cb98f15-49e4-410e-a9ee-ebcde174c0e5", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899156, "uuid": "2cec5b20-2d6b-4adc-843f-a64321f7d7c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899156, "uuid": "5b771ba6-7d29-4c65-981f-a193d7370130", "value": "0aaa974ce105dd9ec1fdbb2cf31a3ed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7085fbef-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883883, "uuid": "14f8096d-59ed-4e68-ab19-df7b944643e5", "comment": "Malware payload", "value": "79f6a42120a274d7dd780ca9a640c79f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883883, "uuid": "a2102df8-9413-4473-ac52-431863111a24", "comment": "Malware payload", "value": "170280bf85516543fb9a012241339f42b8c180c48bb169071e4ee7a32e14c913", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883883, "uuid": "9fd7533d-1bee-43af-9407-f1b9cd3fa368", "comment": "Malware payload", "value": "d31fba426e01cc6f0f2d4d9d85da65e81c082eef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883883, "uuid": "73b6604f-85ed-48b4-981a-d1b3eb376923", "comment": "Malware payload", "value": "b3764e346546fcf2a311c4dffe0f6d99242cb28daa4ef896f5a0e722c5488326d38813ab220c21a9f4f4b39a594e518c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883883, "uuid": "52c992b9-1937-4530-8fee-318f92642224", "value": "T12D23E152DA088E73BB719CB4E3205D036B945EFEE5E16016B3319DF8C9E61810FAE9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883883, "uuid": "b0bef8cc-7c7f-4975-8421-a29252ee7c8c", "value": "768:F5yr+86QKATVvuPLoT0aIjgKMTbU2iQPq3eWwZgs2q3U79ovDOnJ/j:oR3vaoSMKMTbPnPqOJyC6J/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883883, "uuid": "bf9cd2b6-7527-4d6e-a219-2062c1073b42", "value": 47052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883883, "uuid": "20d30f64-0371-44ea-8c91-1261925c159e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883883, "uuid": "7a085852-6c42-4a24-8e3d-7e0d48d1f2c7", "value": "79f6a42120a274d7dd780ca9a640c79f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bfc4b4-2967-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1633828292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828292, "uuid": "478d438d-7f9d-46c5-a027-b81645464929", "comment": "Malware payload (Cerberus)", "value": "fd4fa33f9fb8f0fbc62d60f83a0ee287", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828292, "uuid": "31148df9-d17e-463c-9394-5526646f1528", "comment": "Malware payload (Cerberus)", "value": "1811bd1c7300746f8eb515ce096834ac4524a80c2fc990b7f4874e070501ddf7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828292, "uuid": "9e779ad5-9078-4a48-aa66-add9c2f65002", "comment": "Malware payload (Cerberus)", "value": "f1e6da0a218dc77c60c441e882923841af8435d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828292, "uuid": "6fc4668d-6f5a-40fb-970c-2584fb3af9c6", "comment": "Malware payload (Cerberus)", "value": "c2a46fb95e0677a33c7491b515493e7ab0f19d6eb4b3a03d25a2b31a41e2912e211e01ba1f4653a255a684c24e6b4859", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828292, "uuid": "67fb0384-0b7b-4d3d-bd2f-d25f9727f5f8", "value": "T1ACD533C1FBA1FC75E6FFD870E092B06334D845899541A57A360F5AA79B05CA42303BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828292, "uuid": "7e7c1d71-4aac-4a3f-801c-ebbc9c13ec9b", "value": "49152:sEBaYhGdUKqRQ9wnHIdKVDoSYqixkJGlHlODoqwjg5V0J6X:BYqG7qBHImDUDkJgH8Ufk7CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633828292, "uuid": "f05cf9e0-62f0-467b-920c-4fc664f40a2f", "value": 2996251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633828292, "uuid": "49b070dd-143d-42af-a948-7f4cf7906919", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828292, "uuid": "c7213b59-ff68-4a2d-b409-6a7a0e0d7c98", "value": "Android_Guncelleme_build_obf_8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4ba08a-2996-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633848606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848606, "uuid": "0394203d-9202-4b61-a0e2-202fcbec0d24", "comment": "Malware payload (Mirai)", "value": "00fa10d2b8a78667f0517964c6951a1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848606, "uuid": "ef34312b-62a7-41ed-bf55-0fd5f54cd2ef", "comment": "Malware payload (Mirai)", "value": "1b7da453663e3b5e7bea3edef16a2b5d7ddcb47e5c010273d1fc4c68ad439553", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848606, "uuid": "a9d9e9f3-f554-4538-b9e5-116af805da22", "comment": "Malware payload (Mirai)", "value": "ebde5037c8bfed1e99aeff405220677bbc2b6ab7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848606, "uuid": "4963aeb9-b6e3-4ee5-8eb3-d43096c9d8f1", "comment": "Malware payload (Mirai)", "value": "b365b5fc7065ee75119163744f722a1af0748c650eeb7b4088ade5f3aa51c238a6b137f1e023525df5ed650b05b8ac38", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848606, "uuid": "3c84162e-aa92-4140-97aa-3ea47e1d74b6", "value": "T1EB6302B3E51D0C9AC7240C38FE388A37A76894F982BAB650A884439CE1559D9D3BD126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848606, "uuid": "7023d9c6-25bf-4072-a4ec-9f621d8eaea5", "value": "1536:Glgvgvnd9ktTK8JSM+6pda3PnD2GxYbmWsuGLvyMiyTzjFA/oG:FgvdeK0l+U03b1WiLvyMiQjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633848606, "uuid": "0d4eff60-0524-4992-b10d-464c548bad06", "value": 72768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633848606, "uuid": "b7dd536e-f9c1-43f5-90ef-5af6f95ec2d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848606, "uuid": "4bc1022d-8c51-4efe-8918-ed2c5b128582", "value": "arm7-20211010-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0718e4-2a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906206, "uuid": "7c6b812d-749c-4482-9a1a-2bdb7b0834a9", "comment": "Malware payload (Mirai)", "value": "308aa888d8466ef3aa9070b5b4820b51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906206, "uuid": "52b95390-65b3-40b9-9035-d09d4886320f", "comment": "Malware payload (Mirai)", "value": "1e05c4a3471bbf8e0a3aad9e3ebcfec3c51e02190c0ee6bec9f717094c6afb0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906206, "uuid": "42b08d90-355b-4c2c-8750-9da943b51198", "comment": "Malware payload (Mirai)", "value": "5a3b57335dfde01e67e8ffc880ebf1950ff1b276", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906206, "uuid": "aafc8118-b62f-4858-8e18-2d89385d1b9a", "comment": "Malware payload (Mirai)", "value": "e0bf414827d0f42713599f4968e35b37d0760c4121f87f7166e964b2d7620ac1ff1472d91a6fae140adae054604ff73d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906206, "uuid": "247f9a33-80ed-4a33-8ffb-75daebcde511", "value": "T15ED2E055E7A1CF56F6E15C31E804DA8162C77B7823DD7962121C531BA2C28A849FAE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906206, "uuid": "3c890959-687d-4189-86bf-49a8f68789fa", "value": "768:xoFMAqYfszmF9x2t6vMEA6ULL9h2T83Ko3UoMM+L:MvwtPakL9W83vMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906206, "uuid": "f66209a3-793e-4942-8fc8-b7a4ebcaac02", "value": 29764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906206, "uuid": "36e11a74-a831-4aa3-b293-2e7f5ff35daa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906206, "uuid": "aa3b82c0-5474-4fef-9f1f-7c78329763d0", "value": "bz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9399d98-29f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633888810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888810, "uuid": "00ab9f87-8963-4568-ac34-f279e7ff39da", "comment": "Malware payload (Mirai)", "value": "fa81dfca3f0dabaeb72c4962995b1fad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888810, "uuid": "c02af5af-4449-448e-a0f5-9a16ef0ddae4", "comment": "Malware payload (Mirai)", "value": "1e7c64e1af77bf03d68a60ed66ab57351925d0a5816934bf964654959aff1a97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888810, "uuid": "b055b8df-0790-404a-86d5-5ad5ea849275", "comment": "Malware payload (Mirai)", "value": "0bd382fb2da8bc7296c48ccb7dce187f56a8d4a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888810, "uuid": "244099a6-cbab-4b0c-9568-afab449e23fc", "comment": "Malware payload (Mirai)", "value": "672594cb7ce5b11e4ca22cc8f69df5068462282dcc2da75f9ab002916c9bc27b3fdd9821b8fde95fe0b06c2a0b7267ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888810, "uuid": "e0be7c57-de1b-4a64-a246-2c341f27f4f8", "value": "T15FE20992B880D912C9D5233BFA6E42CD37252798E2DF73039D122F50779A82F0D7B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888810, "uuid": "b90d19a5-6b51-4878-81d1-2e312046cd10", "value": "768:puNS6BZhlDGVEfWNBFEFn98NOvple5P10H:MS2lDZfW7FEB9i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633888810, "uuid": "27abdbe7-135e-4117-8fc4-58c33968f10a", "value": 33964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633888810, "uuid": "55365170-e610-4fa0-bf6e-af2480d9040f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888810, "uuid": "6018a714-bde0-4bde-8a07-a0387a9b4b34", "value": "stainless.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8b3fdb-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843152, "uuid": "86b793b4-d5f9-4dfe-a79f-f024face5130", "comment": "Malware payload (Gafgyt)", "value": "d81521ddb8af4059373c5b0b4f78d7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843152, "uuid": "2f6e4d3c-2ea7-4d19-8659-7f97ad336696", "comment": "Malware payload (Gafgyt)", "value": "1efb397232be8ecba12da8e4a79482606c2607f6fc91e4f8a1acde19b9ab59bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843152, "uuid": "ecf128f0-3c5b-483e-bbf2-5e843ba115f6", "comment": "Malware payload (Gafgyt)", "value": "d07da2d027423550d93e43b0f862c1d6ac8554bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843152, "uuid": "b9162e48-ea6d-4f12-b183-2a0a501b570e", "comment": "Malware payload (Gafgyt)", "value": "226790eddaae342f5065d01f7d5afb9edd74b73a507d69e29780e8f5c43d4adfce87201e51df81bb4fea725b110695f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843152, "uuid": "f73d16c5-02ec-451e-8a0d-41019111f944", "value": "T185933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843152, "uuid": "8aa262b0-4201-410c-a09e-d9092c870d98", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8SMLumXxVqDrstKfz9e:99bzI9dtcaT0EMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843152, "uuid": "65527550-3d5c-48d5-9344-a5406f873f63", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843152, "uuid": "d3a78811-f621-496e-913b-8d9579a5f5e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843152, "uuid": "308fc8f6-922a-480d-b594-e6556144ced4", "value": "d81521ddb8af4059373c5b0b4f78d7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275970de-296e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831362, "uuid": "20cc372d-f3c9-48a2-8205-c4645bbac905", "comment": "Malware payload", "value": "3e0a68d7c3001ba3a1c01edd294d2014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831362, "uuid": "3409f2e0-1a53-4610-a703-ed7c14a73885", "comment": "Malware payload", "value": "20ca9c48b33e3d778fa6ee6fc9afa7b521e8c9766be28792ee72c0de90d25d2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831362, "uuid": "c2efa3a9-e31f-42c6-bed8-77a30dae15d7", "comment": "Malware payload", "value": "135afef1b40b0a57ceae9585243f2112893907da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831362, "uuid": "6e332109-bc6e-4567-8417-232722f8448f", "comment": "Malware payload", "value": "3de441d9dec2cce9b195b717f2edde7a581232db5c1db162d50afb7ea7603ae5a97da0a47eca885e414c845c7aff5a2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831362, "uuid": "adc753c1-ff50-40f7-ba05-cbb3db11242f", "value": "T1CA2384197A21BFFEE56986304BF38F7043D535922A91A389F22CEB1C0F6168D1C5E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831362, "uuid": "ab25c5e6-f96c-4fb2-a16d-1867a1b0ed48", "value": "768:3pE1tr9KtagGs9KHzcyecJo79UDJ8Tj59UjdkTP1vS7GkSUkZepczQ:5EnpOaXs9KTcyrKGKvUjSLM7GlUkMpcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831362, "uuid": "1cf86aa9-e4cd-4576-bdea-9fe22dcf273a", "value": 46771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831362, "uuid": "96c41cb0-8329-4ae3-a9e9-301adc899b87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831362, "uuid": "152c43a5-a1a6-4252-965d-a81d44cc524f", "value": "3e0a68d7c3001ba3a1c01edd294d2014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a95962-2a24-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633909734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909734, "uuid": "4a25c16f-7cd2-4fb3-bb68-f549bb3027e9", "comment": "Malware payload (Mirai)", "value": "e32fe289df59778ff234a83b26c3c933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909734, "uuid": "48c6e6e3-641f-4fda-ae1d-9a4dc690e5d0", "comment": "Malware payload (Mirai)", "value": "234f62b8c02718903ca3088e540e44500ce3a490f05241b2103ce7b1b4ca3e64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909734, "uuid": "955e232b-92dc-4902-98cd-7e78467c0666", "comment": "Malware payload (Mirai)", "value": "22f12d2e7821c777b9d5beedaa6f3044098ea168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909734, "uuid": "471b6b69-d14a-4fbb-959b-73c7c14f9645", "comment": "Malware payload (Mirai)", "value": "d0b89095776a93d5c0b22c59837fb64825b1df25da013be4d04c2b4e1eace26ac413503d8670c460164ad0b5757870a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909734, "uuid": "b2140d0a-73fb-4798-a4ed-45ba783c2f00", "value": "T164436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909734, "uuid": "bd32f9f0-ce00-4682-8705-21a13b31c53a", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXVh5PnXIsf0lkgUI7O+qoSJ/b:CuOoQAqRU6ECeU6tSbX/5PX5Ifs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633909734, "uuid": "569cf385-8240-44cf-af32-0047c7dda36a", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633909734, "uuid": "f8263ada-909e-48f0-b887-a1c0612ade2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909734, "uuid": "33f537f6-87f9-496f-bb41-48701155b744", "value": "e32fe289df59778ff234a83b26c3c933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b67017-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633900000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900000, "uuid": "05ed9f7b-c2f3-4dbf-a296-7ab70307b5fa", "comment": "Malware payload (Mirai)", "value": "3cf4a923c72c640129dba3e9c3134adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900000, "uuid": "421204e8-169b-43aa-bc74-e4331312eff0", "comment": "Malware payload (Mirai)", "value": "24291773b436c35f36e4d501c02c8f9c8a24328e0684c726ea8bf42ee20de4e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900000, "uuid": "4c850ab0-75d9-4f56-bda4-747744cdc7b3", "comment": "Malware payload (Mirai)", "value": "d4622fdc27e63dd4563823edaf6aab83624aeb46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900000, "uuid": "6f420979-1c1b-4966-a569-ff17d09ef714", "comment": "Malware payload (Mirai)", "value": "010217807f28f176837099a1ff8e20ac8705835213f1eac267ac747add2270e2fa7c5952bd0cc97a180158536873269d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900000, "uuid": "508c863f-2f51-486c-8c7e-d32b5d7ca6cf", "value": "T16B235B52322C0A47D1A71FB1293F0BD0D3BFED5020E4F6856A4F9B4A8635E77458AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900000, "uuid": "3efcf64c-aca5-46ce-ab4c-82390f41000e", "value": "768:hoBUisV8LuA4NMkWl7Oq3wIVHdn3a1G0jP:KcV8jSIr3a1GWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633900000, "uuid": "ea17fd78-e2bc-4e61-8170-308bf12e2d9e", "value": 46384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633900000, "uuid": "3bb8e4c3-cd7f-408b-baed-577c358b5c01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900000, "uuid": "fff3e4d9-1f05-4fe4-9fda-c3096b28f8b8", "value": "3cf4a923c72c640129dba3e9c3134adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4531419-299a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633850496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850496, "uuid": "41d5ac73-4f3c-41a2-b7f3-877bf15b5057", "comment": "Malware payload (Gafgyt)", "value": "fdd88dd430e0c9c74390b7899f78ce79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850496, "uuid": "fd5f9506-bb67-4ed9-bf50-ab7669ee159c", "comment": "Malware payload (Gafgyt)", "value": "24ddba0c078ecd6b214b6144c9ce6ea978800140cbffdcbdc57760c5925e6317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850496, "uuid": "4abddcc4-9b3e-483f-b9b3-72037f96349f", "comment": "Malware payload (Gafgyt)", "value": "21770bee39285479e377c7f9cacb0f80f29d8fa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850496, "uuid": "fafd2974-e31c-4248-8a78-bdc4fc3eb093", "comment": "Malware payload (Gafgyt)", "value": "6988258a9b0890dc93a083646b9bff7d52473b124b47cf308526796eafa140038c79b24974d51d1c2d47f8b022a84b59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850496, "uuid": "d7ef5319-ebdb-4559-b2f7-a8c54c01c160", "value": "T17E930941F9418B27C2D227BAF7CF435D37366A7957EB33116A34AEB42BC27981D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850496, "uuid": "50505eb8-ec8e-440a-8b30-6a70fdd4281f", "value": "1536:gqjhl4zPPLyru6Ukf40Gjq1iDWDixHOFJ7PdQCRmREqQ4b/X7Xtee:MzLT6v51TiM7PdDmREqQ4bv7Xtee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633850496, "uuid": "24b5eee0-216e-49da-afdb-51695de15c56", "value": 96600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633850496, "uuid": "272cb19b-d32b-4ee7-b363-4aec0a241e49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850496, "uuid": "8ff18579-d42b-4e88-bba2-ec814f4a70d0", "value": "fdd88dd430e0c9c74390b7899f78ce79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9005b39e-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843134, "uuid": "3748b1dc-9bf0-433e-9ec9-e3839eae95c0", "comment": "Malware payload (Gafgyt)", "value": "3071c0f9537aad030272e1abbc2a0ad5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843134, "uuid": "b0a60a0c-6104-4545-938a-2e8831cfecb9", "comment": "Malware payload (Gafgyt)", "value": "287f6e0d58e0fc6f980c002b73e032b455ecbfe754d3106dddbf4ef3d3230edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843134, "uuid": "fc011b2d-d211-407d-b8c8-87aa3cf8bbdf", "comment": "Malware payload (Gafgyt)", "value": "f71766aa5b833e614e811e658ab982e898aede16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843134, "uuid": "34d83cd4-69a6-4d31-a76b-222a2ca285ae", "comment": "Malware payload (Gafgyt)", "value": "51698345a960fc1660d79e93fda7aca777c98cc9e74e3635b56b24aec008412b4884313be285ed0a3247c54cef7ff1fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843134, "uuid": "c4c9baa8-8c3d-4087-803e-d428003d9a81", "value": "T153832B43E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A313CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843134, "uuid": "398a9931-364a-4555-a3eb-3aaaf83129bb", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCCujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJJ94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843134, "uuid": "3b71381d-f6fa-493d-a377-12f69fd5cd6c", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843134, "uuid": "5b919fa5-3753-454e-9247-ad26611c792c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843134, "uuid": "7ddc8c21-c4b3-49d2-8e46-c5c7f128c502", "value": "3071c0f9537aad030272e1abbc2a0ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a18e13-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633866710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866710, "uuid": "9c01a214-f75e-4789-baf2-bdab984ac811", "comment": "Malware payload (TrickBot)", "value": "c2b42c61debb80e1260204445491837d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866710, "uuid": "9647beba-2adf-43f1-8389-ce2d981dcc0f", "comment": "Malware payload (TrickBot)", "value": "295a8418d504dd81e1066eab3e78924fb107e3f74301f56be89544e942c19b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866710, "uuid": "0a86793d-0fe6-4489-9479-49d2010f8f8c", "comment": "Malware payload (TrickBot)", "value": "7a7172d274b8f01353c7a6bc65cacc2f36c38455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866710, "uuid": "b7bf2263-11af-42c5-88be-d92b45076b30", "comment": "Malware payload (TrickBot)", "value": "0785d9f36a74d6361b6c6322ed34af972ce0d16a4301c50420ffb9388c38838467b325a7194e31532231b2104389ff49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866710, "uuid": "a332eb41-84cf-4621-ad73-83a191ae5b7c", "value": "T151A4D033F1E4C8F6D1F712700EA65BA9B67AFC10CBB0EA5753805A5D1C72A858923367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866710, "uuid": "b472d765-66d4-4637-b6f7-1b4e5183e29b", "value": "f8cb6cf7a746c79f8c917be532cea46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866710, "uuid": "2e09dd38-85d1-4988-bd83-13d10f895ad7", "value": "6144:X9cZrtODhev9zIVcMYkh2Kb//xHEZ0rmMTG9VVwF85HA5ke1W1DJSqFD:tmIDhmkB/xkOF0LNA5W1D5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866710, "uuid": "3d9c9e7f-df20-42a5-878d-b6931081b81e", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866710, "uuid": "e3b4f70c-2eaf-4a8e-96bf-8d701ae7be03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866710, "uuid": "5259fbb7-920b-4865-ad97-89aa06417558", "value": "c2b42c61debb80e1260204445491837d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdd4b43-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884285, "uuid": "c3835e7a-8991-44b0-8ae2-7247ec30f805", "comment": "Malware payload", "value": "bcb8e86f4c92bb2bbf486a79a6fc33bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884285, "uuid": "ae63e786-f45b-419c-a194-5a6928019772", "comment": "Malware payload", "value": "2a58b120f470131303724750a58158c3f52e9de06340ac35bb9ec33e83747da2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884285, "uuid": "9792c45b-f8a1-4b8d-bef1-124fcd191a89", "comment": "Malware payload", "value": "0c5af342acfe958968bc6f09766abab08995fe0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884285, "uuid": "14d95fd2-30df-4238-a795-01a32ba0f2d8", "comment": "Malware payload", "value": "6dce2b4d1745fac48f718a412f7a4e322ec9819341b7d060ce85632afeb35cc1efdf17689628a438cc3ee363e26005e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884285, "uuid": "02fc4b0f-0095-4356-a367-887c7c39f87e", "value": "T1798302B091D43A30CAA9DE7FD3BEE3535856D960D2FA213735068BF971F6801D2A2C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884285, "uuid": "76e1ff13-d7e6-4100-9c8a-74e80848e1c3", "value": "1536:0RDb2XX/65YUZc3WZbDiWPpGeTI6SacXja78CDA0ThOm44S3qQw:IDwv6iCj5Y6GjiDAsOkiqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884285, "uuid": "336f27e2-b391-4752-9603-427e349e24b9", "value": 84644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884285, "uuid": "4e9ef4bb-670a-4ab3-8442-22d13a6eebc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884285, "uuid": "2de76e5b-0e94-46a8-8c1f-10818ae9a3a4", "value": "bcb8e86f4c92bb2bbf486a79a6fc33bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd48116-29a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633852953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852953, "uuid": "64444158-7a85-4eb7-880d-d46406fa31d4", "comment": "Malware payload (Gafgyt)", "value": "e8163f18a4fd591e80be5983cd9e4d20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852953, "uuid": "c1ff506c-f32d-4900-b0c4-34f4f8b1e65f", "comment": "Malware payload (Gafgyt)", "value": "2adcac31883b5f903a926cc81c8318883d8ab2d1a563c2042c80c510b0be1bf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852953, "uuid": "dad36a13-d1a7-4b05-96e7-325f49886e62", "comment": "Malware payload (Gafgyt)", "value": "136a383b8275cd364dbf88686fec313804d647cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852953, "uuid": "4838a97a-1003-4810-b79b-38aa38dd77ca", "comment": "Malware payload (Gafgyt)", "value": "b06e72c358cfa4f249dc8e43b2ba9a9a70c78ff0247b2d3909682d1690ecdce41987019b1bf4e0c3b5bbafed4d4aab3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852953, "uuid": "fc70c3e1-eacf-4a4c-86d3-12f57b8d1808", "value": "T1D6C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852953, "uuid": "541cab21-eb32-4c61-977f-afdcd5470123", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP2L7ymm/QMurB1nKGNb:SMQplV2amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852953, "uuid": "451adb20-77ba-46bb-90e1-8b4e16461d4a", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852953, "uuid": "00a7bbbb-26ea-45cd-b211-6dccabe1b975", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852953, "uuid": "b6667c36-9128-4626-9d00-7b75b659c6f9", "value": "e8163f18a4fd591e80be5983cd9e4d20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d4f996-2a20-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633907919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907919, "uuid": "9acc85cf-fd50-4d6d-9a9a-2f12cefd1bfc", "comment": "Malware payload (Mirai)", "value": "4f65470543f13e2f64d382fec427c2d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907919, "uuid": "c6061f91-c20a-4da4-9dad-eecf261966c1", "comment": "Malware payload (Mirai)", "value": "2be476f72099978d880c11082eeb0721b6db7c635f2592f8cb1fdc935989c767", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907919, "uuid": "0702f467-791c-4bc9-93ed-192d5d91bde3", "comment": "Malware payload (Mirai)", "value": "0d0f81c8b8237a9c29777bfd4bb5880121e87560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907919, "uuid": "edb822b1-d02a-4d83-bf7f-91eb5075fe6f", "comment": "Malware payload (Mirai)", "value": "b5db5917416294cc9c734648254e7df56e6ecc783f2ae1b89d6427e347107e4cec7abc1fbbf34042f38070ce49541bc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907919, "uuid": "d98b491d-f0a0-47f4-971b-3a511d86cb20", "value": "T1C2339E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907919, "uuid": "60f10765-29ed-4026-9872-20e1864a0c2e", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40ZdiWFyGoMuJLk3XCmlolN9aXCxF:EcdC753UlwtNFFyGoMD3X3qlGXCxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633907919, "uuid": "3a0d8ab3-006d-4416-a593-da122957f02b", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633907919, "uuid": "3f2d969f-32b6-48b5-a6f0-33e00522dc4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907919, "uuid": "34e06446-4803-4edd-ad80-72611e69fdce", "value": "4f65470543f13e2f64d382fec427c2d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cea8013-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856363, "uuid": "ce457683-f5b5-414d-ac2b-9eb991aa44e3", "comment": "Malware payload (Gafgyt)", "value": "a550039ebfc1cc2b31b359ef77c516e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856363, "uuid": "396ee8fd-1771-494a-b3d6-4fca4a231fc4", "comment": "Malware payload (Gafgyt)", "value": "2d52cb0661640779b4f7d94b97efd38b0ad9b4a30edec2eccf6e4a087725066c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856363, "uuid": "85715e97-79aa-4fd4-87f9-45e90dfed946", "comment": "Malware payload (Gafgyt)", "value": "02144b3bd6643e09cb2594426b5188206c0697a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856363, "uuid": "d933199b-c384-4279-9ada-e1c1aa39c470", "comment": "Malware payload (Gafgyt)", "value": "d186a834f336c521468431cb724bd41b80f327f1433d74d868453f78f2f39a27d3b7d931a233bcc0ad72f89122002276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856363, "uuid": "f3936ab4-e917-4307-9012-e4784bd877e1", "value": "T14AA35B82D642C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856363, "uuid": "16a36cd0-1689-4306-adc1-486dbef62669", "value": "3072:i3yqjPQP39VjGWX98c32V7kGyNVV5huf87FXnf0OzTyoQQub:ixQP39VjGWXJ9NVV5hyeFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856363, "uuid": "bf6c3d7f-0da2-4c62-b59f-a458db3ec630", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856363, "uuid": "1fa44e73-4bea-4391-9510-89a431794f62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856363, "uuid": "537da7e4-67a7-428a-a1ae-5e14b4e2286a", "value": "a550039ebfc1cc2b31b359ef77c516e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244d2d01-29b7-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633862710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862710, "uuid": "9e3ee3b1-afe7-4bf1-83c2-58ccc58f826d", "comment": "Malware payload (OskiStealer)", "value": "ffaa9755239587c3b4678da8afa6dd9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862710, "uuid": "3eb510f7-cd7d-4c43-9c6f-ddd9e9a76e01", "comment": "Malware payload (OskiStealer)", "value": "2e970f330612770b2d3b786690aa6dd847a0d4773cc726fdc5df1dd9338d6e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862710, "uuid": "5b56edd6-c898-4791-8e7c-0177448c6732", "comment": "Malware payload (OskiStealer)", "value": "71a981250a9bac4dbb517196c86adca52a22244b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862710, "uuid": "6486e376-234b-4f51-bdc3-54b8c9f679bc", "comment": "Malware payload (OskiStealer)", "value": "4eac80a54604320ec6566c9892e81b647c8aac420d6c685f618d1436bb43fb8ab1ec51cc715f36ba0cb4659b7392ffa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862710, "uuid": "ddee0de8-45ef-4e03-9520-3319cc96ac35", "value": "T1F2158D60DAD50025EF729F3859F95876BA3BAE7139217C3CA41B7EA70B334C19893439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862710, "uuid": "d9888598-4806-439b-88d6-cf59264eff46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862710, "uuid": "c3621323-701a-4d6e-b342-e924a982e479", "value": "12288:phvirSme9I5UJaeutyLgiPxl6MkneDogS7qn+QHnFsVjs7YtiwS0:/Me93attKgiDt3S7ULHnhcpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862710, "uuid": "0a828941-59ca-486f-a249-c390e4c1e053", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862710, "uuid": "42ecd784-801a-4862-8ff3-921d4c29efab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862710, "uuid": "bfcd00d2-356f-4831-8011-0b9b486a825d", "value": "Account Details for transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d792091-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633867208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867208, "uuid": "9f4dd3e1-2ef4-436a-a3a9-311e69250a57", "comment": "Malware payload (Mirai)", "value": "3745a83f9ac7d8da0301f27dd9effbd5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867208, "uuid": "320c35c5-f84e-4b70-b76a-a54c3a65d509", "comment": "Malware payload (Mirai)", "value": "2eec6d363b79e775d0e3bb917467b256c7e2f7d400b9a329fbdfc80cdb8a27da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867208, "uuid": "97e8baf3-d06c-4e4a-bb33-5d3c7912e8a5", "comment": "Malware payload (Mirai)", "value": "d3ad3c171ff8aba36bc0d12ce19b5b8114c34376", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867208, "uuid": "5b9f13fa-2398-49fe-8abd-e6af9fd73719", "comment": "Malware payload (Mirai)", "value": "7e82f6b03d0a1ba6a771e1d298620b2d408278d381c6687bdb0a33ede56da1911c5084984ea3fd58a59f08db18fcaee1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867208, "uuid": "b9477d97-c880-454d-b5c4-ea50120d935a", "value": "T15C334CC6D983DCF5DC120672306B9F7296B6E5BE3068DA47D7D9A932ED02A02D10738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867208, "uuid": "2132ade9-171a-4993-bb19-4034e472b04f", "value": "768:zRV34rDgx1ldhWtnpata7hpd2siavrWuNULIK/IdKCShxYvEjjTxIeh:lV34rDElFta7hp0XavVAwKdwvEjP+eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867208, "uuid": "264ff725-9e09-4e62-83fc-757ef8f1a0ef", "value": 50940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867208, "uuid": "7faa9cdf-0dfd-41da-9294-bc801dc6fd0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867208, "uuid": "4425d916-e1e6-4ff3-9fad-cd231d72150e", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1793e1b7-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851092, "uuid": "2a3a5af9-ef05-4e52-ba25-27f87c9bcaa3", "comment": "Malware payload (Gafgyt)", "value": "d212dd7061881e6de78b36045ecfe987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851092, "uuid": "cc410d1e-210c-40d1-95c7-fa99aaca6475", "comment": "Malware payload (Gafgyt)", "value": "2f028ca23a1dddcc44868772e9407ea99a363cf735be4478823020fd0aa02d98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851092, "uuid": "4b66c360-d5cb-4a00-8183-71f22ed1bfb2", "comment": "Malware payload (Gafgyt)", "value": "75efb9c81e00fb3529aa2caa72cf229719e26ca2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851092, "uuid": "b69ad15b-ba93-4086-9d44-8dc3bc695b19", "comment": "Malware payload (Gafgyt)", "value": "8e7e2d1d9ee76974db669fc1bd9d978954fc0f0dbaeaa963b32dc98bdef99a36faaa600f2adb5161bfc9b156ea2ceb54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851092, "uuid": "388ca7df-1f6d-4dac-a42a-269f048045a3", "value": "T10F733C45E783CAB3C48717B6029BAA690531F93A0E1F9F46F31CBDB49F124C87126765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851092, "uuid": "6f16e555-bc06-45b7-8025-e8997cd94fc4", "value": "1536:7K+OxQeOWo6E4DCrEk3vYbOzx6Mf07B97mLI2VOCjXUfyRk:3OWulTCrEk/YSt1e97mU2VOCbUfyRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851092, "uuid": "ca969f12-0771-488f-a922-f04ad9804b31", "value": 77696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851092, "uuid": "5e259c21-0a88-4e4d-905a-fe699b8a4e28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851092, "uuid": "bb2ba484-99a8-49f2-824d-104ef6013c3e", "value": "d212dd7061881e6de78b36045ecfe987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d96a848-2973-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633833654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833654, "uuid": "58bff668-939d-4a7d-866c-c2b7751ca37c", "comment": "Malware payload", "value": "5ff3d213fdeb7d290e4236d4c56ea2a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833654, "uuid": "25fcddbe-0560-4b9c-808e-b8db3637c362", "comment": "Malware payload", "value": "2f2f01ddd4dc774ec2acb4e2555f62420f312657a9d21f836ca61260b841c877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833654, "uuid": "41925ed3-4115-4830-86dd-f14539ba29f7", "comment": "Malware payload", "value": "a13ef8e4b66f5dd123c7691311d129a05fcc3863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833654, "uuid": "a4319c0e-ce44-4bf6-8688-f6b8a22b2803", "comment": "Malware payload", "value": "5e52c9c313c8e7fdf18df40ee9fe228296a8f4fccaf3c82c4c05a6f9b91d61af6f1a2c9f38ae224f9f07c5c155f60dac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833654, "uuid": "3cf06f9f-7a22-4b32-b124-24746248f021", "value": "T14A13F14ED8E03E56CF4E183EC08F16925219EAE5355C8F1A29344C84A2FF17B77C59E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833654, "uuid": "a78a4cd5-182e-4184-ba48-96a34b4a3236", "value": "768:HRRHnuoiRbmqlLV/eTzXmeTSM5pPu9P9vRDR7Zk0/zwbgXW+bL/eb:HR9gVmPWeT3fu5lCWwbg3vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833654, "uuid": "8a4e5b14-b071-4b57-9c58-2cf45848b4c5", "value": 44572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833654, "uuid": "788d61bf-bd4f-44e8-ae69-7f23764463f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833654, "uuid": "67848401-69bc-4f42-9882-fb7a033baec4", "value": "SecuriteInfo.com.Linux.Mirai.1667.8168.20047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8854e9c9-29f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890366, "uuid": "7cb8261b-6fd3-4499-aa16-c1594d800477", "comment": "Malware payload (Mirai)", "value": "fc1f068dfdfb28591304f2d6187cc8dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890366, "uuid": "ecef8d8c-2720-40e4-a5e1-9adf884f78af", "comment": "Malware payload (Mirai)", "value": "33145cc5894720b1d73114490510af9813ca04e3c0b3480cc6b6402ebe69606a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890366, "uuid": "4df16e86-3b6d-4014-9a68-ff1c695e8087", "comment": "Malware payload (Mirai)", "value": "6961b7b69b926b4986e2039de912bb48b0315f74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890366, "uuid": "992a6e6e-2696-4396-bf14-977641586132", "comment": "Malware payload (Mirai)", "value": "87a63dd649e74d9f17983df6fb6a69b2913f3d4bbb4d5b2d3c2534ec186bfebab1254c7dd2d9f7f10531d26bbf719b6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890366, "uuid": "19ba99f5-002f-4d32-943b-944b9c208aa4", "value": "T1E0230896B981CF11D5D4127AFA2D128D33231768E3DFB3129E106F207B8697B0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890366, "uuid": "470b50b0-7dc8-4ee0-93cf-0cba2e108777", "value": "768:rZnayttII3ZJNYKTK63oJk5Q3+814ICQFWd0W1KUsfum7IfMsIz16iRLwy1t7x78:rZnaSIIvK6Z5Q9jW1KJPVsI4iRLv1t7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890366, "uuid": "a046903c-2c59-43c6-a3a7-8b96d619981d", "value": 46212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890366, "uuid": "188a7cc1-f9dc-45fb-9d4a-264801dadf8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890366, "uuid": "bf6db33f-59de-4cf3-b283-f9f284bd3acc", "value": "fc1f068dfdfb28591304f2d6187cc8dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77181acd-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883894, "uuid": "13a883b5-449e-46fe-a64b-cb0454c8e92b", "comment": "Malware payload", "value": "877caf69413972731fd1af8dbb90bca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883894, "uuid": "1c004844-4a2a-4a6f-8f43-eebfe433a15d", "comment": "Malware payload", "value": "34bea1b9281271fe05af97d8f1a8443f1342b6a1de19ced833316dbc09d7be8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883894, "uuid": "31549a03-7504-45da-ab2a-585808ba78ae", "comment": "Malware payload", "value": "c1b91047064f4f7a2c7492e90252ccac6116cf95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883894, "uuid": "8d4b9847-4c42-4992-8744-316fafd1411d", "comment": "Malware payload", "value": "edeb06ecff46ffa9006179d4458059c39775445d912c34ab00335572833429a9c8da42655fcfda1b5399ce4671169a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883894, "uuid": "a03c2099-7389-489c-90e9-64439c412d69", "value": "T13D63022DB07A3E4CECCA2DBC51EC37A7A79270D1C1989216D85ABC406D9898391DF0F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883894, "uuid": "e213f5f6-5037-49d6-81ad-c86ebf50b723", "value": "768:G5ki98zgY+mVcW58vbhtRqST82euWXADV80fTOvGbFl4FU9xAIg1OygwLpIoNghB:3i98k3jxcOD4FUb61TgMYvcYTum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883894, "uuid": "c645d200-329b-463f-8eaa-c0a0758f8d9f", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883894, "uuid": "727d5eb9-1af0-496a-a5e5-d89672540ca3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883894, "uuid": "9fa37b57-0f5a-49c0-bbc7-7683ce4d84c0", "value": "877caf69413972731fd1af8dbb90bca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7724e1a6-29e7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883465, "uuid": "3a03dd2a-6b9e-4cae-97bb-e912dafd464e", "comment": "Malware payload", "value": "2591280d14b87de6b83a3d5c78da1ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883465, "uuid": "49e67f29-ca2e-460f-b606-15456d56d7af", "comment": "Malware payload", "value": "34c1646e2d0c27eaecb515e7b3d880a8eb0d548286d99e8460a37959b43ec7aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883465, "uuid": "c7e06a85-9dcf-4e4b-87a9-6cb2aabc0419", "comment": "Malware payload", "value": "64c76e4ebb88052d3a437260142bde209add5879", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883465, "uuid": "ff98afa0-5f0d-4a7c-85d2-fac1756bffa0", "comment": "Malware payload", "value": "afa8fc342ef2dcfe1409f6efa90025cf01c9a32a562eb6d8db3c7829fced6a0a2ea40139607e52bf39b26fea1fcef08d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883465, "uuid": "74160725-e617-4d07-a3b2-18ad9c426a43", "value": "T1EA43F1D1CE66A7B7F7235A14DCBB2212711A0AA4D1ED13DD37878682B9F3CC24EB9045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883465, "uuid": "17d21330-8ffb-44ca-8a9f-56032ce36076", "value": "1536:+yPJWtV6N/KVexqhI/cffCfJWLxpFf6Rc25Li/k6I1Efte+dO:+yPJW4cnxf6gLxpFVN/noQt5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883465, "uuid": "c62075bc-0ba1-4f7a-9d69-c2954df7dfbc", "value": 60380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883465, "uuid": "ce61c8a3-ef88-4fdf-8de0-1266a8937d84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883465, "uuid": "20b32c01-896a-45fb-86c6-79e5b873e4d9", "value": "2591280d14b87de6b83a3d5c78da1ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42290651-296e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831407, "uuid": "a054fcfc-39e4-47e5-aec5-49696c27b99f", "comment": "Malware payload", "value": "7dfef0eada3a56a71b04a2ee11c1d608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831407, "uuid": "8da5b881-3918-442a-9620-1d11e238dedf", "comment": "Malware payload", "value": "357458e807171d930125fe1d9bf084bfc19bf8d7514e426f46d986843dde4e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831407, "uuid": "17a11643-19ec-406f-9746-28cd6d46e730", "comment": "Malware payload", "value": "e230366ed8ae7173103fb82c277707520e5ef33f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831407, "uuid": "dbb416d1-c2f8-4518-a0d1-5194ee3e6742", "comment": "Malware payload", "value": "9d1f7bab1bc602856dae7fef49170e864b7079893ce14227241c9895dd3fc950e063828f23c9337a8d07400200e8c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831407, "uuid": "2521e4b1-d330-4861-8d6f-48b708de658e", "value": "T1B943190392418A53C4D21B7EBBAF861936236E54979F331167287FF82B427EE073D522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831407, "uuid": "7de55838-0c19-4689-a684-c32c7dbe4d9a", "value": "1536:5wnuLBzzRAQuMJiEG4bs0WA/brqJW9jQ3mTiQu9u0sx:bvG4bs0WA/brqQ983muQuQ0sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831407, "uuid": "06576e19-602d-4fd8-a461-51ede0ad010a", "value": 57198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831407, "uuid": "fb56d4aa-979b-4e6e-a600-70afe26f049c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831407, "uuid": "b0d2749f-cf62-41b5-9a73-8029c7f4ecb0", "value": "7dfef0eada3a56a71b04a2ee11c1d608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c56326a-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "ed65b00d-9f21-4d7b-b24b-73fc9aa80fea", "comment": "Malware payload (Mirai)", "value": "1ec06055089732fea67930af74be2c95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "6e2263ba-1422-43aa-9f8f-5f6736b694d3", "comment": "Malware payload (Mirai)", "value": "35aced3ec7331040d8bda1c7833ddc3f3f233f56fa9950179a6382485601d158", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "5a01d441-d69e-4be6-942b-019d5b2e9e9a", "comment": "Malware payload (Mirai)", "value": "367da13e501e81fd72fe4718201f39f66944f9d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "60720100-2600-4d5d-a3bf-e8c333ece0c5", "comment": "Malware payload (Mirai)", "value": "33f6a16e9c060160fe3b6b50906df04555f3892ae98bd1aa41f0dfc5edea614a2601ae86559d36776e2e485fc183fabc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "0852dcb7-e2e1-4bfd-bbb4-e74e366a0835", "value": "T159B2E032D7288E8BCAA391FB168D0DED3F2B6781C75FC35091192F3A56453190ED3668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "9e805a41-ce71-46b0-9fdd-a35c43e8de07", "value": "384:MB5xGQrRp43lWzaxIemvHsbjvEaJ61IlyMUq6AHz0j+kQy+hqUKK6ZA3d6nmf1TG:a5xnC4axIDGb5AIlJrOj+kgIA3d6nDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877407, "uuid": "7460effe-b902-4673-8152-f54157eb7eb7", "value": 23712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877407, "uuid": "9898c571-f401-4a73-b759-349134b2bbc6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "1c2b042b-5830-4073-9313-a6732a466fbd", "value": "sora.x86-20211010-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd1a8a8-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899183, "uuid": "19fbce80-88dc-4b9b-878c-5faa08dd0ec2", "comment": "Malware payload", "value": "618a6c335fb4db1db6a603214cfe2946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899183, "uuid": "7dd6d481-f404-47a6-8b66-4a03aa701a22", "comment": "Malware payload", "value": "35b6d2317d7096fcb3a48dec2463e4ed6fe7df62a6d79e02f1e94130534cea53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899183, "uuid": "b812c126-4218-44c1-8375-f1a06cdd9deb", "comment": "Malware payload", "value": "327ae564eeed1bb07da76e58846f1721cd7b45fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899183, "uuid": "7c3d2e30-40d5-4544-bef0-73bf2bb3db06", "comment": "Malware payload", "value": "ac47b3624b5a55a4568f2cc8e614772a2dc1c25706155693cafad723adb50e2099886585f32309ba5df170aba13aef53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899183, "uuid": "de5a9e22-ede9-4b66-b3c4-abbd3ef49821", "value": "T14DB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899183, "uuid": "987a0fa9-99eb-4649-a4a7-4f6eac50ac6d", "value": "3072:MSY+46m1qOzsshFPPKNy+AmkZrQAhPDCXFke:06mgOzJhFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899183, "uuid": "3775506b-0b3e-4ec8-88a2-edb09e5857de", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899183, "uuid": "8b646936-c32c-405f-a2cc-2be8403ff080", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899183, "uuid": "f7e311b3-e6d3-4529-8338-8249763680a1", "value": "618a6c335fb4db1db6a603214cfe2946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016974c1-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877254, "uuid": "cdb8e5ed-7afd-469e-84a1-8ad28fd50a31", "comment": "Malware payload (Mirai)", "value": "410de641d36048d861383cf9ae482c21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877254, "uuid": "5238ed6c-e10d-4844-8ede-f1b301e8d787", "comment": "Malware payload (Mirai)", "value": "3638535166985ec904ebcddcfbf1fcbc61684ee006f75c13450fed5a8ecd90e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877254, "uuid": "0e80eac5-05d2-428f-bc4c-b75a8ef49f27", "comment": "Malware payload (Mirai)", "value": "536103c91dd6a964dcb2643d0ef7552a3db9c05d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877254, "uuid": "6f7d5da1-de12-4953-b145-b6cfcfda8f28", "comment": "Malware payload (Mirai)", "value": "53a74fbd920ad473c720604675d59d30ea3f73eec9ed9cabd3e675d785ca7d97a76da8b509e050e2d9e7a13ee9c23a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877254, "uuid": "9ac755ea-62d7-46cc-bd0f-047491569afc", "value": "T184837DABF9678E41C0410BF01ADBD3FC2F23A614AE4319F0BD5E46795C526EAAC067D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877254, "uuid": "e5192e2a-81d4-4b3b-b81a-fc0cd9b6533e", "value": "1536:q/fdmScapyr8oV5D37kR7ZgUztKsVg+/LWN:q9BNEQq5DUZdDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877254, "uuid": "ad466bfd-615d-4fac-ad01-d89c80177964", "value": 83056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877254, "uuid": "94e61f83-fc77-4c74-912d-e649fb97df4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877254, "uuid": "d252c28e-d47b-410d-8ece-e633c0146285", "value": "410de641d36048d861383cf9ae482c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0418c854-299e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851919, "uuid": "f07cec77-08fe-43ae-8a35-be2ab31df54e", "comment": "Malware payload (Gafgyt)", "value": "706878969fad8c2167d873c37915ad59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851919, "uuid": "d93df455-520a-4ea9-8021-ca90568d6865", "comment": "Malware payload (Gafgyt)", "value": "36f481301394cf57af643a354f252b629ab18e943a9b4c34e7ffe7cc08d4ad94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851919, "uuid": "049af047-46ca-4e1d-8fc6-484e7d2e5a8e", "comment": "Malware payload (Gafgyt)", "value": "25011b88cbafc2de4306e3b28bd0c93fdf9919a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851919, "uuid": "fd0ed14a-61dd-4c5a-b485-f8d6f5145768", "comment": "Malware payload (Gafgyt)", "value": "0ff95e9861aa162752dae6caa5db967c707177362d02dbc2644241fdb5f2bf58a6e61b3410061e2da12259497aca92e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851919, "uuid": "04a5f89f-edaf-4558-838a-8c72049a63ee", "value": "T1F6930893F800EFA3F40AE77605D347257630BBB24A531622B31779B6AE322D47826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851919, "uuid": "f18ac460-e5ab-4dc2-9d83-b39fc7cc5396", "value": "1536:UCYQK55m5E9r8h5NVGYBGQmkvxuENv9rmrBFiyoQgd3Hf6aTmQ9VqXjewfNLe:fs965CYoT4ArBFiyoQcbmQ9VqXywfNLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851919, "uuid": "a8bf6f6e-12ac-4431-9a72-063c5f286cb0", "value": 93575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851919, "uuid": "ad24fa6f-fda1-4c00-b916-4d9839eff8af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851919, "uuid": "2bac3138-a568-4560-8482-9d43a69ab076", "value": "706878969fad8c2167d873c37915ad59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b02485-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842768, "uuid": "b41a9e64-f2b1-4d6f-82f2-bad92ed47739", "comment": "Malware payload (Gafgyt)", "value": "e5cc9f995b556dc460201e810b988d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842768, "uuid": "f62132af-0ab2-43ff-8495-7131c7d46243", "comment": "Malware payload (Gafgyt)", "value": "3869797dca0149faf9ae4cdc618bb9d3bb30f92f9c00be2214ecb365ba754fe7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842768, "uuid": "0acdec13-0fb4-431e-9ec3-64cebf155de6", "comment": "Malware payload (Gafgyt)", "value": "e79f5b4bf348c0ec2a5aab42db0720d036710bad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842768, "uuid": "bf0fca08-5e2b-4036-8442-dfaa7bbe5f87", "comment": "Malware payload (Gafgyt)", "value": "e2de4aad24176ac19c5735d486ee7aa16762c79c449da33afc0c2190bde5bcaf101aae1d7c61194096c68120493b2d33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842768, "uuid": "ba8a4eeb-ed85-4c31-8870-0222a7575c8f", "value": "T156F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842768, "uuid": "7ac2ec26-ab10-45c4-a708-7b85efadc526", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RjqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISan9qnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842768, "uuid": "0240fe43-e444-4956-92b2-6d5fb2491c9e", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842768, "uuid": "b9a2e8e5-faf4-4a75-9269-de44ef99e4e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842768, "uuid": "24755599-6b93-42d8-824d-d00f69ff6a2d", "value": "e5cc9f995b556dc460201e810b988d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ffc98c-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853231, "uuid": "83e667c5-a21f-49fc-a355-e285a6ba0a63", "comment": "Malware payload (Gafgyt)", "value": "a429e8dfcef185f01acd7f8326b4384a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853231, "uuid": "9a68c944-238d-4b4a-85e5-0086076b1869", "comment": "Malware payload (Gafgyt)", "value": "38f469f5eec873ae3e75621d48517af91dc9dcd63259c707040bc9943fb38937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853231, "uuid": "b5e8ecb9-3d72-4fd0-bb7c-f4d718a9a955", "comment": "Malware payload (Gafgyt)", "value": "ab17f0f843290c4385a02d60d5ae2d115ddf3eb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853231, "uuid": "e1ee2866-3545-45b3-8e75-71381f347011", "comment": "Malware payload (Gafgyt)", "value": "84a9450d8782f528aca419dbad76615f5f16a463439272674d92b3d740e016760a7e2b3ec82fe4ab9aaa2b45f6ec28bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853231, "uuid": "3f5098d5-8c1c-427d-b9bb-17cd34fae436", "value": "T163A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853231, "uuid": "cd9d636f-4941-4562-ba00-df0aa1e934ce", "value": "3072:wW8FUmgujld6Mkxm6AJ+4flHmmFVcqq0GnDZT:wJFv4Lm6AJ+4flHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853231, "uuid": "8ce46266-990e-4ef7-b532-f62f34973c05", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853231, "uuid": "a8783647-4944-4c43-91c2-bce9d370d912", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853231, "uuid": "fa24976c-96ef-4771-bc8d-9b2e0e380d75", "value": "a429e8dfcef185f01acd7f8326b4384a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b70db26-29e7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883472, "uuid": "b23aba2e-9456-478a-a1eb-ef10d058f901", "comment": "Malware payload", "value": "551b8b4b835e8dacb411a133e64200da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883472, "uuid": "94d88250-9eef-461c-a572-7e39cfbd6f16", "comment": "Malware payload", "value": "3972ef467b70cfb6ac9a87f7107a6b74e577446a33b7910fcb7feb81a1f79eb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883472, "uuid": "a800fd66-1814-4d46-9d8e-56c91a114fc6", "comment": "Malware payload", "value": "35640552328c6d48ccd54b9d4018be053703b2bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883472, "uuid": "11f78890-4097-4ef0-a17d-66766f7f5256", "comment": "Malware payload", "value": "816f45566f0f19e6786c602072dcd1a01fcf11a5edf582906236ca97a6db32c14187f3f141586ee84b3b661aedc4bb20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883472, "uuid": "90dc1d27-bac4-44eb-91ea-0af5a3eb04ff", "value": "T16703E1A3A4888250E17D69787CBF77068472711A825676F4DFCC3A3ACA21F5D1E232D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883472, "uuid": "42a68774-ac62-4040-929b-082dff2f7c60", "value": "768:4wTv2Y53dcoK55TAaS9rmSM6tGoDvOfAFwXC2m+nbcuyD7UryqL8OAfnBY1KkQ6/:lTv263I5caS9rmit9DvOkwyX+nouy8mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883472, "uuid": "8b0e8e7d-2dbc-4a8c-bd7c-03f06f549e8f", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883472, "uuid": "5daf8126-fcae-4f5f-9c10-6a907749b302", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883472, "uuid": "37442fc6-6d6e-44fe-a86d-32c61e612187", "value": "551b8b4b835e8dacb411a133e64200da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822220f7-29f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633887778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633887778, "uuid": "8e6da755-c6c2-4a4b-92f1-1925904cb602", "comment": "Malware payload", "value": "4db7eb28029846ea78925a192dd837ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633887778, "uuid": "7591ff6c-4664-49dc-8b44-9b65e74818ab", "comment": "Malware payload", "value": "3b44d2ea5d9c58321bd71a37c657d2b9d9f559db6d2b768d0b265b2c1a22070c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633887778, "uuid": "6204dd09-ddd5-45d5-be70-ea10f5a5fcff", "comment": "Malware payload", "value": "0043699d452caf333cf2eb5e3cc1198ee4754b33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633887778, "uuid": "3635d243-d147-44ba-be86-9e99400f96b5", "comment": "Malware payload", "value": "72893016d36202f1dd250aab6d9f557f74c4db501414858f2acd808aa99d9f61d445b44c5480310cbc2bd73eae7b2909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633887778, "uuid": "28f586cd-fbee-4b2b-8485-f2e7f824a1ff", "value": "T1445633C3A7BD9032E6271FBC9835EC924B763D2BDC31565E1507206D13B89A0A13AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633887778, "uuid": "21f955ed-1ff4-4733-96a8-53ed94936650", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633887778, "uuid": "f101186e-874c-4d03-a4a8-3dbe198c0710", "value": "98304:gZv7yvip4uvN6rsx86wx40k7l9nrEk0OtIksy7KyncYAm1HW2ggnz+r+bWLxHi6l:g0usrXD4dR9Ak0OakzFAm1HdnyVYq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633887778, "uuid": "7a78f1dc-6400-49c5-aced-33c1431a4d12", "value": 6250343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633887778, "uuid": "ae3b39fd-9ec0-4bb6-8916-8d367c33a6f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633887778, "uuid": "5d4ead34-286e-474d-92a2-533ce0d11b01", "value": "4db7eb28029846ea78925a192dd837ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9975a4b-2a24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633909803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909803, "uuid": "270f617e-553b-45ba-af05-2cc3cc1790b7", "comment": "Malware payload", "value": "2e6cee58726d98846987a88bdcca721c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909803, "uuid": "e0b0948c-db5e-4460-88b7-bfbec6a88a5a", "comment": "Malware payload", "value": "3b7dface74f2325c100be501df2465210f5a830a2807c8884764625d3f19520b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909803, "uuid": "f8262601-adb8-4f5b-9a93-9fca8f1bcd46", "comment": "Malware payload", "value": "248405870bc92085ecd32f219cb8c70e648d7573", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909803, "uuid": "a54e9c5e-b255-4a6e-af40-6249fa7ef428", "comment": "Malware payload", "value": "31a0fb7b88723fc5847ca507f1ab3348d369d36961f2384065f295db7aea3e9b6f5e99360f43e82affda82a63b4546d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909803, "uuid": "ed9be40c-b4d6-4a4c-afb4-b6dc77cdeffc", "value": "T183D2D163E8FD47ADC0E810743F6DBA4A7584E21B5854A1F5EFC8223508D3A4A3F2539B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909803, "uuid": "03e62563-863b-4bb9-83b2-6b0dbfa1d53e", "value": "768:1QNQcGgJ7bkLP9MqL9W0snnOdX9ASf3SHk3CMU7nbcuyD7Uryqa:10Qc3bkLP9rpLsnnOdXyAEhBnouy8mqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633909803, "uuid": "0abc4178-682a-407f-acb5-4a8f08cd1721", "value": 30860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633909803, "uuid": "2ae27c8f-3a79-41d4-9863-6150b330f871", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909803, "uuid": "96d9eb92-17e4-4300-ad3c-87d981e27874", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fba7f2-29a3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633854262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633854262, "uuid": "2bb4db0c-ad94-4833-a9af-7396cb58cd37", "comment": "Malware payload (Mirai)", "value": "ef599ba31015c6cf5f012dec8d8e0a73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633854262, "uuid": "39571321-4c5a-49e8-a31a-847c3e93411a", "comment": "Malware payload (Mirai)", "value": "3bcad8b47d0dd3c8930e3045119f5eea310766a09ea6ef3b2ed2f7ff630c490f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633854262, "uuid": "aade23b4-a7de-495f-a86b-51d1207f8cac", "comment": "Malware payload (Mirai)", "value": "9edd37f8674b84ec902f5f42d2e21fb9a5270eda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633854262, "uuid": "162e96e9-b7a2-4359-8214-0c32b6f9be22", "comment": "Malware payload (Mirai)", "value": "1b0a2c74f5beb284e877f333fcc07237565a7deeab21e03169bbfa2ecb488658f0a39edbea23297b049cd304f29155a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633854262, "uuid": "4d41470d-d11d-45a6-be1a-4db1cb51a97e", "value": "T102431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633854262, "uuid": "9788ab16-2893-4837-a633-cd57104696a0", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDG:eL0AxvSHfymp0xgunvCkV6vTMDauF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633854262, "uuid": "f25a22bf-a8da-4927-879a-0b2ba952fb34", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633854262, "uuid": "ffdba60e-500c-4e38-9250-b49439fa85ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633854262, "uuid": "680b7acf-1fc3-4ade-b783-28b7287d28e2", "value": "ef599ba31015c6cf5f012dec8d8e0a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b504720-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633867017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867017, "uuid": "7adf202d-df9e-404a-8cb9-3aeebc770396", "comment": "Malware payload", "value": "f26069f74db245b7c75dd487280a55bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867017, "uuid": "5996fa06-7da0-4b86-a946-caae438b16c5", "comment": "Malware payload", "value": "3ce1542e6b9b3b4a115a75703fc5013643c5474b67263bb09e045e7fbf917627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867017, "uuid": "b74e8d47-01ca-490d-9459-cddb2f6a93e2", "comment": "Malware payload", "value": "e04e43146a9acb841aaa5baf01ca7b0727d08047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867017, "uuid": "daaf9fbf-366d-4239-9d35-eec310e9154d", "comment": "Malware payload", "value": "475a8cba64da5fdce4af9b2ab2e0dfe6c759ff8473a4c2f1c67c824eaea96ed24c32348751fa61f81aacd984a9282699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867017, "uuid": "da2b91c4-fb05-4fc2-96ac-91a3ad471ac6", "value": "T1F8D35B20ABA0C039F4B712F845BA53BDA92D3EB1573451CB42D665FA63386E8DD30397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867017, "uuid": "6ce5454e-7fa6-4229-829d-61958fe6027d", "value": "3072:enZQCsXyWY7thZLN6fx8BNiUF/h/3mcZRCwD748ZYl:enZQCqY7dZ6yBNiUF0c/CwYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867017, "uuid": "553ca6c5-7e59-4d5d-9c50-5859313839a4", "value": 140085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867017, "uuid": "c02359d7-343c-4107-af02-32e9a425d82c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867017, "uuid": "d56fd0eb-97e3-4126-9725-d8485346687e", "value": "f26069f74db245b7c75dd487280a55bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fcb5ad-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856376, "uuid": "9077d6d3-f1fc-4153-a75f-56c977bef6a9", "comment": "Malware payload (Gafgyt)", "value": "559d16570faa7a6bc53418e057297022", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856376, "uuid": "83573c1b-b6c6-44cc-b29a-7c92dc147765", "comment": "Malware payload (Gafgyt)", "value": "3d29c1aa3ceb795a43ae9f0f287b9326d04da51d9a2fbb0de02196392b9a8ce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856376, "uuid": "b55fe926-b3ef-4c8f-8304-18d6a551c6ba", "comment": "Malware payload (Gafgyt)", "value": "6906d3fe4f1a44272b0dc8448a1082da676ba00f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856376, "uuid": "69fbf675-7c42-404d-b2d5-24de0277b8ba", "comment": "Malware payload (Gafgyt)", "value": "2017bbf9d06a736c047236b0c146be7661845a7902203a959dd29c1b5a19d10ae0a517af42a247c9c4cab59544794bc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856376, "uuid": "08aaf1ff-554a-494c-b6cf-a93e19d4fe37", "value": "T1F5E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856376, "uuid": "96c382d2-c612-4bb8-9a22-a2bc00879e93", "value": "3072:K+MVwUm6Oq+loz85hd8EzhsURxuZq+1uPNd5R:K+MVwxq++z85hd85URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856376, "uuid": "bd2aa02e-f9c3-408a-be28-b88df0de08e6", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856376, "uuid": "e813b8e5-6499-44b0-83e8-b7b33d1b5c7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856376, "uuid": "fca4b486-d82b-4673-ba93-c31ee8e16fba", "value": "559d16570faa7a6bc53418e057297022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb3a7c2-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633867232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867232, "uuid": "93846129-a344-45b8-89cc-9976bbd3b8df", "comment": "Malware payload", "value": "9daed17aa9c473af95f00c0492d10170", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867232, "uuid": "2c2fe4ad-3d95-4add-b667-f055ee42d542", "comment": "Malware payload", "value": "3d897feec3ac48cb7ca219f6f6760aad3bcee73d5d15dd90c85d39ac5a991fa7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867232, "uuid": "b8daf9e2-6bb9-4cd4-884b-c0bd0bde8512", "comment": "Malware payload", "value": "658e04731f8324869b64d10f830add88483de9dd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867232, "uuid": "d6430d99-0f39-4876-aa83-d47c997d78ec", "comment": "Malware payload", "value": "21efd651083c0151d3a589f80318ef5b490f8bdf6cbea142d4d0e4c89f46f172383b8726f0e5e33a082f940226a15627", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867232, "uuid": "00cf90f1-2292-40c3-9b82-0021f764b556", "value": "T16FF43346EDCDC019958A3017ECA59134AAE5DFCF2D19DFD89CB861F12E183F0164A6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867232, "uuid": "54be9582-a968-4317-a482-28f693ea29a0", "value": "12288:6AAN/84TFJCPlWuirqOTJbx+r1m6MzpMUFy2tUmTr835MDT61S:6/84T2tWRrLJ1rdGUJtUmTrAuDT61S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867232, "uuid": "2ce5d176-d35c-4b98-ab10-ee0f6009600d", "value": 745559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867232, "uuid": "506481ac-2e2d-4acf-97ec-b3375d70c25d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867232, "uuid": "8f5a4c07-9eae-4575-b396-640571509201", "value": "QC10.10.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71430abe-29af-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633859403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859403, "uuid": "ad652617-c784-4f52-9acc-ac5fde7a2b8a", "comment": "Malware payload (Mirai)", "value": "c791a8bfd56ee3563b6e2eaaa6607d3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859403, "uuid": "5a32de92-fb57-4085-8d6d-62561eec9583", "comment": "Malware payload (Mirai)", "value": "3d947b49a8a6af149e832e7d3a4a9f57269ea664d92f0efa38f106ebc2e007dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859403, "uuid": "42990561-57f0-4c2c-8c21-ce6f0cdaf71c", "comment": "Malware payload (Mirai)", "value": "49d0521d93e5a26eac01cf87b7f77ae2cbbc4b21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859403, "uuid": "595b980e-ba88-4896-a5f3-9476eaefd70f", "comment": "Malware payload (Mirai)", "value": "0bb28a631458aa51a076a705c4db8e2e811ccd7b7d96056c57c25b2ff60de8f4ad3245259689ac1ebc21793717ed86ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859403, "uuid": "639bf4ff-4e6f-4283-a138-aa96b6ca200a", "value": "T191D34C46FA408A13C4D61776FAAF414A3322D795E3DB73028D285BF43F87A5E4E5390A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859403, "uuid": "1a52801c-a679-47ef-971e-b33d35f827b8", "value": "3072:Clw5q6T0UK1ZhEyL71+DrvHg6mL06BusHX+rM/9c2:ClX6IUKCy/1IvHg6m46VHXOM/9c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633859403, "uuid": "1bfd6b7f-e23e-49ed-8e29-7c180493fc76", "value": 140741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633859403, "uuid": "c2c46d0b-4b3f-40f0-b752-861aaf497ea8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859403, "uuid": "32fcb184-ee2f-4965-99e8-a9f63a505003", "value": "arm7-20211010-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99259e04-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884811, "uuid": "54a9865d-1dd4-4559-b8f0-c1cc6384672f", "comment": "Malware payload", "value": "1d6be06608b1cb7ef28a53dad73e9af3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884811, "uuid": "a5f29774-e442-49dc-9c94-e183552e097a", "comment": "Malware payload", "value": "3dda05c8f691dc2c4ffadd35e5c6fc074dc2f5b54bf941e9569407491acc339c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884811, "uuid": "3b9c66dd-6210-44a0-b2d4-ba173ad9c26d", "comment": "Malware payload", "value": "6ae099122736c3539d92b51eb34123a0d33208a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884811, "uuid": "286a982f-306d-42a3-916e-6357d568ebce", "comment": "Malware payload", "value": "524552e744f168626767063fe548108c6b64d43491cbb4f06c4074dc3e3cb85007d72e5362e169b281e4fe6ef73492a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884811, "uuid": "11f80961-d5d6-4592-8259-b7e440d68332", "value": "T1C753027081CA3590E3963A323DE1D402779653EA68EC3FF0019546AEE86B243D97E0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884811, "uuid": "9927af88-423d-41da-a12b-c1fe504343fa", "value": "1536:iVe1CFmVxpFjyUIkrirQOnAoOyy/hsaioVESiL3YOLcpCq:l1CFA1yUKbnAryUpvDOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884811, "uuid": "8374f31d-f152-414d-86d2-d48acd44277b", "value": 65704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884811, "uuid": "b3758c82-5adf-42aa-917a-ec91732e164f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884811, "uuid": "6fb92b2a-368d-4b12-8b04-1fe03e61d1c2", "value": "1d6be06608b1cb7ef28a53dad73e9af3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceac2da-29f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890749, "uuid": "953f0bf5-30cd-42fd-ae63-78c807349760", "comment": "Malware payload (Mirai)", "value": "232c7c36742374054685942d70e65f9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890749, "uuid": "c58cfa04-c6d3-40df-b78f-1afa51450b6f", "comment": "Malware payload (Mirai)", "value": "3ec6b0fbe669cc7d05b4c5596adbb06855990a4cafe32649a5c4f22e5e8d9fe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890749, "uuid": "022bfe06-2117-4ad7-bff4-78f77e34afb6", "comment": "Malware payload (Mirai)", "value": "13ebb80d78da88a3445e1cdf3fe074cbc5f2f259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890749, "uuid": "a5489686-f9b7-4af5-a5b4-2e7b22f80040", "comment": "Malware payload (Mirai)", "value": "fdb22f78d8340df36791e2819267fd90155f9fd769d81bbbc0cfcbd86ca0b2842fe68419eea94021bad4b8f6c5a58d1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890749, "uuid": "1f774122-f256-4a73-8d7d-72bf6da6500e", "value": "T14DE22B81325C0E17D2672E74293E1BD4C3FFEE9120E4F585655F9F8A8539E724086E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890749, "uuid": "8d0bccaf-87b5-4664-b12a-f75b0fd09489", "value": "768:bOHbvBm3oRiLA7RaPQ8YZNi4MUeRWbWQSnQiFx10H9:amoHG4MVQSnDFW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890749, "uuid": "07e53ed0-53b2-458b-9da2-ab7d84b07af2", "value": 33708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890749, "uuid": "7bb9452e-c737-40c2-9954-3339dc4c4b2d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890749, "uuid": "3222ffd2-a86c-41d7-8d7f-5ccdf54bacaa", "value": "232c7c36742374054685942d70e65f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253230b-29af-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633859405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859405, "uuid": "a6e23289-491e-43c6-a594-87f946e08261", "comment": "Malware payload (Mirai)", "value": "18459f27850e19839a15fd8261b10830", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859405, "uuid": "26b81d11-4ae8-4ff9-be0f-b4d200bcb2ea", "comment": "Malware payload (Mirai)", "value": "3efbdc91fa3143461d6ce4c5a0630d468a09b299b64cc48f0d6a74d0047fe530", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859405, "uuid": "5139171c-9d08-46ce-becb-1cf6509e73ab", "comment": "Malware payload (Mirai)", "value": "53e6abf890be2d54a73d938a0185e72f95a26650", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859405, "uuid": "92122dec-671c-48c8-880f-e9d4028217f0", "comment": "Malware payload (Mirai)", "value": "7244bb91e94cff28991dea6dde5fb06a08da50056d9bfad40664242953d987fab79eac1c508382f57bdac9883d01d9e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859405, "uuid": "9d46a1a7-6a92-4066-af3d-24cc58f0f8ff", "value": "T1AA630781BC41E626C7C15377FE5F558E3711A7C9E2EA32039C241FA07A9B81B0D67E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859405, "uuid": "b0aada07-d97d-434b-ab34-a768980e8595", "value": "768:4sZG/hfSn5ukztzPqoaEOVddLErAZE/y3EoEXyf7wCVy/Jx+5H8hG1rmCd/574yO:tG/xS5xhzSSrAUTzyLeZS1u8BErIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633859405, "uuid": "c75dc270-4a2a-4df9-ba6e-ae2ad1b6d26e", "value": 68420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633859405, "uuid": "6fea536d-33f9-4b2a-9aeb-0f310813b26a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859405, "uuid": "8df3dca3-ae50-44bd-839e-9680b30aafd5", "value": "arm-20211010-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047f3af3-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884561, "uuid": "eb65eca2-c828-47c4-9f7a-a49a0f5d77c7", "comment": "Malware payload", "value": "11b3357422b60c404c872e539df8ac25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884561, "uuid": "961e3175-c664-4ff4-865c-2efd7ea83363", "comment": "Malware payload", "value": "3f4275eae828f26e5a4fa69abfefc7a9ef21d55e1d13cba2cbaddb515b2db8ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884561, "uuid": "c696e55d-a52e-4f08-823e-dac346a3e03e", "comment": "Malware payload", "value": "d986ae2910f4fc353afcb550a1fcbbf250698450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884561, "uuid": "b361ed76-a09c-442d-b69a-3ffe270e2bf0", "comment": "Malware payload", "value": "437c4c6f9fa9be9d812049ae163ef5f5995f3d7ec775d36ee83b13ba1680e9c8cb52b7780d20ee90942fb05d823a64c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884561, "uuid": "8a180975-63d4-4e8f-a130-aef1cf03c26d", "value": "T1F45302C1F356C19DC6FD46F21ABF3D8B0380B52D583588B21BD921378A85FDA5B04A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884561, "uuid": "3c1533e6-eca4-4564-8334-8ba6aa8f5a32", "value": "1536:5pY1RM4gKsI6vKb5ZXnsJYM3xfyu62GxCija6xfnouy8EqXxAp:5pY1R1/SKVZqY0xfyd2GrjZxPoutdmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884561, "uuid": "90e12069-65ff-4da8-acb2-fadcbc08e315", "value": 62776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884561, "uuid": "99780db1-550d-4b91-a98d-7a1e18592ad4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884561, "uuid": "f1348383-f0e3-4a28-b188-e3ccb7db6221", "value": "11b3357422b60c404c872e539df8ac25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e63c96-2a13-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902225, "uuid": "01bd057f-a165-474d-ade8-7e7f9ae98d28", "comment": "Malware payload (Mirai)", "value": "08faff84e33b60c6fb242b0f5d296380", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902225, "uuid": "c8d96815-eb0d-488a-849f-c8076a062754", "comment": "Malware payload (Mirai)", "value": "3fece72636054f681e7fee768d3841e098a022e68cf5c79e96939c09f9ef74cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902225, "uuid": "a7dae8fa-46f8-47b3-b681-d229ccb8d226", "comment": "Malware payload (Mirai)", "value": "503253056382c5c4531bc617592a8fb1f9868799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902225, "uuid": "614db15b-fe79-497f-bced-afe506b21c17", "comment": "Malware payload (Mirai)", "value": "00f5b1fa60b3952c8df4df47e0e4e2369e0b37e073731110d645a289fdcc6fb32e77ca79bac655a01b8c68995f9fb736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902225, "uuid": "76ffef3e-8df1-4874-8d77-1fa7abd51424", "value": "T17ED2E0B5AFBB460FF48A233C5E9EDCD925AC78651BB9464A06401B623138AD1E7DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902225, "uuid": "0db00a38-6881-49c4-867a-88b5755b2f9f", "value": "768:xN8fWlfoQmQAXV7E/QciiRcLprDKFJazql:jMNXFl76N4PcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902225, "uuid": "d7a7b4a9-a70a-4c6d-95c5-4a5d4e568f6d", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902225, "uuid": "d31f86ba-6489-4686-909b-6d112b102f78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902225, "uuid": "ad95a6ad-3edd-4f52-8301-2480f0b3e12b", "value": "08faff84e33b60c6fb242b0f5d296380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14238353-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851087, "uuid": "8d96f601-754a-4c06-aff5-af1855332019", "comment": "Malware payload (Gafgyt)", "value": "ae910234f995c445e0b4ea2fb0c0e84a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851087, "uuid": "849e564d-24d4-4b25-a970-6921b66085e6", "comment": "Malware payload (Gafgyt)", "value": "419496392244c74edc22e8208c76dc1fd1abab56d0357beccb0c51ced22f6bfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851087, "uuid": "a07ee31e-500c-4a04-835c-30bbd9881710", "comment": "Malware payload (Gafgyt)", "value": "7e90a98b9e1de4ba03ee0799d2dcc63fb1249ec6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851087, "uuid": "3176fe19-d04f-49d1-b710-177af5c4decf", "comment": "Malware payload (Gafgyt)", "value": "55cdf2c6ea69c0b3ae429afc370466c3efe9e799d1fdb84bfafb73e738caf931964171d2eb82bdeb7f5dc42fbf2f6dcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851087, "uuid": "53a44a25-8dfd-4fc9-8cee-e8ccbc9ccb0e", "value": "T147931943771C0F43C0DB6AF11EA727F0876AB9A116A36185690FAFC44773AB82513FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851087, "uuid": "6ae0a31f-edff-4b9f-9fd9-605bd622d727", "value": "1536:WQAm68/OMby8+HbJFcor340NRcnazJ9kc8kfREmQ9VqXjtWfNXe:Wnm8Fncor3xjN8kZEmQ9VqXBWfNXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851087, "uuid": "97696998-7d18-45fb-a08f-42ae7e1e0e86", "value": 89356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851087, "uuid": "d909caca-6e5a-416b-993e-ee8496b047f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851087, "uuid": "e21f886f-3822-434a-ba20-d331f5bba40e", "value": "ae910234f995c445e0b4ea2fb0c0e84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024f325b-29b7-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1633862653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862653, "uuid": "f20f01ab-65c7-4931-80dd-3ada8439f730", "comment": "Malware payload (QuasarRAT)", "value": "962acf3296bd570beb350ab8ff8362cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862653, "uuid": "34be4ce3-9486-445a-85c2-4037319bc4ed", "comment": "Malware payload (QuasarRAT)", "value": "43ad7167028e0cbf89f29f9f7fcd8122090d02a0fcff5e8c5243c5abf71cf905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862653, "uuid": "ce97eece-88ce-4976-b770-fd14323dafa6", "comment": "Malware payload (QuasarRAT)", "value": "662c745971372917b6270d239af626a94fc428dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862653, "uuid": "b21ead8c-a8e8-4fff-82b1-038a27193ad0", "comment": "Malware payload (QuasarRAT)", "value": "fe399981e755180866f9c4ea59e1c7a2083ed1f6d8ffad55b311fa5751a51f166a175ee62aecf844b9c56dc37110dc9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862653, "uuid": "617c8e6c-4653-46bf-be68-dc7f159bef66", "value": "T135759ED1E284D98DC41B02B7CC36D9716417AEAA8974861F246E7D2B76F7383206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862653, "uuid": "47c21df0-23fa-4c5a-97d7-ee9bba5b24f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862653, "uuid": "f0754c92-ae81-40c9-82f4-3e927fa54033", "value": "24576:M9PTI1yI3dstra2VBcc4espQJbxnY+cZ2VYvxkcI9IplxrRLEfL2:SP2y5aMcNL3+aAY5k50lxrRLE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862653, "uuid": "d30b7146-846a-48b9-86c1-d87c2190a6c4", "value": 1630720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862653, "uuid": "2d173624-2e23-4a9a-b1fc-43961d29d9ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862653, "uuid": "0fd9a3ab-768b-4424-a88a-4bbd0f3fc5b7", "value": "Payment.swifT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aed6148-299c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633851125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851125, "uuid": "05319135-2f84-4888-a2ce-ce666a13215f", "comment": "Malware payload", "value": "720f00a7b0c9a4d0e3339499e32eb537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851125, "uuid": "e8b3f86a-e485-4aca-ad72-61af987c1cce", "comment": "Malware payload", "value": "4586433aa86133845dbf5182f3436e5908993b7affb715f8c25e50f4aef511e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851125, "uuid": "504e2865-2d3f-44cd-a669-02a24f8a644f", "comment": "Malware payload", "value": "808f10589d3f1c69f4bb8fa262a6780a255ef417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851125, "uuid": "c77baccc-addd-41b0-bb3e-6cd97d6f23be", "comment": "Malware payload", "value": "1863484e79fa19fbce3d78cc0289c305d5a03b55d7add268d30bf725036d32010735d851e8e67b3e9898679929f20b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851125, "uuid": "5519d395-937e-4b8e-aca8-7d53ff26e863", "value": "T12E64E01036F18436F26F5A348E718BA14B3B7C656DB1C58F2BB526FE9E35291CA20347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851125, "uuid": "db34e908-23bf-4cb8-a100-30370d0252ee", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851125, "uuid": "f9be9461-050e-43a3-8ace-cec03438b44e", "value": "6144:IIUQFwFFglbbdDFnQk5LoFfGl6G9hCaY7B/:MawolbbxFQAh70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851125, "uuid": "f149c7a8-7f5b-4953-8b21-c38ad91029b2", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851125, "uuid": "d7949f4c-00f0-4055-99e2-7402c6009df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851125, "uuid": "72f015ad-e47f-48b4-b702-282c85ebe0a0", "value": "720f00a7b0c9a4d0e3339499e32eb537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1750ba99-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633866983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866983, "uuid": "e0c68e85-269a-4a21-b661-0baf5ee727fc", "comment": "Malware payload", "value": "8ab931942d6b5665a1917bc14bfd2071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866983, "uuid": "206b6f97-3b80-4794-9845-ec8c4ba64ada", "comment": "Malware payload", "value": "46b55066562fda498a993a7d35206815aab265353c87a6ee4acbe75ae937cd71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866983, "uuid": "e812d4ca-24da-406c-8844-fa1f224e248a", "comment": "Malware payload", "value": "607669c6ebc8add1de86d8d5c9c8029eb0d8caa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866983, "uuid": "6967566b-d39c-4508-91ac-71031683e386", "comment": "Malware payload", "value": "0e03aceb22a64d0427ae22b8cb2b28920eacc527332452068474ef577860e1738e50e06ba8eefe61f41beeb2aec14a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866983, "uuid": "06905e54-ee96-4df5-a4ff-c248ff31b021", "value": "T1E55533259BA9C1AEC206C0F0B45563E127736EDAF7044E4D62F77D8F03706488BEA6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866983, "uuid": "2133cf9b-0503-43f8-9d7c-d3477cb6e03e", "value": "24576:+54MYuLvSmyRq0PSueafsHtymTNbnJ0xzO0sJ8Mhj/npxnpqC6hq43Hm4D8:+54MYkeq0quzOPTL0xTlMhjLpqvhl3mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866983, "uuid": "26474e97-d8d4-4394-ac0f-18aa15d604fb", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866983, "uuid": "efea6709-1dd5-4def-98be-42af96d4966f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866983, "uuid": "041fbc98-0550-4eaf-92bc-375801a5fdde", "value": "8ab931942d6b5665a1917bc14bfd2071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cc0eca-29af-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633859404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859404, "uuid": "8c27feb7-db5e-434b-9a3c-f83cdc845a05", "comment": "Malware payload (Mirai)", "value": "8cca41db8c6487f57a4fc94b91a82664", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859404, "uuid": "01b9b2bf-c8a4-4bee-9b4d-19c787a69ef0", "comment": "Malware payload (Mirai)", "value": "47ae571bb60077b1c6c3ccb5c89b04e9d45203c6a12c5bb08c235ee4b509829c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859404, "uuid": "1f6346e9-463c-4aa1-9192-7250d19c6392", "comment": "Malware payload (Mirai)", "value": "b3a65eecf44817405b126127a183b1ebbd0d2636", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633859404, "uuid": "7bde3500-6263-4315-ac88-a9a6da88a00f", "comment": "Malware payload (Mirai)", "value": "e6c6eff03b13424f3464318092a1f349f104c4bd16e948e19fec66c57eb036d87d0f41f41e1100e708100f676a84b933", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859404, "uuid": "56f9c7da-5be1-41f5-93b3-1267d61aa668", "value": "T19A534BC4A183E9F6EC001A39317EAB719E77F53F7078EDA7D7D56523A901A02E20625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859404, "uuid": "da9c6f09-bbe8-4d27-95d3-bc88e3b7415f", "value": "1536:jHNexcFOGqktvNCi2qIjs+unCvOHI32jiVLmNibnC:jHkxQPt5Ui2qIjsEvka2jiYoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633859404, "uuid": "95fe8b99-17c7-4e1f-8d75-8611b6813c7b", "value": 62044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633859404, "uuid": "7cbc209c-9bfc-482a-901a-63f36045e578", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633859404, "uuid": "16b2eada-3fe8-4532-a310-62a301fa5f5f", "value": "x86-20211010-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfac0b0-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851640, "uuid": "5f0c3ac6-3faa-49ff-9b28-27e09ef9943a", "comment": "Malware payload (Gafgyt)", "value": "589b4670d7b970bf715708c47fe11a5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851640, "uuid": "397f1746-3476-4148-9c38-3d4d2c2d9491", "comment": "Malware payload (Gafgyt)", "value": "47b76b0d52d2c6f61b64bb112527cc72b06d52d4662a166711c91f8d92356f24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851640, "uuid": "b634be27-a357-4fc5-ac09-99bbdd722f48", "comment": "Malware payload (Gafgyt)", "value": "56dd4cb9d72ec41a8c080243d511b1c23496fd38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851640, "uuid": "29c77c2a-91ef-4881-a258-2d78d94abfe8", "comment": "Malware payload (Gafgyt)", "value": "fcaa49bad56b1787df16e12c0ac40892e6cba2b887f7395477847a35282c97ca1f2a865e09779f89a545fbd14042297e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851640, "uuid": "466a8bb0-7b36-41e7-bbec-6025f1b17cca", "value": "T144A31A45F9418727C2D327BAF78F435D3736267857DB33116A24BEB42BC27992E2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851640, "uuid": "9b27821a-b807-4f69-9dd6-34fbe66c3643", "value": "3072:jzB5e1Ff7sydmlPPxshLmCVrQAFiOXpYe:K1FffdmlPOmCVrQAFiOXpYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851640, "uuid": "b2ee4e3c-9d84-4671-bdd0-4a9a0c62e37e", "value": 102162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851640, "uuid": "89736855-b2a8-4fa0-9e4f-622e22da4ea8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851640, "uuid": "6c688996-446c-41a0-a796-fef552914984", "value": "589b4670d7b970bf715708c47fe11a5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13a3b04-2989-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843163, "uuid": "ead830a4-8eb7-4b85-8926-4b12441af444", "comment": "Malware payload", "value": "1d67eb06099887810d679e8026943808", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843163, "uuid": "9f802c87-dd85-4c49-bf69-44b5a436618e", "comment": "Malware payload", "value": "49480047239993b507465de034847350fb09a859668b65b5ab4d8d1af7a5af96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843163, "uuid": "d32b6641-2cc0-4049-b1ee-87319fb6a961", "comment": "Malware payload", "value": "6dae251f2ad2ed27a0878d7051a28d0bcab29ebd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843163, "uuid": "c46de4d5-cb0c-42ee-89d3-10ad08686c42", "comment": "Malware payload", "value": "1e26766ef41645f2c42c6b74fc2d31e4744bb1f46d5bf53633b7cf90ff85e79c87d1ffa8324c7c512cd7c825972988e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843163, "uuid": "e5ef49e3-b4fe-4f7e-8516-933242c61a0f", "value": "T175733B03771D0B93C59BAEF02DF727F187AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843163, "uuid": "ace36a73-90fd-4411-9cd0-4170858fb9c2", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaW9ZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2QwZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843163, "uuid": "b96e9008-2467-4442-832c-39797abedd7a", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843163, "uuid": "c4937d3e-0f6e-4624-b686-356ec43e4a67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843163, "uuid": "f3387b47-675a-4148-9509-5d81ca127cac", "value": "1d67eb06099887810d679e8026943808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5400c98b-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633866656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866656, "uuid": "07b8976c-42fc-4c8c-9734-9966c41182f7", "comment": "Malware payload (DanaBot)", "value": "c9aa90525dae9738fdd2e72d15fa7533", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866656, "uuid": "d3e6ba17-0d79-4c88-abff-bdcfa4da56b0", "comment": "Malware payload (DanaBot)", "value": "4a22c0f9ba13ab18950c865a0d164a9840359712c76501e5f64f54e740441a79", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866656, "uuid": "e26c29cb-e409-4bcd-9117-dbd2accf36d0", "comment": "Malware payload (DanaBot)", "value": "0341e47456e2b1f6e59f6e82de18a23d810d6eb1", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866656, "uuid": "4a76842d-b94a-4fd5-a17a-0df9bca4c4d7", "comment": "Malware payload (DanaBot)", "value": "66a8ba45f43b7e0580902a8045be995a745cf6d7b117f5c67a67c8924f544ddc5c8d250666a7be3834fc2a0359ce485b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866656, "uuid": "5cd018eb-c914-41be-b5fa-3d43f75d8ff2", "value": "T1F345120062A1C035F2F716B8867693A96D293EE1EB6444CF62D52BEE4635BE0FD30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866656, "uuid": "748175e6-3bca-4743-b348-08572211ef7c", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866656, "uuid": "9ace87eb-66bf-444c-b284-bb340e3cde89", "value": "24576:8OyyUMxRHOsOWrGiahHi1FQoCdES1othxjl7Y0Art1v4:8OMMxtOs3SHhi3R8ESixjl7Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866656, "uuid": "3838a0b3-a46c-4078-bb6a-186c103d9a6b", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866656, "uuid": "391ccea8-96ba-4385-ab29-45559812547c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866656, "uuid": "33e91be4-fafa-4fbc-b30e-79bb47909db0", "value": "c9aa90525dae9738fdd2e72d15fa7533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263cd778-29e6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633882900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882900, "uuid": "25b29803-0730-45b8-a5d1-921c40cd4c91", "comment": "Malware payload (RedLineStealer)", "value": "ee1d6b6105c96cdf72051ac81669170b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882900, "uuid": "feee6502-54c6-47f0-9af3-9e6d03e1c1cb", "comment": "Malware payload (RedLineStealer)", "value": "4ac4e8328d428626cc0c25364a669c704d316000ad3da748c0a666a815838eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882900, "uuid": "d811c713-0a93-4192-bb94-ffdd5040adb3", "comment": "Malware payload (RedLineStealer)", "value": "fe5e49ee5e6d21e46e534342f251701a53d0b429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882900, "uuid": "531005b5-7fc3-4729-bedd-ef27b4e3ed0b", "comment": "Malware payload (RedLineStealer)", "value": "56ab0b84a51ef37596589c5bb0c30db7262474dcebf74d3068ee4ae0c5f72235633edda82b4f324f0a6b7b33b7c8143a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882900, "uuid": "eb91b4eb-4223-4d85-a4c2-af8d6fcf025d", "value": "T1E394BE10A7A0C035F1F316F859BA9268B93E79A16B2494CF53D41AEE4B34AE5FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882900, "uuid": "82785f3e-5326-49e9-9ec1-4e05de35e3e7", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882900, "uuid": "0ac01d11-9a4b-4ebf-83bd-39c0e9d528c0", "value": "12288:VRGIH3fOwqN5FD/82Ee/ZbAebBznWNFtaXui:LGIH3s5Z/HEeNAkz8Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633882900, "uuid": "374f3db1-3953-4c08-a17e-9b5ea0c303b6", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633882900, "uuid": "5cb48ac8-038f-44fd-a0f8-cee92de1ebaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882900, "uuid": "f5bd2a11-f647-4210-8c6d-d5d40f568759", "value": "ee1d6b6105c96cdf72051ac81669170b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0e5ada-29dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633878641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878641, "uuid": "789e1264-0354-430c-bb7c-31742873b3ab", "comment": "Malware payload (Mirai)", "value": "b9717f8e9a089717458e3f9d471fd264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878641, "uuid": "ad349575-99ff-45e6-9479-30fb0aa59ffa", "comment": "Malware payload (Mirai)", "value": "4ad80e8eca759e05f549fdc48ef28b1237febadbff591b3528415a3461625c18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878641, "uuid": "b74b64ba-03c4-4c85-a4da-18885fb12110", "comment": "Malware payload (Mirai)", "value": "07ccbfe1b73cf0723db3a05d395abadc0febacad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878641, "uuid": "a3416f4a-1852-4245-a0ce-fac97fa88d71", "comment": "Malware payload (Mirai)", "value": "a5187f59d203c1484cc92cdd8171c711d9f8c4d950337d9715d34066e4575c9b3f0f3e59e9f05d4d1f435bb71ac51813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878641, "uuid": "8f8c1c87-1563-4f9b-a459-4b1ede817cc7", "value": "T158832924A9383F22C0E4A47E52F78316F5E6260E14B4D65D7DB60F8FFB10680A9173B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878641, "uuid": "898fdbf0-6d99-482c-a74f-fa1b6076bd32", "value": "1536:fFq1axGvRJ7dcJYNAaDO2dE9CDtcndJliuVMTAvTUiyH5oMlimFRY:NgdcNzCDtcViuVMcvTDyZomlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633878641, "uuid": "b2637784-a104-4cc9-b105-b536883d06e6", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633878641, "uuid": "7275f651-cdec-4c32-9f6e-1b5bd8839f2d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878641, "uuid": "b43abacf-b91b-430a-ae74-0239e7b7c68f", "value": "b9717f8e9a089717458e3f9d471fd264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cafd6b3-299b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633850779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850779, "uuid": "5cbdc9ae-60db-4bf3-b5cf-cbf2b6562d72", "comment": "Malware payload (Mirai)", "value": "81501a4fa263e2a28d0f5056b2c9c8aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850779, "uuid": "473e9193-0d6f-44f6-acb5-9b2248ea23d0", "comment": "Malware payload (Mirai)", "value": "4c975205f0f19ac77e0f091f20e0d3b5432208ffca27ba76e023a42ae9abe8ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850779, "uuid": "0843401b-02f6-4514-9ad9-7f479634bb5e", "comment": "Malware payload (Mirai)", "value": "dc077c52feaa86613ed225a681387068bb6c7e0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850779, "uuid": "1e28d4f1-a1ee-4a14-899c-0594336e80dc", "comment": "Malware payload (Mirai)", "value": "d364d0c00a6805b5dd3df8cc601e241045176c227d4e9bcda8a02f3b5eb24c5bc93c53e475dd9f76b7cc94a4a5527e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850779, "uuid": "7d03c3af-95dc-4862-aa37-c8686c2089f5", "value": "T111C2E1DFB4963985CC0C5CBC258D5AD116A9A2C7230BCF0837203DCDA9B645EF99C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850779, "uuid": "4aa0a517-8da6-431d-8805-3da0a1cbe670", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB7WR:5CrJgHiOJrfwmQrctI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633850779, "uuid": "245ed700-a6fd-46a2-b0cc-b034602dfc38", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633850779, "uuid": "5b810f47-e80b-44d3-84f8-8496e7bce2c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850779, "uuid": "aa68dba9-03ac-4b40-aec1-221ae924a85c", "value": "81501a4fa263e2a28d0f5056b2c9c8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a31a05-2a0e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633900030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900030, "uuid": "14c76214-3105-4967-8ebc-d42469ad7922", "comment": "Malware payload (Mirai)", "value": "2205fa1191844aa13dabf9d1a2922899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900030, "uuid": "2056f1eb-e226-42b8-bfb1-efa0388b7f47", "comment": "Malware payload (Mirai)", "value": "4dc7d5a4f38815476b19d028a995998cfd9c81089d2d7871615943bf01d07ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900030, "uuid": "cc1f4e4a-d75d-4803-b44b-eb0a570751a4", "comment": "Malware payload (Mirai)", "value": "a91a060f32215f1447dc0f852dffd9ea89083f6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900030, "uuid": "64ee46c4-86e4-4545-8b8c-1c6f53225e04", "comment": "Malware payload (Mirai)", "value": "9b9c42d289be6b3896813bf63b17abfa8b61ac55f00e92b699021da5d31b561f5657612ded644f885a082085d4000bcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900030, "uuid": "e84c75f3-de18-4b83-938b-d605be727e1e", "value": "T1DD231896B801DD3CF95BE6BE8423090DFA60735141930B3763B7FD93AD721A86E26D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900030, "uuid": "3be9f80f-5a5b-44ae-abfb-a3263627a2dd", "value": "768:/i+eRsWpPJMehVZT9seLgXMF11YDeDYXFDzY5u38Wh5xCTqqntzlS6u5Nuk:/jSuw1an3Y438WhOTqqNlS6uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633900030, "uuid": "ddf71958-f0d5-4656-9139-9862aa1974e8", "value": 48044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633900030, "uuid": "fb0859af-7e28-4a6b-b748-8985957f3c18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900030, "uuid": "1da66ef1-16a1-484a-bced-32fca22b0dec", "value": "2205fa1191844aa13dabf9d1a2922899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771cb964-29f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890766, "uuid": "b30fa3cc-6abd-4225-a4ed-d606f37f5e11", "comment": "Malware payload (Mirai)", "value": "f5f6d76abda72fb2d4db06c06c9baa8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890766, "uuid": "df8c2f25-8797-448e-b9bc-f66e6d5f3326", "comment": "Malware payload (Mirai)", "value": "4def6527d9ec955142b50ce630a3e8817decb1a86efdd6035572566a4bb2b0f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890766, "uuid": "b860f911-a05f-4042-b535-6690034fe8e1", "comment": "Malware payload (Mirai)", "value": "cfde2ede0a7896b2dea7e8ab260c8f7ab3c28562", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890766, "uuid": "91577742-bdc7-4b66-8593-b2ce8bca1c03", "comment": "Malware payload (Mirai)", "value": "eb8516e4fab6da9baa379de482b2831b8aa4529c8f2d08f449e12667ea222cd6e5cfecab24a923cd13f5c01158552bc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890766, "uuid": "39b6626b-b62b-4b1e-a88f-cf6eed618d2b", "value": "T15FC2E692A8C1991AC6E4577AB96F059E3321B7D8C2CF7717CF101F007A8661F1DA3B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890766, "uuid": "427a578b-f212-4fa3-ac5d-c1ddf29c45da", "value": "768:eAeiwNvtwHhlHCHEfMlFBFqnpn+qaH+nPNF10H:ZcNilHvfM9Fq0qK+n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890766, "uuid": "ad8834a0-5a3b-4e15-ae34-76821865307f", "value": 26944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890766, "uuid": "0337e14b-27ad-40c9-810b-01ae37e7e9b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890766, "uuid": "a1552863-430f-46c7-b316-433fdb7f9790", "value": "f5f6d76abda72fb2d4db06c06c9baa8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfd1a7a-29c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870696, "uuid": "a874573b-982a-493a-8e14-53598d8a63ec", "comment": "Malware payload (Mirai)", "value": "8cca05dfe262e9466767ae500b375049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870696, "uuid": "2e4f39a4-c450-444d-9763-58765882f3b1", "comment": "Malware payload (Mirai)", "value": "4dfc0b94f7eefb3b25fda6e7373197deb80534238ac1df081a4cc6a4e9dbaf57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870696, "uuid": "6e4222f0-ecd7-4a4e-9dd9-ff64e7501b60", "comment": "Malware payload (Mirai)", "value": "9fcfeffa087f9be3c5e0c8dfe8f061966fa5ec1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870696, "uuid": "befa29f2-1371-4fdb-885f-f4b8939fa7c1", "comment": "Malware payload (Mirai)", "value": "71f8d31283cbe8a7418f735aeb6739702cc79c40e0a65e3a1f1e717dad135e7481e8f6d6bbc2e700ba0c9e6f9c213bdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870696, "uuid": "cab2ec1c-27c6-4b82-9241-49b7911b5a38", "value": "T1D0338E61C96CAD44D25C43B1B9288E785323DA09EAA62FF54A8BC3519407FDCF12E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870696, "uuid": "949b6d06-62ca-4c61-8c36-fd970f20dad5", "value": "768:cu/Zo4AqUq6CYXAA9ia8CKBqAa5zCESENCodRDoVMOTRniCs+Q1:h/ntUJCYB9ia876EDEYKOVHniCs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870696, "uuid": "858f586e-b24b-4e53-86e2-2febf309fa57", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870696, "uuid": "480a05b0-4ab2-49dc-a017-f6d6c3b231f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870696, "uuid": "660b31ff-43b1-456c-a659-7825d82bab19", "value": "8cca05dfe262e9466767ae500b375049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703c0aa0-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633866703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866703, "uuid": "a90c6a9f-b8d7-4ff5-af86-4a0fb6c33f82", "comment": "Malware payload (Smoke Loader)", "value": "c97960b6aa572113ace629fd47aa1b04", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866703, "uuid": "795b1f3e-4800-4b78-b5a1-22fc1cbcaa98", "comment": "Malware payload (Smoke Loader)", "value": "4e12dfdb1d6a4dfe304cb8930c2e794572f295d6b8bdff28776a643976ac8ddc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866703, "uuid": "53647555-f6b3-4dfa-b24a-7fa13238f456", "comment": "Malware payload (Smoke Loader)", "value": "875316c3287012ef5335c4c0bc18dfd912c99ef0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866703, "uuid": "a3562d83-fc86-48c1-884d-ec61a79fb604", "comment": "Malware payload (Smoke Loader)", "value": "e73e8f99cdbd68c884fec4f59511b7c70fa69b795a5de6d7f611d447cc28cdc7b9ac69add6b4f489233358255f015178", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866703, "uuid": "bd82a319-1367-45da-9c7b-75fdafc7432e", "value": "T178647D1067A0C035F5F716F849BA92ACA93E7EA16B2490CFD2C516EE97356D1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866703, "uuid": "572c693c-1c52-44b3-9cfd-a184a08a6351", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866703, "uuid": "2c4be4cb-2b34-49fd-b3d7-16c307bbd8e0", "value": "6144:KYpOjkGELkE+YjctygOHvYsM9ZvX6+nk0klgT2:xOp0kOj+4HvYscZbnk0k02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866703, "uuid": "0dda9239-fe95-496e-a0e9-da3185e4c309", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866703, "uuid": "6f33c2b8-3a29-4ea0-a73e-2e82659969f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866703, "uuid": "57123890-18e4-4e31-b3a7-3714bfd7f7b2", "value": "c97960b6aa572113ace629fd47aa1b04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6268c147-2974-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633834038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834038, "uuid": "1d51dcc1-290d-4a6f-a805-cb2039a7ed1c", "comment": "Malware payload (Formbook)", "value": "de4419c0142a84761ed9abddcbc8bd76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834038, "uuid": "a32d299e-8ea4-4d40-8c55-a150535e3c40", "comment": "Malware payload (Formbook)", "value": "4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834038, "uuid": "be8a65e7-eed2-4318-8412-6d996a6f3dd7", "comment": "Malware payload (Formbook)", "value": "8d8d8261358f19dd12e6988a5a543ba0b62e204f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834038, "uuid": "b0723036-5139-4f4e-887f-9a0a8b65c050", "comment": "Malware payload (Formbook)", "value": "b883d71aa2fd488690cce039267e887b611c4d3f3797bd353231b140e4246505754c1ec5a9891fc61ab78703da4a7e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834038, "uuid": "af1aeaf3-516f-402b-a2d0-e777a20c8da3", "value": "T1DD74120C6C5713ECD2282CB2B8AD7A6B3EC9616D4AB5D14F64120BD41DD43A00BFAD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834038, "uuid": "447b5575-afc7-4350-af75-8d5ed0f7ff3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834038, "uuid": "b8576d35-76c7-420b-96e5-d26a4856b8f2", "value": "6144:/4/m0gEcqdGdOC3GZt2tQJfru5VckxBWL0VbhHhTPboNK5StFfQxbSYw:/dGcqdmOXZt2tQQ5fB9hsHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633834038, "uuid": "2824b035-6a13-4d3e-8a94-fdfc50daf32a", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633834038, "uuid": "2de444e2-dc16-48be-b9ca-51919e73120b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834038, "uuid": "7ee01c38-3402-41fa-86cd-4173bf8c9373", "value": "de4419c0142a84761ed9abddcbc8bd76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e247924-2996-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633848607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848607, "uuid": "7be2b192-ef51-4a93-92bc-a036a34582d2", "comment": "Malware payload (Mirai)", "value": "2f025fdcf025f099a12ab9ea45360d4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848607, "uuid": "2e2fca9c-120d-46c4-b5af-261c97865988", "comment": "Malware payload (Mirai)", "value": "4f0379853139827989fab52f054ebc22f413b35e8e903a13ff7b5c6edef4d901", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848607, "uuid": "73f81a34-dafd-45b5-86ba-f798d16420b5", "comment": "Malware payload (Mirai)", "value": "09e35d8e4549cd5513d68da0c3f90c01dd6ef5d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848607, "uuid": "a915dede-63e0-4cff-9649-493513387150", "comment": "Malware payload (Mirai)", "value": "e532e3b955c0c83293246ef1d9e1b2527c8c308a57606f1ef123613ea9b2576a2bc616df348d631e22a7db4d2b452ec4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848607, "uuid": "46f2c812-6828-4f0e-943f-d445418abdf2", "value": "T1F713F2E43E8FD40CE6EA843ACFBE914954242FD4F1D5B19069C04E9C5A4B3966630AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848607, "uuid": "cafea08a-fcfb-443c-88ca-1c402148a1a0", "value": "768:WBJUR+MV2nfPCxwBI1vuBVf1EQzbiIe44aL5RbVShXkzzs3Uoz0:UySn8Dvo1Fy54L58XAez0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633848607, "uuid": "cee8465b-54a0-4050-83cb-541bd0c586db", "value": 44848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633848607, "uuid": "4b85e567-49bc-47fb-8ff4-13d0fabafdaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848607, "uuid": "56d32a14-5bde-44fe-b008-aabee8ea7109", "value": "arm-20211010-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189e9df8-29db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633878152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878152, "uuid": "c6d19f4e-e480-4eef-b3ff-e882452a8656", "comment": "Malware payload (Mirai)", "value": "7aa06a425f7be6eac87b72d926fe6dd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878152, "uuid": "fbd46ef0-9f09-470d-b254-67aa946e7dfe", "comment": "Malware payload (Mirai)", "value": "4f075ac324a28b4841334f75592e90dd2524c43ffa401130d9262039c4917f6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878152, "uuid": "a643d66f-7758-47b1-81d4-1ddf752942b2", "comment": "Malware payload (Mirai)", "value": "666a7bd823baf2d746b3f270a68e8bfb96287d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878152, "uuid": "dc6e33c0-dfe6-4c0e-84f8-cf1032bb9fc3", "comment": "Malware payload (Mirai)", "value": "7b918acd3fafce3cf7194ce197acd5c0b37fe822763441293d39ad5a0fe414483f8e4051438713d07dfc7f1bdfa9bcf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878152, "uuid": "d27f4175-7e87-49c0-8652-a00e8c43f4fd", "value": "T188D2D025D0298D67EEABFF760C4BF2C3B7509E1EB700AD9109F0AF05A256D917A0C2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878152, "uuid": "2cb6da2f-c1e2-41bc-b520-11822c025998", "value": "768:X5GBlUiZZy1MAzd5CvQNNMG1EJ9lVKpsOk7t3lx4uVcqgw09A:JG/UizLAzzN71EJMCH7t3lx4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633878152, "uuid": "b4ec2d85-12ed-4cad-a5ce-23ddf764cc34", "value": 28828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633878152, "uuid": "2f9828fd-7116-4d0f-a407-1276f60f234d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878152, "uuid": "447b2209-1381-4ad7-a9c1-01423d4accbf", "value": "7aa06a425f7be6eac87b72d926fe6dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa10f0a2-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884839, "uuid": "175ad297-f326-4fc7-9d1d-1453506988af", "comment": "Malware payload", "value": "38e36ee8dd50bbcd0294be8471b96b45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884839, "uuid": "290a7793-703a-4d3b-b5c1-c384e84ead33", "comment": "Malware payload", "value": "500d597ddab031b7239d7d5a538bfd10c52a3fc90196812368f46066b61cfa14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884839, "uuid": "b7c6a604-f571-41aa-a0e6-acf836e2edbf", "comment": "Malware payload", "value": "40a374a02e17513da84d22fbc07bce2ffc062302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884839, "uuid": "79f2c7ae-30e0-47df-95dc-9a88b2095627", "comment": "Malware payload", "value": "fa9e3a3aa2b8f70f1d459823b2b9586fb7f26d171b388c7d9bcfaaafd4eeb40bb4f6c0bd7bea05dbf593736bb38b732a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884839, "uuid": "8dd0ab1b-a962-4ee8-945e-1b9e85b4cd59", "value": "T1FA54973F27270B63D0D9193201D31671ECA9DBC4347C53D6A8E0A96C2F2A6B43596EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884839, "uuid": "2a897408-2654-441f-a79f-bbc47fcecf22", "value": "6144:2a5wl0O24BphabsTdTS+Dy1I3MALO5CWPw:2y4BphcB+Dy1I3MALO5Cyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884839, "uuid": "6a67d107-688a-4bcd-8b24-60b6099b010d", "value": 292278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884839, "uuid": "dc7974c2-9617-485e-a3d6-f24aaf32d974", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884839, "uuid": "f6feaf1e-b668-4517-85d6-cf10a02bfabd", "value": "38e36ee8dd50bbcd0294be8471b96b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d06cfc-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899168, "uuid": "ec3e0b0e-efc7-4577-aafd-8155e0f6de25", "comment": "Malware payload (Mirai)", "value": "3bf241db1e8c26f4a671cd5d3dc327c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899168, "uuid": "80cd1650-0d91-4080-bc11-6f5eb55f1e2f", "comment": "Malware payload (Mirai)", "value": "501c8774d8412e7a670adb0d4de029144167e5e9beda4c2efbeee0f16051d430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899168, "uuid": "1b8f3bb6-f91f-4efd-a37d-fa5b4541ee28", "comment": "Malware payload (Mirai)", "value": "912a890c226d104ff1b9d83ce10ca00202a55a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899168, "uuid": "4ccfa096-2ea7-43bb-8ca7-c3213807d535", "comment": "Malware payload (Mirai)", "value": "e601c0959ce4ae55e581122bcc16a484a6cfff95160d26da6290cda7f77871ffd1efe1c3114afc13cfa1afc461a42b4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899168, "uuid": "d117ad82-7deb-4955-9f28-bedcfbdf4fd2", "value": "T16C53A319BF650FB7DCAFCC3745A9174228CCA51A61A93B36B934D418F24B64F09E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899168, "uuid": "7de090fc-3d47-467e-bc03-4f7c2765529b", "value": "768:j+bpLmWQ3Wk/VM/SNvvxTzIP25UdesefnepAA2IZIy6Xidokc7vvK:j+b5mA/EvvxIP2QVWnCAAFZIyHc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899168, "uuid": "76b23f88-68ba-4c83-9c52-78daec3f54cf", "value": 63888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899168, "uuid": "140b24ce-f93e-4bfc-8e39-078b1a09b645", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899168, "uuid": "54eeda84-f1f0-490d-9b71-77a4dbdf4fed", "value": "3bf241db1e8c26f4a671cd5d3dc327c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4807e9-2a20-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633907925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907925, "uuid": "2cf53d55-5437-4043-8d5f-dd9770fc7ade", "comment": "Malware payload (Mirai)", "value": "b9709503004c44c7ffe7661ab8a4c51e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907925, "uuid": "5d2b173a-7284-490c-9a5c-307c94ac72bf", "comment": "Malware payload (Mirai)", "value": "50950a59cfcc0e6c5ba65cc493a3de0790463998d1abcf9fe4bd1f24b56204e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907925, "uuid": "4535dd67-8a12-4fff-b982-de8943e09576", "comment": "Malware payload (Mirai)", "value": "f97aff022bfcb022a7a1f5469df08b7a1e30eb47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907925, "uuid": "6c10c72f-cf3c-4f63-ab9d-1d59e34fbc9b", "comment": "Malware payload (Mirai)", "value": "9ca8fd51b04ac39f13c1e86bf553a765add359f4b8cd359b9064d4095bd2a1101e637430594731d2f2f094b3f7a3ccf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907925, "uuid": "c02db5e4-a070-4da8-8e08-664334991108", "value": "T1B043199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907925, "uuid": "940f6ef7-e5d3-4897-af77-ccd1710a35f0", "value": "1536:EaDIpuRZhJRAAMA+xVZtWaWhK3+y6MdD:EaIe6ZtWhhQ1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633907925, "uuid": "08453655-fb69-4b16-a079-5986cf016e9a", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633907925, "uuid": "f56bd5f6-089e-4c7a-b636-9e8a3e542e98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907925, "uuid": "dd680075-c040-472d-a69e-e5e1c6fde099", "value": "b9709503004c44c7ffe7661ab8a4c51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70ecc23-2a0b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899007, "uuid": "c1d3dd99-2bb5-4108-8f89-bcb19cec99ec", "comment": "Malware payload (Mirai)", "value": "5266f54325e01d8165fc50af63890a75", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899007, "uuid": "b1d3f88d-bc72-445d-b42e-5fc2f321d881", "comment": "Malware payload (Mirai)", "value": "50ac4daa0f36560bb83140c55714c1bd9e89ba7d98fb1ad42fa47f604ccc482d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899007, "uuid": "cf8fdd23-7e74-4343-b9a1-7d2edef721fd", "comment": "Malware payload (Mirai)", "value": "a2609e0d6298094934aff4e50849f1039a1f149b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899007, "uuid": "a5031cf2-7736-445d-9975-97bb9b2d1999", "comment": "Malware payload (Mirai)", "value": "80e1186dff9b7083f1a12b8095af9cc8888d09c3a345da8522411e7af8f23ebe3297d8a942543b2646d419349a30fb38", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899007, "uuid": "df6f3f4d-c120-4721-aced-065920e2bac5", "value": "T12C030856BCC28A2AC6D0537AAA6E409E332073E8D1DF371BCD151B147AC652F1EA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899007, "uuid": "a8bb5465-aa06-47bc-a6e5-8f78585b4899", "value": "768:1cc4siKFA+c8dpncagsLum4giGDWIOrL4vbv58LShHKK65eKl6DhdP1Di3gWcN:+cGKS+cApnDgsLujcWLAv58WhKeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899007, "uuid": "aaa94d6b-a1f1-48fe-8f9f-d6b7a75306a9", "value": 38844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899007, "uuid": "7a56b2ca-08a5-4f1d-86e3-a35e0478233e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899007, "uuid": "ae059a10-c4df-47a5-8821-910c7be9543d", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6106f89-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851385, "uuid": "40abbdcb-75a0-4292-946a-8b65f5d3ef44", "comment": "Malware payload (Gafgyt)", "value": "af7cad67922a5986c232c61c137cbb80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851385, "uuid": "14b0e25d-0f13-4b7e-9106-425e9eaff658", "comment": "Malware payload (Gafgyt)", "value": "5249f1eaf1a3d77fcb1ab6bd2b92adac5f9d4bf48078c772675dac34bb68286b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851385, "uuid": "3d8ae5a2-156b-4915-aabb-0caa8f085b8b", "comment": "Malware payload (Gafgyt)", "value": "f20f3354c55ac32fe7b06a65286ebca5da958150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851385, "uuid": "3854b110-5b2f-4137-99aa-18588fa4f2f1", "comment": "Malware payload (Gafgyt)", "value": "32b9adde9a38901b5360cf03bc9b073f2a26e5b146cd1fcdcbe8d8104ee09a93c9836b53556fb1f424507cfaf69a6c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851385, "uuid": "277949ad-0e7a-405c-990f-9def158e53a6", "value": "T1E6C3966A7A21EFFEE16883310BF36F70C3D5219626919386F16CE6581E7128C2C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851385, "uuid": "fe3a2147-2e88-41c5-a887-ed6bf7892865", "value": "1536:Q7jr1Tf9q+Di8s2rKPdiyIBx4HGere3b7M1l21HtUmkiSFxfC7xoXe:ypQ9GSHGesal21NUmkiSFxfKxoXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851385, "uuid": "e478246a-eafa-4e26-81f8-c87592012e2f", "value": 118295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851385, "uuid": "71372cd9-ca3b-4bfe-a199-3db40093198e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851385, "uuid": "53475a17-7fd6-4e60-b8ad-68015eec8300", "value": "af7cad67922a5986c232c61c137cbb80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce06969e-2a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906804, "uuid": "da4fc1a3-a1c9-4e1e-a211-383a7e20d24f", "comment": "Malware payload (Mirai)", "value": "b5a39748c68d7a53fddf160b72d3b30f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906804, "uuid": "b168caf1-63ec-4a23-b3ce-598673843ecb", "comment": "Malware payload (Mirai)", "value": "525bc3aa5bc07eb94424f6cade03bb5f62641e7516e8b26f55aeb0b35ecfc4fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906804, "uuid": "7095aefe-93ec-498e-8994-3ae3e42747b5", "comment": "Malware payload (Mirai)", "value": "143de36829349079ad20fbab9d1223d42fb9fb1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906804, "uuid": "873dc190-6b77-4440-9431-4f2784429f64", "comment": "Malware payload (Mirai)", "value": "d7451d9db77edfe84fab9f2913a4b84fb4ea4aee33594d3e3b0c6881342b7c88f9a4f6fc07836bb57c977d801fc9b98a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906804, "uuid": "bde3e7a0-abc8-4aa2-af28-442f373b5130", "value": "T1E1D34B46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906804, "uuid": "4484164e-18fe-445d-8404-ed8e7e2564d6", "value": "3072:uw9Lg2RRhpRM54yaRF230tuiC/gH5CEuq3H3l2M/9CIkYj:d9LgaRhpRMqzG+uiC/gZCcH3kM/9iYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906804, "uuid": "5f39f021-7f15-480e-b1e8-66d79a70eca0", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906804, "uuid": "42099d51-7c06-4f15-8089-6ef4ea48ed7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906804, "uuid": "0924b8ba-c556-4f07-9897-a2c2a4350c11", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1d2ec4-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851098, "uuid": "902f4dc8-b3c1-4615-aa30-a748277e4f2b", "comment": "Malware payload (Mirai)", "value": "324c172b4085bba9b7c84547f3a4b10f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851098, "uuid": "fefde73e-d098-4a6e-b383-35c4a4efd6ce", "comment": "Malware payload (Mirai)", "value": "52c919a531e2168efdee8b1df6f597aacbabccdfd40e53c35628c9bf08870d5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851098, "uuid": "9662f198-c4e4-4d05-a889-085309999e35", "comment": "Malware payload (Mirai)", "value": "c0c6cc2d232ee05adbefa0b8d7d4ca04059425d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851098, "uuid": "20ed6b36-13af-476d-bfe3-221739481622", "comment": "Malware payload (Mirai)", "value": "c50377424912689db5848f454d0e4511d76b892ae229a683f193a7258046a351917a41b39187e1779189c718b5514392", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851098, "uuid": "5c2090a3-58ea-4d62-a055-8a45c0a49d0f", "value": "T106C2E188178919E9C2F9C17C47B81B6C19A40F66F809DC86B8F8F7519D8E4753023EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851098, "uuid": "d89d0a9c-0b2e-493b-ab61-9332d0903e95", "value": "768:f2G214DFyosXqgvV9o1ndB08T0JgGlzDpbuR1Jp:f2GdDgosaaO1ndtsVJuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851098, "uuid": "366e910f-aed7-4e8e-8cdc-a14550ca2ff5", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851098, "uuid": "44f87c1d-0587-41a8-a760-d53b9055ec73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851098, "uuid": "2600ed71-0cd9-49c7-a2d5-af2405ca9b6a", "value": "324c172b4085bba9b7c84547f3a4b10f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605b0d11-29eb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633885145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633885145, "uuid": "511d8780-8613-41c8-8ad7-f3cfb0a62daf", "comment": "Malware payload", "value": "b2a808bfe7acc654cdc0fb8eb890f04b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633885145, "uuid": "2f5abcaa-5c18-45ee-97b3-bdd0683dca83", "comment": "Malware payload", "value": "53563eb87723578c09b476713b288d4b961acd23b4a644fead12aad3788a2d3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633885145, "uuid": "408d07b2-8049-4ec4-b07a-902f557a6856", "comment": "Malware payload", "value": "27519058f8944d0f6b0d0565133f0c49f6f116d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633885145, "uuid": "67e87187-4b9e-4f26-a4c9-83aac820f523", "comment": "Malware payload", "value": "d08f8b96a415a477a814968a6768494452f095a1931968c705c22293cc6eaacaf7c0d52cb06a42498eee52f4a33e8b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633885145, "uuid": "265f450d-e2c2-4917-83b9-f5ed77bb18cd", "value": "T1D35302D14FC7DD62C1592EF879C9E1B816CD202439D2E3183B189BBCF28E0679AA5217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633885145, "uuid": "d2e687d3-7c50-40da-ab1e-9bc9e1be997a", "value": "1536:+QtRd6hl60HvK3R6pZupaJVjCe8h4SpQET3b/5HP:FtjiKRyuyCe8hvTbRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633885145, "uuid": "ac6052b5-f619-4987-ae0e-a044b4c7e0c0", "value": 63524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633885145, "uuid": "209edf0c-716b-4b08-b03b-f0d7d24b1809", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633885145, "uuid": "5b19d931-ff88-4f78-baea-7a8bda4f0269", "value": "b2a808bfe7acc654cdc0fb8eb890f04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97986a4e-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843147, "uuid": "82277a26-d269-4dd6-a0a6-0ea87ba5efff", "comment": "Malware payload (Gafgyt)", "value": "6b514091d6b706f4f1004c339102ee60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843147, "uuid": "07cfa15b-6749-4e35-aa1d-004c904d732c", "comment": "Malware payload (Gafgyt)", "value": "537d71dbc1987bfb53436e4e995f1df74460b9b6f07819989700d7de411e127a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843147, "uuid": "644c39f9-1c09-4579-95bc-3f520872dc25", "comment": "Malware payload (Gafgyt)", "value": "d170ccfe076e3f33f5a2305d32ec3d48d5113e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843147, "uuid": "0823fb76-f35a-475e-8028-03d172cd3b1e", "comment": "Malware payload (Gafgyt)", "value": "37f525dfd0aff76df98cd40b9def8b19f3d1b404fb76b579b62d078d89546bb997caf35075518d5d4e21df0578ee5e8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843147, "uuid": "68ea49a4-0652-4a7d-b2ef-06b350fbe9eb", "value": "T116D31905F4514767C2D31379B68E4A5D3B321BE493CB33265A34AFB42FC279A1E29DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843147, "uuid": "9be5505b-a6a9-446d-9ac1-73f753cf8549", "value": "3072:66LdGaAhDwVHWddQNIhFhrSGHhVAgzZmsQNYMQ/XYln:3LwaAhDwrIhFhrSGhZmsQNYFfYln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843147, "uuid": "31464d50-c694-425c-ac11-e7af1fb4260f", "value": 140421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843147, "uuid": "1afb794d-f5f1-407e-b396-b2b7c600ec2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843147, "uuid": "1c8f6d2a-8fc9-4e0a-a63c-1e5c0416e7c4", "value": "6b514091d6b706f4f1004c339102ee60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aee6c00-29a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856681, "uuid": "21fd53d6-a1af-45a8-ab95-32086ae37326", "comment": "Malware payload (Gafgyt)", "value": "8f2cec7d47c34f2f075f48ad76805b2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856681, "uuid": "d5ff6501-dc14-4f5c-84bf-57d9e586779d", "comment": "Malware payload (Gafgyt)", "value": "564fd4ed802cd424e7a4b02ede2ab29cd6ee4526fbf2a94e208acb3c1142094a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856681, "uuid": "47662fe4-7f11-4de2-9340-959b45f7ce67", "comment": "Malware payload (Gafgyt)", "value": "88cf4ac3140204102b17b79bcf82c060321c6044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856681, "uuid": "57a0dc74-885e-46d6-a346-d4aeb1d13706", "comment": "Malware payload (Gafgyt)", "value": "4d2926d545b220d47d8b75e48b3322b4c55d5630b505c57ff79f240639805be0684ba759408a3b1f26be255dc094d150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856681, "uuid": "255eae5f-6e85-48b1-96eb-9c1c6dee9e0b", "value": "T1CDC30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856681, "uuid": "4e6797fb-af36-4fb6-a917-7ae7dfca3e63", "value": "3072:EJDZ+6lJQTnoo3YKdLrLmkx7WT5hLXcuXE674eoC9DQlD6ObAF5R:LXmQKT5hLXcuNVoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856681, "uuid": "79301bbd-91ca-4e89-a8a0-42bae490a9c2", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856681, "uuid": "6a4421e8-90ed-492a-8ed6-45a6cbc91ed6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856681, "uuid": "6fd0b116-046c-47a7-b976-0f3905fce38f", "value": "8f2cec7d47c34f2f075f48ad76805b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3914c627-2994-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633847713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847713, "uuid": "a6c0f771-28db-4c22-afce-aaf34f8dd3e7", "comment": "Malware payload (Gafgyt)", "value": "7fb0ca0a1638bc06e7853ae8bd23cb48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847713, "uuid": "a880ee11-0b9f-4786-99ec-5aeb979d1feb", "comment": "Malware payload (Gafgyt)", "value": "568e8623daccc2aebd06a2f7b3fca8d843e7a53cdc0aaf0eb612c66249f16b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847713, "uuid": "99ff9d50-b428-45b2-aca0-7d3bc7b8c457", "comment": "Malware payload (Gafgyt)", "value": "591e578c3e9e855c08de458bb553825cd402b224", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847713, "uuid": "b3d70d67-4bf9-457e-9f8e-339e616ebaf2", "comment": "Malware payload (Gafgyt)", "value": "466766155dccb7a9f0707f4bb7f3a37be22a94fd2439ecd380d50a413f3dee1c7c4c162fd65ef4a7c27e7143b679b4dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847713, "uuid": "d56c614a-b98a-4faa-ae8c-8e3707cbdbe7", "value": "T1B45302B15D4372EBD01BCC34E2B6054C56F29E36D73A992B633CA57187C3546AAF2C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847713, "uuid": "2f010841-451e-425e-a6c1-63ae719e9894", "value": "1536:icLDNYJgd7cT2uN3KR99WHSFhRcF6Q9A1WwpE9Pr:xLDMgdYT2uY9gSrRiJZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847713, "uuid": "4e2cf4f1-c9f9-47ca-8d55-943c3f06c468", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847713, "uuid": "e742b1a8-d4fa-4332-8aeb-910ae20a4e4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847713, "uuid": "83c42488-015f-4864-b853-ee64f1cdbb3f", "value": "7fb0ca0a1638bc06e7853ae8bd23cb48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babee766-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633902906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902906, "uuid": "18dcf825-5c0d-4b08-8a8b-ab431a92b229", "comment": "Malware payload", "value": "435d4757bcfe29c1f1ea289a2566a3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902906, "uuid": "d5efc129-646d-43cd-b52c-c5893bd6f739", "comment": "Malware payload", "value": "56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902906, "uuid": "9be0f3a7-e3f7-4d31-9dc0-4ac913bcaa77", "comment": "Malware payload", "value": "105406f798f7b8a0b8532a64ad9061e5ae447cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902906, "uuid": "3405c92d-f9b3-464c-b689-4b507500cd81", "comment": "Malware payload", "value": "6deafb4f561ef293d49d9e40c0228c494530deb0bc5f01b07ffd7eda7847bcd8959cca797cc12ed59582d1407fb02a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902906, "uuid": "863e6f64-75cf-4dee-b8b8-929d6b691ab6", "value": "T1FF748E00B7E0C035F6F316F949B992A8A93E7DA55B2990DF52C0EADE56346E1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902906, "uuid": "030fbe70-eaea-410c-bf68-8b251af29cec", "value": "d8470aebc2200bafc1ff60318f406103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902906, "uuid": "bdde9a6f-348d-4f05-b5ec-afef3d6f5e5f", "value": "6144:7+lBHzxPyoHMtCeXjxMUa0PNFOOIefACagyZ8lcKJl8bwblpYL:yf1PywqCeXjxMUzPCOIefACagyZ8lcKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902906, "uuid": "9e14f87d-dc86-4604-b2d2-ef5d29a67563", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902906, "uuid": "12c10bb8-b759-476a-90d2-b31b23c688a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902906, "uuid": "9a997137-4f8b-4a73-853b-75a3367c5fe8", "value": "SecuriteInfo.com.W32.AIDetect.malware1.32537.18714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6733a8ae-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633866688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866688, "uuid": "88ea3d0d-35dd-4a3b-8965-504aa0afcdb3", "comment": "Malware payload", "value": "1f0a20571eeeaa371d13c18579b487e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866688, "uuid": "e6a319ab-214b-490f-a053-7a3a3aaa5ce7", "comment": "Malware payload", "value": "577224970e2202493057eff5b7537cb426281b659455c30fc40dc98826240515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866688, "uuid": "cedc86d1-342d-4138-9204-0e0d8de1edf3", "comment": "Malware payload", "value": "fb45a7ff5ba357085ad3c6e1e6be167ca67ce696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866688, "uuid": "b3349590-0db2-46df-9118-321d309ce727", "comment": "Malware payload", "value": "99cfea7c87596417934ff4a1d1646323a8e8091ab2ad2f4f2a6751617772e87ea987d68746af1cd631ae9d1f2c514c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866688, "uuid": "11c772dc-e2a3-4819-ba94-1a4a3c02df06", "value": "T1B7649FA372D240F2C7D351724F5B7B36E3FACBA402325E8357A8DE546930987A329716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866688, "uuid": "2b56b7df-c78d-45b2-bbc5-f3063a75009f", "value": "3072:iV+Cv5BHvNL0yWdwr8UxVMT2EDFjj4H1+2f+4fkt8lswu/IaJZtLEYrVg2BtzVm9:iV+u0bUDMT2EDFjj4bflswu/jtLFVgTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866688, "uuid": "54c57c08-f6c4-436d-a204-e599faed9db1", "value": 332886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866688, "uuid": "58a20856-ff1c-4122-9576-ab22762060d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866688, "uuid": "990cf3a8-a843-4d83-9906-7232439cf4f2", "value": "1f0a20571eeeaa371d13c18579b487e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0109161c-299e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633851914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851914, "uuid": "3bdd4bf4-9937-45ab-b5e1-90e2658fac94", "comment": "Malware payload", "value": "336f994b849d96ddf57e23f4261ae37e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851914, "uuid": "093a6a83-c31e-48ad-a6d7-16c5bc209495", "comment": "Malware payload", "value": "5827909580dce26b9c1fdf4047aac04188e1e66157018a653d304733c39f18d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851914, "uuid": "16eb9ee7-840a-47ec-9154-096f153c9d2a", "comment": "Malware payload", "value": "38a23269860586ed0cf3f94b49c8325224a05b3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851914, "uuid": "2a8f4930-fa62-4463-b46f-a58473a8b5a8", "comment": "Malware payload", "value": "07f417d1ade77cad7f13fda5daaa1147b5185b3bfb08ff10b81a99751f3c2c7929232d0eace2bbed774760eb32a36637", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851914, "uuid": "89a41039-5c20-4816-a5d5-2c2ecb306b0f", "value": "T126E2E063905FD70DC19D587A7A1FED1A0C12A72D1BC4CBF3AB8062B68C35E2718646B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851914, "uuid": "19d698df-20ac-4a75-8921-1c0a9f3c1e67", "value": "768:zhhi1Ub6L8s4Khg8S/w+EuTCo9JpkKnbcuyD7UryqU:zhhaUGQs4KC87+EAJBnouy8mqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851914, "uuid": "14c2f965-1895-40db-9850-51756af72a6b", "value": 31844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851914, "uuid": "981c763f-9be7-4846-9167-23562b54ecaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851914, "uuid": "211a6ccb-ebab-425b-88bc-03b915fbf5fc", "value": "336f994b849d96ddf57e23f4261ae37e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caff91b5-29d5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633875875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875875, "uuid": "7ee64415-ccee-4ced-a171-7d57a0145be0", "comment": "Malware payload (Mirai)", "value": "aa5f340eef2367d0ef607486bd8a4ea8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875875, "uuid": "e6429032-270f-48d8-a978-4a14a03226bb", "comment": "Malware payload (Mirai)", "value": "587f83703382e01266e08daf62335adce1bf1189db758b62912daf493c08396b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875875, "uuid": "e442f81b-4d80-4bd6-ba96-12015e4cd00f", "comment": "Malware payload (Mirai)", "value": "075c258b3c18e95285b369c8e9af29d815c5cac6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875875, "uuid": "ebb11a61-736e-4084-87f2-1347837dc38b", "comment": "Malware payload (Mirai)", "value": "24c0e30fd7dd732f22892e137bb4c4969b23a2b1d35488438f2f23c999b231476d1bd1fafe6f97701819dd11bd84c0c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875875, "uuid": "fd86c74c-2a8d-45c2-aed8-bb82bc7f17e1", "value": "T1D7C2D04D168540B1C1B05A70EE7E86427B6FABECD1FD68176AA157406301AC27BEC2FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875875, "uuid": "040ce704-5ece-42dd-ba8a-1f4f851c7d0c", "value": "768:AL8dknN4aeP2XLsZqJW4fu4uT1A/8crNToe2ZtKs3Uozag:AQC4aq2bGqJluzo8EobnHzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633875875, "uuid": "321618a1-b530-4f24-9199-f10e921f45d3", "value": 26124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633875875, "uuid": "5823d555-704d-4a6e-950b-535edbf5dbfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875875, "uuid": "707275ff-3feb-4955-aeff-37d1fb497950", "value": "aa5f340eef2367d0ef607486bd8a4ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eff16a-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877536, "uuid": "941ecd3c-eb0a-4c02-a0b5-3ffceb848255", "comment": "Malware payload (Mirai)", "value": "a36a49888240beeba65c77dbed4e2ac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877536, "uuid": "ed1ae251-4041-46c9-ad75-20419961218a", "comment": "Malware payload (Mirai)", "value": "5983ae6112420d732f834ff23250444f72dd2297dbd0bb2853f27bd867a1ed08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877536, "uuid": "62323328-60fa-447a-997d-bbcf7697ebdf", "comment": "Malware payload (Mirai)", "value": "e177fa5e3ed216fc895d96c247e5929e893b9da4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877536, "uuid": "21e0b8d2-ee18-4a9e-a999-3dc7eee2b237", "comment": "Malware payload (Mirai)", "value": "48ab7f6501009b421ed7c91f309d00a2986165be5ce305bfd920d27f9b7b1143ddbe6bb060f6be65d8d78f5c5477e9c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877536, "uuid": "6af7d054-349d-46a8-8395-85f2ff55e394", "value": "T1CE931B0BF1037E1CF0A15D328A672B6C1B9760619F2249D5E341BE571A732F5AECA7B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877536, "uuid": "f8124a2e-dd7b-4c33-8bbd-412051b4870b", "value": "1536:wASotXly7SAkoyDC5ORvhiXZ7MD35mdX1lPP:NSIXly7SAk/5RB5+FpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877536, "uuid": "c6bdf22f-d099-4786-9102-8148368b1cb4", "value": 91336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877536, "uuid": "3be55466-0f02-4bd5-a721-5c53f7ba804f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877536, "uuid": "0215510d-af90-4a0c-8dc2-34e68938adda", "value": "a36a49888240beeba65c77dbed4e2ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734570e-296f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831764, "uuid": "83710736-8ad7-4c81-92b4-565c75b975c4", "comment": "Malware payload", "value": "4477707be6337fbeb3cbbe3ba2615569", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831764, "uuid": "9850eb26-c458-4354-afff-606f196a5091", "comment": "Malware payload", "value": "5a2ccf72f28e6dd43460742053228322808a784c1c159428ceb9c65c23bb5293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831764, "uuid": "24529188-eef1-47d2-8d6a-9977d9a2f9eb", "comment": "Malware payload", "value": "a685767d7387149c0b55c9b1b33eec1f90c2f923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831764, "uuid": "c297ee6e-213a-44f7-96ca-eb09dac9ef9d", "comment": "Malware payload", "value": "2ed8c1cdad34dc56e676049d10d92e81171ea07dfed2df3be0ae1542dfe9e5afabfb6540fb0f5407433fc08215c632e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831764, "uuid": "cc4a5dbb-6761-4628-b518-7827dd8dcb8f", "value": "T121239407BB61AE73CC5FDE730BE64601208EB4571594AB0B7278ED6CAB1B48A09F3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831764, "uuid": "0bcbc950-0d42-4e88-8831-e003feb7a4ee", "value": "768:/KjKNeD+t5MKZh1gQXiZEejBqop8BvumQdRaN6MR1vS7GkSUkZepczQ:/KjKNht5VZh1gcdomtumQ6jM7GlUkMp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831764, "uuid": "5cac0d0b-239b-4655-a312-d73a89bace50", "value": 46771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831764, "uuid": "573306da-715c-4bf1-98da-9bff6b299e3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831764, "uuid": "9805fc55-41f9-4455-aa28-a039d3457bea", "value": "4477707be6337fbeb3cbbe3ba2615569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6514692c-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633851652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851652, "uuid": "3ae32ab3-2f38-4426-898f-93389e1f077a", "comment": "Malware payload (Formbook)", "value": "8279edc14cc42685f7fceefe384ddf0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851652, "uuid": "246d95bf-19f4-498e-8878-18c304fa4490", "comment": "Malware payload (Formbook)", "value": "5a573da6707c9373b0f49b049b07ddc21bc6976195b834473d0be2daaf52c173", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851652, "uuid": "38e3d42c-b585-4f48-9d2f-8370c137147b", "comment": "Malware payload (Formbook)", "value": "d6b01e94dd1528eb364e16db7bc6a5e06a66bde6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851652, "uuid": "2ccf367c-7e4a-4f07-ac32-9f9256ff2db6", "comment": "Malware payload (Formbook)", "value": "22d54b710fa91433d5630366f4b0b3083003de5e0c48a3d3f074b1273c64cb6e3fa8088cbfa456439f516f7ae89c6f11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851652, "uuid": "158e9b7b-0aca-4be7-a1cb-eaa4a186eb25", "value": "T12984F15813779308CC7947F52828AB902375912A109ED3BC1FE8E4FC6EB7BB549E0667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851652, "uuid": "6b9804bf-7c21-441f-afdc-c69436eed994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851652, "uuid": "d9bbe29c-be27-405b-bea4-541113da82a8", "value": "6144:kKq6ZZmDQ+3HwOEjhH+KU8b1Qy6mK8WRAYfnsdtGfBYmP6tKX:skoq1BTbKy6x8/vdMfBRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851652, "uuid": "51954d1a-27fa-4be6-a306-b6edbfebc4cb", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851652, "uuid": "8d0bf8c4-533a-447f-9890-f721fd310f4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851652, "uuid": "680aa60e-f505-45ec-b8f9-354813e9869e", "value": "8279edc14cc42685f7fceefe384ddf0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ac2225-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873804, "uuid": "05b6cb28-e5b4-43b9-8d1f-902ed145e628", "comment": "Malware payload (Mirai)", "value": "421c0c67d34e6c80d795e00533dbb957", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873804, "uuid": "0ab7a734-74e6-432f-8bce-4b610d238f26", "comment": "Malware payload (Mirai)", "value": "5a70d47692b6577db3245f23283910b286181e78af8be4a7cc491a30d3bcad5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873804, "uuid": "8f17954f-faf1-4182-b405-67005224235b", "comment": "Malware payload (Mirai)", "value": "e5d0e1b6485f10d63b19a16bc4ab9b14d72c5658", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873804, "uuid": "b9b8d6a3-e651-4669-b669-e981af8ce305", "comment": "Malware payload (Mirai)", "value": "e5e20a7b3991ca32e389f0963be814f42a8728e7ac7be394df1145973e2469a12b422e59bfbbfefcbdb4c1002d3ee576", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873804, "uuid": "a851a89f-f8bc-4824-8b50-59f8dd168289", "value": "T12F3302D0E2129090DC902DBDD729989AFDC57FB49CB1719353680017A9A1D0F7EED2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873804, "uuid": "ec11762d-2a95-45f2-b685-2a23ca1b8d80", "value": "1536:NNVAJQob4LIJ1tBC7tikk4LlxcwgRPWlt39:LV+bIIzTKk4LuPWltN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873804, "uuid": "22d7c689-b838-4b6f-95d3-5e41dc64a186", "value": 54776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873804, "uuid": "a8f4954c-5e2a-44ea-97bb-0d7f2964b15f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873804, "uuid": "83db90c4-3234-4541-918c-526b79c14c27", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6798ab9a-29a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633852945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852945, "uuid": "c6d43744-9ea0-4125-b5b9-d7e7e6f1caf1", "comment": "Malware payload (Gafgyt)", "value": "73f07f32f124f53a8d33217c0bd5f136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852945, "uuid": "8f6e4c4b-0c04-4ea7-aca8-90bba3ae7f9f", "comment": "Malware payload (Gafgyt)", "value": "5a9491d721c5d3eeb8d5d832ffb53a379019ee0ce9903c8f3d57147d27824223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852945, "uuid": "75858188-e6fe-4a51-9971-2f986d93f3f5", "comment": "Malware payload (Gafgyt)", "value": "7766b607e493be380888333de95bb77f0e13cd0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852945, "uuid": "3259305b-397d-4ace-a7ca-4fec2f247a7c", "comment": "Malware payload (Gafgyt)", "value": "6ad88b10c464aced36ee3d850277fc2bfee375bd3eff1f4f6571356e733f4a7bed155d062bc386e22606538b811aee24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852945, "uuid": "d6d2f4a8-2148-428e-9e30-90dddb0d2086", "value": "T181B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852945, "uuid": "a04798f5-2410-40f8-9573-6852d09144c3", "value": "3072:MDVLSItJP+Xsp4JlN3H/jmH1cuEgvniuN/:MDV+ItJH2l3H/jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852945, "uuid": "89334e46-6b96-492a-876b-b5b97886be55", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852945, "uuid": "0a7dd5b8-20d8-4098-93d3-a6eb0331e57a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852945, "uuid": "33fc61bd-9759-43fb-bd26-26165ecf5eb3", "value": "73f07f32f124f53a8d33217c0bd5f136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83a5fea-29f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633888809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888809, "uuid": "fb476d84-5284-4762-bd95-c65ce4fc83c5", "comment": "Malware payload (Mirai)", "value": "8cd205fe960320d6245211db487db714", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888809, "uuid": "f5b6e65a-fac3-47f2-81a4-146c6a395f22", "comment": "Malware payload (Mirai)", "value": "5c10a3d48b2f661a8790956ab01e04b7ece120c676199bb1dd04736eee00e12a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888809, "uuid": "63aca6fd-fc6f-48be-8cb6-e3d42af5a95e", "comment": "Malware payload (Mirai)", "value": "bdd2eaede2b03b1fb7c863992578ec533a7e244d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888809, "uuid": "86daabce-9a5c-40c7-9ea8-c585d40c9845", "comment": "Malware payload (Mirai)", "value": "60653be6580a0832da18683811a692fd47948bd6d9aa0e43cd71d30bf77c1fd0ec02089f789854f88b6eaf64ef3c5836", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888809, "uuid": "5c6f6e1e-a815-42e6-8395-cc72b2290426", "value": "T130A32B56EB408F03C0D61779BAEF42453323AB5493DB73069918AFB43F867AE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888809, "uuid": "67ba055f-6780-4757-ab08-25c2d68a3398", "value": "1536:55nYzNIwx64iQXHt/qiGbfcUbpNlMjEiE5h4GfHXlqoW1Ezw/9xefkTyXITI:+NZxbio/qiGbfcTG5hfPXoouEM/9xAXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633888809, "uuid": "7b5526a7-5f8a-4f81-99aa-d3bd721c898b", "value": 106244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633888809, "uuid": "5d4c757f-5543-4296-9d43-ddfb8cb88010", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888809, "uuid": "009a45a2-4c3d-4d91-a567-14bbd745c229", "value": "stainless.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a5a9a4-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902951, "uuid": "aac6f30e-f5cc-4672-aba7-c291161b58f0", "comment": "Malware payload (Mirai)", "value": "7781c69c9d21f349d99e4b00be4857b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902951, "uuid": "65c05f13-974b-4e44-aaa2-d06e8d7f4967", "comment": "Malware payload (Mirai)", "value": "5c9ec4cad730b1417f776c2ba399f5b87354a18b4b3cf9ca437d9da850b1cffd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902951, "uuid": "ac8ab455-42bf-4d26-a43f-e308cf4d0295", "comment": "Malware payload (Mirai)", "value": "5daf6fab52e24602673165a79ff055ca1fa6e359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902951, "uuid": "6a39380c-497a-4390-9427-0ec7bd0c24d7", "comment": "Malware payload (Mirai)", "value": "66a13a070a821e1f84e7d3cb29d7ea3006e5aef53ef6667a6c2e6d5a6c25e5289319614d5e870367176488317ba293c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902951, "uuid": "3bcb2cec-fb4a-41a9-8bc8-cfa49e5f9cfc", "value": "T181F2E0228327D531CD78DABB9D3182E8196B43F4B9BF70656794C68D58C1F03C5FA14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902951, "uuid": "c25b98bf-3b56-496c-9e3f-dcbac140ca73", "value": "768:aYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjIG9q3UELCi:aYyAxdRH9zILLBBrodjSLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902951, "uuid": "b13991fb-5cee-4038-a838-a69dbb6d19d3", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902951, "uuid": "0cb1e0e9-923d-4ac8-b0c1-3cc7c7bec198", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902951, "uuid": "ef394505-50ff-4185-8573-10a702fabf90", "value": "7781c69c9d21f349d99e4b00be4857b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eca094-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883871, "uuid": "623fc919-2e99-4e19-acae-d9923a346458", "comment": "Malware payload", "value": "d997d9fb4fc8f3b4483b08702ee654fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883871, "uuid": "11609922-0b44-4f6e-93cc-06d41390368e", "comment": "Malware payload", "value": "5ca8e84460ede02bcabdb45e388031002fc870292b756e8b777fad06c4b631e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883871, "uuid": "5bd745a9-2f8c-4358-8811-23be1f471bdd", "comment": "Malware payload", "value": "8e84b44070782ffdb69e0b576f88c66677111187", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883871, "uuid": "6bf8c3dd-5e10-4463-8882-e0157fdac457", "comment": "Malware payload", "value": "f02087d5bafc4c33c9e0e37db784fdd99d4707b310f01c8ecfe86d0877d9510cfd106e3037e84c207c95f1e951d9de3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883871, "uuid": "24d83f33-9c1e-4d6c-8685-769fc9c65d95", "value": "T18453026E270B6EDAD46EC4F1668A17967C314FED4AD7C9022146B5E8F5402CF3E60AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883871, "uuid": "c614d75f-0744-44cd-b4b7-0ee477140743", "value": "1536:wrLi5S0+MACR1stlhfXGONpi1lc0yDfMHgS51YIh4VrY8wrx2fB:wrLy4Q0h/bQb51hOVrYleB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883871, "uuid": "088bcd66-ef83-4f7e-bc17-ebe59de04221", "value": 65708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883871, "uuid": "8b9138b6-6453-4294-94ac-5c59c09dd17e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883871, "uuid": "36c8a99c-290f-4ecd-819f-b854466a22ce", "value": "d997d9fb4fc8f3b4483b08702ee654fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7b25b7-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633866621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866621, "uuid": "d3b8248f-e0bf-4067-b2d3-5ba963d0b571", "comment": "Malware payload (DanaBot)", "value": "9418037bf1d8645727149ed3833d949e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866621, "uuid": "657d0ca4-abde-4f4f-91e8-4b22b3fe9fb5", "comment": "Malware payload (DanaBot)", "value": "5cb964bd923cc010694b5960dc72715b1a09e1dd282b5669b8cf8d391550168f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866621, "uuid": "b4c5aa28-f2d6-4209-ae4f-fd383a8a9862", "comment": "Malware payload (DanaBot)", "value": "87f6572536e0d4793322cc4a52d103de174ca586", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866621, "uuid": "0e2d3567-9d82-4495-8f43-e8d7ae91cd63", "comment": "Malware payload (DanaBot)", "value": "0b0677be28cc769c989f3c0dcd7a456ee9b34fa4dab9efa254da59b80cf85fb45e086073a8ad2e61c49e926099455177", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866621, "uuid": "0f7c8ff6-61d8-4491-ba4d-736a0efbb9a4", "value": "T1CF451210B7A0C039F1B756B889BA836DA93E3DE3AB2464DB63D115EE16765C0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866621, "uuid": "1203fbed-e7c7-4fce-a879-ec8e3bc7e7dc", "value": "88f6b4d5fe41c261e2640642cf08fe8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866621, "uuid": "fcd27d3c-60ed-47d8-adaf-f177cfbb2142", "value": "24576:wtcp5/CDKcmO76eXB36riylDGGBBQUdAQndLlsPLn:j/CDKcmODBEltGQSindL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866621, "uuid": "e1dc4381-510d-4722-bcac-84c1229b21ad", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866621, "uuid": "a2107e49-2c3b-42ec-a17c-5533181f18d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866621, "uuid": "0643d66a-ef68-4626-aa56-893ea6b93a66", "value": "9418037bf1d8645727149ed3833d949e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acc0714-29aa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633857191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633857191, "uuid": "cef43a57-3850-4028-afc2-4c897031d6d3", "comment": "Malware payload", "value": "6395cb44b6d0b89a3e1aff111ce3f036", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633857191, "uuid": "d997ff2b-1e5c-477b-bf7b-c387cc5568a5", "comment": "Malware payload", "value": "5df3c3a290c24c0c70d9b6c2fe5a33db638b7220cada425026fb817900061573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633857191, "uuid": "09543117-2ffa-4c3c-9c51-39b8a2f6dfea", "comment": "Malware payload", "value": "2db1e18320a881e2e00386361d86bd631d88d831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633857191, "uuid": "3a110b8c-1f34-49dd-9e3f-4725f19be330", "comment": "Malware payload", "value": "7824738288a6167475be4090196d6c92f674ee87966c287b96f34c657aa9bd367da6b8d0654ca80d9688a6c7058fe4f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633857191, "uuid": "baf4adb1-c60f-4c36-8e76-8cf40b9ef9cc", "value": "T1EE64018BFB21AC1FC9000B7115DB0B5973BCDA4A82C7D191F394C95F39BA285B7A11D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633857191, "uuid": "c3f641cd-9c9e-4123-a184-5dceeb6fa34a", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio3POdOQ33Q:p3lOYoaja8xzx/0wsxzSimPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633857191, "uuid": "9ad2967b-3837-4eb2-bd92-2b781f01b789", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633857191, "uuid": "bf902edf-21f2-4b32-b544-1b758f735988", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633857191, "uuid": "fe26b3a0-448d-4e04-ba52-36b07c2757ed", "value": "6395cb44b6d0b89a3e1aff111ce3f036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa8dcc-29a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633852970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852970, "uuid": "2a60c10d-c071-4aa3-9ffe-735c3ba6df2a", "comment": "Malware payload (Gafgyt)", "value": "794c313c7c28561d6fccf4f25029b5c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852970, "uuid": "ea35d2ec-5178-4d56-8a37-9f7b5e824999", "comment": "Malware payload (Gafgyt)", "value": "5e1aba3a2a5978bda25d93de427d0bc52c91882454ee61d989fd421f9dbfd5a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852970, "uuid": "452ce5cd-d98f-45c7-b8e2-7e9636b677b0", "comment": "Malware payload (Gafgyt)", "value": "b2eac7a32350aa37ef56bcc0168e46d9891caffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852970, "uuid": "f0bdb61f-2386-4c8c-a9a1-3eb016f5b441", "comment": "Malware payload (Gafgyt)", "value": "7c5a3d039d75c4d0a0aadc4aacc3df9b99a69eee468b9aa68aa1d10130e67cb8064ad80209204a0d5a491ec60df88745", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852970, "uuid": "7fff1b6d-760f-474a-9d80-4f03ec842c0e", "value": "T192A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852970, "uuid": "534bd8f5-adda-4001-a320-90de4521eca6", "value": "3072:VK1z13U6HzHoXRtmTUhQogNEmmFVcqq0GnDZT:VK7DDeKlogNEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852970, "uuid": "d0972aa5-f834-4c8f-b393-85f04bacc44b", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852970, "uuid": "ff0ddd0c-9e07-4862-b3cf-1e5fcaa51e5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852970, "uuid": "6035f04b-2128-4574-9d22-4b82e07a3f3f", "value": "794c313c7c28561d6fccf4f25029b5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ad9db9-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884269, "uuid": "b98a5c7c-75f3-4028-8263-353360d89d45", "comment": "Malware payload", "value": "7d06a70ceafa243ca1571d87d19bc109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884269, "uuid": "663c8cb9-2477-482e-9250-bd82cf90c004", "comment": "Malware payload", "value": "5e63609b62451d1a7e46d0051509480bc9ee82d2279ef09472759c09c6eff9b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884269, "uuid": "0d04d44f-9cf4-4376-8bb2-4fa22a02db9e", "comment": "Malware payload", "value": "4fbb4192d9ff0fe81bb6d7e3f17c17c0915358be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884269, "uuid": "81dc79bb-cf9e-40c7-bdb6-3e6cd16bccc7", "comment": "Malware payload", "value": "9afe8612f5148e6e45bba9c699ae489669e898384a67928bf83dc96282a56205e610a66f161602a880d4df2d40f9914d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884269, "uuid": "f9cfb35b-ed7c-4fe9-ae09-5dbd9b69f82a", "value": "T14103F262CE8BA7D3E2300D3266AC484B335958609DDF3AE93E350D6665C58413DFDF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884269, "uuid": "e194c951-d13f-4cf1-9cdb-f57a11392c51", "value": "768:9ND3m8JfRabCy1RdnehPXoh4PEHFJYyf/H3UHwuNtO/IoYksUmfgFk:9ND3BjPy1jnepYuP6FO8mNs/IoYkPmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884269, "uuid": "bd8f6da9-e9ba-437f-8355-85b09d860f51", "value": 39032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884269, "uuid": "fe4f2504-8b33-4866-850c-73057316b660", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884269, "uuid": "274ab74f-e2db-4a3e-bf56-6e8c72cd8273", "value": "7d06a70ceafa243ca1571d87d19bc109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfbf21c-29cb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633871531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871531, "uuid": "e64ccd6a-8dbf-4669-944b-72a734b1fcac", "comment": "Malware payload (Mirai)", "value": "cce39957f0991bc7f30191bf7dd223c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871531, "uuid": "160b39ca-c076-4fcb-b5bb-7e7337432a2c", "comment": "Malware payload (Mirai)", "value": "5e9fabfe9c1082052a9185594f9c77a0ad75a95b825edf7ea3bc916dfd58f2ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871531, "uuid": "dcba035c-0e8b-47a8-84c7-b01e6eedd04c", "comment": "Malware payload (Mirai)", "value": "7baedd5593632e00efc57267816954a8da43d76f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871531, "uuid": "0afbca28-5beb-40e8-9e3b-59d4ef9392b1", "comment": "Malware payload (Mirai)", "value": "0d88bdc054d2276cc2e9942012e7d2f9a3f197dd2c1bd565a77d656615f5f010947301da2b96910af209d72c776a1333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871531, "uuid": "d7d4f9ef-7490-4185-990e-7dde8efed2b1", "value": "T188536D21AD7A2D17C0E8A5BB52F78320B1F5574E25A4CB1E7D620F8DFF50A4022672F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871531, "uuid": "7fa157a2-bf22-48f1-ac55-efe5afad08e0", "value": "768:Z7BuVCK0YoecHtPVGIKsumRmoKoMbPOdRsNacO+3Hw0GWJNSGxh:pBucK0YQNPdKsrRmOMUCam3wGJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633871531, "uuid": "1589017e-fe90-4680-b582-29292e23ed0a", "value": 60804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633871531, "uuid": "47b4bbb8-8d9d-4f8e-9067-1e973c7a82d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871531, "uuid": "3fedaef3-c69a-4ca8-937c-15efeab62334", "value": "cce39957f0991bc7f30191bf7dd223c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afb4a22-2a22-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633908758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908758, "uuid": "a4d55231-9b98-4298-a0f9-82b408a27afc", "comment": "Malware payload (Mirai)", "value": "dd1a4680dd36dd111633b84122c88047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908758, "uuid": "793d4f8d-8c0e-4acc-b381-e92500a3b631", "comment": "Malware payload (Mirai)", "value": "61444605955f1f615cee013afc36efe8f861c7ec76b8cba75932fcdb92fe0b1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908758, "uuid": "432bdf74-9e6f-4b2e-a115-478571d597a6", "comment": "Malware payload (Mirai)", "value": "2876af7cdc1557d1c951330d41a81968b6584ce1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908758, "uuid": "7ab83810-900b-4ada-be04-42a1354ba87d", "comment": "Malware payload (Mirai)", "value": "a82412753ed03d0a95266b66c210c2851532164eacae812b1cfecc1a68a49a50c0d0b394cdcf3687d312569f3bd6dbfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908758, "uuid": "d9a758e8-1d3d-47d6-8023-e11e7a5c33a7", "value": "T1DC435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908758, "uuid": "d364c2cb-bb0a-4554-80db-6218d5d06549", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEppVuz2GipH6TnSgGABs:ybUg1Jgzz4Cqu1HFsi6nSgG8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633908758, "uuid": "4ed09ef6-26d4-4e7b-9e5c-b0dfd5f75d8b", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633908758, "uuid": "4d21a5be-2379-440f-99aa-873ea51380b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908758, "uuid": "944571de-9390-4da7-882d-9cffd7994648", "value": "dd1a4680dd36dd111633b84122c88047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da372d7b-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902959, "uuid": "0aca25cf-b014-40ae-b4a7-c2417142a95d", "comment": "Malware payload (Mirai)", "value": "d6284280bebfc9eea3a3c32b0c0f3639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902959, "uuid": "b3fa11a5-1c08-403b-8213-0fc45a030d68", "comment": "Malware payload (Mirai)", "value": "619c74e389fb2af3783ee034b3eb69e688f9224274396661defe4e6130ec4177", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902959, "uuid": "e5e0fcba-91d2-4545-a1c1-be5d880b77f7", "comment": "Malware payload (Mirai)", "value": "891fd34c9c26703ee0b8556c5db0f356a9b471a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902959, "uuid": "82b0e99f-9a69-4f2c-aaca-bea0c18dd167", "comment": "Malware payload (Mirai)", "value": "50da8b9082b292f9b74a54c2dce8eee9a5ccb97cf995c251a8aa4c342c76f108531de87d6636b0e708e2c9e1fc8d2851", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902959, "uuid": "30f5d018-86c4-450e-8ba9-1605c7cf6f82", "value": "T1A0332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902959, "uuid": "4265fed2-de76-4716-903f-03fe296f3617", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWHG2TqOhRol7gSu9+f1prZadIb0eNia:Ua0zoRg2mew4ChAVLzF7gSyg1pVa6Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902959, "uuid": "52dbbb7b-888c-442a-aedc-f51f2dde03b4", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902959, "uuid": "5c0cf43c-d97c-434c-b1e6-2fd2ff3b5719", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902959, "uuid": "a6d819a9-a2a3-4763-838b-b0b24113a326", "value": "d6284280bebfc9eea3a3c32b0c0f3639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c61b22d-2996-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633848604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848604, "uuid": "0195f3a9-ee17-45b7-b3a6-094949a48b59", "comment": "Malware payload (Mirai)", "value": "abd15fbf63b4f5cead1e3f28b61f1143", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848604, "uuid": "30dbf0a0-6206-41a0-80af-b57984c06963", "comment": "Malware payload (Mirai)", "value": "61b079001d8cb2bda6a886941756213bacadda2b2d6bdca1bf3e35f7bc1984c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848604, "uuid": "e8e0ff8c-945d-4984-8936-c9616d8413b8", "comment": "Malware payload (Mirai)", "value": "4c75f358463ec00206e7503fc28b6fbd70147ed2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633848604, "uuid": "c6480922-4b0a-4df8-92c0-2a7301d3dc5a", "comment": "Malware payload (Mirai)", "value": "b3867d035e3c3b2db19b3bd2b9d98eb9b34ed690ae8fed2ffccaf430bfa1e245e1205701a86020cf6c7abc4f02dd7431", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848604, "uuid": "fd3cafcb-2917-4dda-bcc4-02e66e63b23d", "value": "T19513E1E1C2BC5F9CE82D5171499DA6D21067B0EF979889E5EBE0F0B41E99B2DDE00344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848604, "uuid": "932a809d-c154-484a-b9f8-b77c12f6e30c", "value": "768:vi5dFNml6o4YXMThtMQt09KqIeTIpV2OVn3oXvFTP8AWDd5RSFiXVnbcuyD7UHQB:6/Pmo2XMThtMFLIAIrXF4XdTPSpYQnoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633848604, "uuid": "ee17c07c-5634-49a5-b264-68c67a914d7d", "value": 42616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633848604, "uuid": "485e5799-f44d-4afc-97e4-148647fe5f9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633848604, "uuid": "a94cbc8f-34f7-4cd2-b8bc-a581810aa93b", "value": "x86-20211010-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd5851d-2973-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633833651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833651, "uuid": "2bfca774-b186-4789-94f5-53ab1eb4d924", "comment": "Malware payload (RedLineStealer)", "value": "4948487aef7eddb78e82323d3c3a8135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833651, "uuid": "3591ae17-ecaa-4910-aa9f-05cedc6208c4", "comment": "Malware payload (RedLineStealer)", "value": "62b9a227f035544237037d32dda4613226215ae67d18f344f5d1f7533ef726f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833651, "uuid": "f9293e50-7fe2-4707-999d-5763ec7007ff", "comment": "Malware payload (RedLineStealer)", "value": "e28eb53935bf9ee768c1509c44985af8fe070bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833651, "uuid": "34c909dc-0838-4939-9ca9-881a6616c820", "comment": "Malware payload (RedLineStealer)", "value": "95c0016d636958b115019badc663bb59719fa614c42c497a12713b8afbe35388f7adae097ab9695559eea3d8a78b249f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833651, "uuid": "9c1b8b61-fc81-4162-86d8-50eb0e8a4886", "value": "T1B4E4E1D0B690C034F2B626FBC5759E68A93A7EA1EB3590CF52C916EE16349D1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833651, "uuid": "4cb63e69-ace9-4996-a359-9f0c27e7cce3", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833651, "uuid": "0edd5dfb-2fb0-4536-a014-e8b4a022f742", "value": "12288:pzXUYAjlvkcW5xWT0a6UCM/k07YJeydtPvu/MNs1VsvuG3f5:pzXPoQxV4f7Yw+tPvu2scvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833651, "uuid": "c99fbf88-5e0d-496b-8be1-b9d6033fd242", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833651, "uuid": "5c1d9d57-a7aa-4b03-a40d-14fc236234c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833651, "uuid": "e8cb04a6-5b76-4446-99e2-f1bc16f70e33", "value": "SecuriteInfo.com.Ransom.Stop.Z5.24995.10621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d86dd52-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633877409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "c2d2c07c-b3c5-40f1-ada4-143e6bbba892", "comment": "Malware payload", "value": "eda791e62de5843c682c353c12716ddb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "f5113c27-8740-425e-b1e0-c5188578400b", "comment": "Malware payload", "value": "6360ad35587c2e472839a87a90f8134a701cef2fa91f8517056602ac71e52aa9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "0887abc6-bfb9-4e72-bcc5-7ac0684823ac", "comment": "Malware payload", "value": "6ffe4180467ea8ce21a12301787a95c8e3259d0d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "cf0bb32c-8980-40bf-b498-045dffddaf71", "comment": "Malware payload", "value": "cdb215114676fb173169e5b17b7d426aa0959e9be910d54ba7a3763c4583d3af7396d90b590d16484e42de0b3e6f2b43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "a94718bc-55da-4ad8-8b5f-4b60b81b30e6", "value": "T1F1C24105AF914EA7EC6FDD3384FD0B4630CD900A21A53B662934E828B35F59F49F3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "1e30ef01-3fb3-48c4-b1f7-31d1e0271abb", "value": "384:sQOxwgYdym95LCCGZjqzm2/S1CPeleo1eVFqIF6XiWEtYJ9DTD:9ndo6S4Peleo1en8XifmJ9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877409, "uuid": "727f02f8-4d3d-42b2-90de-298dbbe60faa", "value": 26872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877409, "uuid": "a382b577-355d-41bd-9e04-03cd49e46907", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "eb7c96af-05e2-4896-ac96-7d12ecc662f8", "value": "scorp.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42292499-29ba-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633864049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633864049, "uuid": "1f79af84-028d-4541-b4d0-39e1d563ab76", "comment": "Malware payload (DanaBot)", "value": "9ce4e1f3f1e2a963f5fc8a644f8a98f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633864049, "uuid": "7f12a969-b2ec-4073-9785-da213e04287c", "comment": "Malware payload (DanaBot)", "value": "64b608dd4724d90e85149b4b450fc86f7a258da04095e9e8cff77a7ee5645b29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633864049, "uuid": "82856765-4fa4-4612-9d02-044681e9d8e8", "comment": "Malware payload (DanaBot)", "value": "a1ca96540eb03755dbcf6ece3fbf31a96a5f1477", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633864049, "uuid": "026c578e-a3b0-4e01-9a62-b8938f1c28e2", "comment": "Malware payload (DanaBot)", "value": "0c3252bfb436372a84a6eeca5bac0845def2b08c60d861f5117820b51d5fcd34798b73090ac5f3e14aed2028caeea84e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633864049, "uuid": "237e13f8-a4db-4a49-9bef-314263d6f797", "value": "T1AB663317ECD2C0B3FAED8275C175A9680008F8271E22E8B67B9BEC52853555BCD1CA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633864049, "uuid": "af539e77-f039-416a-8cd6-a14f74288fe9", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633864049, "uuid": "90c0c1c7-738a-46a6-9cc3-b469d5b166ed", "value": "98304:EZwzFvmFN4m3Qui7BYvtSw7iD69hcj86yVvRHQKSOmnSRuduKANCsN0UOZbH59/D:Eq+HpiD8iD60jkfVSNSupANCsTebnbDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633864049, "uuid": "499fa1c1-7df7-46cc-a075-3eb4c46109ab", "value": 6480335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633864049, "uuid": "2ef94ec7-6983-4d93-8ac4-2dbffa485595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633864049, "uuid": "be61d81d-cedb-403d-b5d7-597bd01ccc4b", "value": "9ce4e1f3f1e2a963f5fc8a644f8a98f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97abe4dc-2991-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633846583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846583, "uuid": "c97af382-fbdf-483f-a57c-06c7205f1afa", "comment": "Malware payload", "value": "37206badf4c6e13f7830424a2e3e84c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846583, "uuid": "86900b56-2913-4b5a-9c71-fccbcc656bd3", "comment": "Malware payload", "value": "65bf761e7a7f7721792388dd53bd872c2d28d439e4c6434439df5bf96635a787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846583, "uuid": "ec303cb0-2205-4e6e-8a01-c9063b266e3b", "comment": "Malware payload", "value": "9b5f45a26e2e430e788562a21b06e24688243558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846583, "uuid": "20647d12-69d0-4784-8b3e-697ae65d3a9a", "comment": "Malware payload", "value": "c08ca877d870624ff47c5afaed3d819e79cff573be1bf7afbead90c5b803734aad49c81c14c2b16fc4529136396e2645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846583, "uuid": "d07bf0fa-553b-4143-a824-0cbcef379cd1", "value": "T192E2E1E3E7D187C0C6BD5475902FFD3A0998E28CB5EA89B75B8437B78290F0921A8715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846583, "uuid": "de6b0b24-0479-40c9-a741-900d2a5c6d6c", "value": "768:QyIuM3Lc1tCjtmSPI6QfSxDBY1T0B1Ki9VVDk/QLzS9FfU3pnnbcuyD7Uryqt:jm3Lc/Cjfya9BYV81Ki9HA/t/fU31noU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846583, "uuid": "519ca54e-2dba-4116-9eb6-54c13642d82d", "value": 34108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846583, "uuid": "c4ac6963-775d-4d9d-bb73-38cd5b8aae26", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846583, "uuid": "6af6a6f5-ef3a-47e6-a7ed-2ecb2d75463f", "value": "37206badf4c6e13f7830424a2e3e84c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36ae938-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633862521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862521, "uuid": "80189c26-1cff-4057-a899-bdb5226df0c7", "comment": "Malware payload", "value": "33641163d57d90da177bedcb17996382", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862521, "uuid": "78df1b03-aa9d-4e8f-98da-6d8f0e505352", "comment": "Malware payload", "value": "660b9d2bc1d97a6ea61382909bffdd09f19b16ab78c4bd0022aa590998f7e1f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862521, "uuid": "bf38f8c8-9a25-468f-82e1-e63eb161a7b5", "comment": "Malware payload", "value": "322ced153264b46f038f475e1dcd59480b2c3799", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862521, "uuid": "0c8c0cc9-7063-40c2-a398-f0f7b74c5ff6", "comment": "Malware payload", "value": "aa0de5fec349a6348713f02755f9a2072983003bfcd9f8cfe8ec638dfa6ddd9c0e77eb8e99b117d54e6d239af1cf40d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862521, "uuid": "616954e8-4ab9-4492-902d-da74203a6b7e", "value": "T1D77423059F800D87B5B4D697D05C0028FE25E2F4CF6AA46ADC9199CC1EEF247ABC7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862521, "uuid": "84912d80-6df7-4fce-9caf-6edde43d8958", "value": "384:g/XvYVwIzLRw5JmPXwO70Nh73PQPGPGPgPPKPd3JPgCeWKgkwf:fqN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862521, "uuid": "912ecc48-2dd4-4d72-9189-fcabf93d1a1f", "value": 362748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862521, "uuid": "e0eec3da-7238-48b3-b8e3-4337e182122e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862521, "uuid": "8054a8e3-7c90-46d4-b73d-d5b83078c3ed", "value": "K1N4M6H1Z8C.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3518b3-2a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906806, "uuid": "8762e77b-9378-4962-a8a7-a4ef452e26b0", "comment": "Malware payload (Mirai)", "value": "8b90cd36f393a40b3884bd73dfb2107b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906806, "uuid": "f0f1fbca-c4b3-4949-b0df-a43de56d9b99", "comment": "Malware payload (Mirai)", "value": "66e64ae534c8b14663454887ea28e8571e6d7b826dee7e16fe70f2edacb4d021", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906806, "uuid": "1a90e6da-9227-489f-9ce1-18721656f770", "comment": "Malware payload (Mirai)", "value": "35281f812c0940dbf4988c767f7a304148e77df3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906806, "uuid": "90019ab1-f797-438b-a4be-385c22c231ba", "comment": "Malware payload (Mirai)", "value": "8d37c710776fbfb6cbb7cc2a91620aa0703b4670de4395634cb95778f831f30435464709116676222ffb600763f32946", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906806, "uuid": "7060d343-8960-415d-958b-3b38765981e0", "value": "T121334BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906806, "uuid": "3d803ba0-8896-45e3-9f52-b60bae6cbfc5", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNJ6OQ6xpwhNbr/L:xZebkP/Ad39UMJRlhNkL6bIbDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906806, "uuid": "d0e3db3d-9b18-4ba3-9a5f-7e72fd56f023", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906806, "uuid": "aa0bddca-d244-42c3-9b51-b23ce26fd19e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906806, "uuid": "3b4ef1fc-3e62-4215-bd84-09df5da0166c", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa4a818-295f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633825247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633825247, "uuid": "30992395-7a0f-4b66-a923-ff9bf01daa3a", "comment": "Malware payload", "value": "2b7ad9fb71f0e2e7e1854c8824f2249a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633825247, "uuid": "492ac92d-5784-4c65-9238-13b981f3b966", "comment": "Malware payload", "value": "66f2ef9fdfb42bcaa00f7dda2da9a67e988714ea469bcab0daf7a58976c73e3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633825247, "uuid": "f765a441-3dad-4f9b-b245-baef398f5add", "comment": "Malware payload", "value": "888f92b7faacab567899a16ffbe81ab69a0b165e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633825247, "uuid": "17f63e28-fd8d-4a2d-807d-f4f90a8cb9d9", "comment": "Malware payload", "value": "1e31418ec9161145a6d92bb1abf5a6ca09c2b38639557fde17b849ec7b061d3b676c98d58a8a3d40068b9afa1d93b9cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633825247, "uuid": "20ca9a4c-3706-4874-bb80-25bc26344bfa", "value": "T1A913F1D7637FA9F2D48BA37E491A02D4BA537D0272138B6715A9711F06B7C368901BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633825247, "uuid": "b95479c9-8a2a-4023-98fa-d83cbd7e95fe", "value": "768:ghbuBfVst4gf7zNS/IdZHr26e+E4UBOvy6F2GrH3ikVBGWJDrNx0qGaz3a5Y:JVqDaoHBE4UTG73bhJdLjzIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633825247, "uuid": "6a516b85-1e94-4a55-92bb-c61f2c8bbc17", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633825247, "uuid": "7b28cc5c-75e9-4a8e-b767-3cfc7b701f2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633825247, "uuid": "d2b9ae58-c3d8-43d2-8c4f-31cc9f5ac20f", "value": "K0X.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca253b20-2a24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633909804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "d566bbd1-9a1e-4a6c-bbc8-3c0eb0576c3e", "comment": "Malware payload", "value": "503b038799709d868f4a59ee020068f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "b7e78300-299d-48d0-9783-c7d1288dbd45", "comment": "Malware payload", "value": "69fca444f2839e9f798e289f5b1380f9d8f18f8e01ecba375c7ff885d4e886f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "036c611a-ffbe-4ab8-ae6f-a79674e325b8", "comment": "Malware payload", "value": "7658c9540e0e4474dadad9da2c6aae6500a1847b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633909804, "uuid": "5cb623b9-ea33-4ba8-ad41-be72f8060f6a", "comment": "Malware payload", "value": "d30b6481449fa4fba8bcd8d8c9110ce8df87fde61b215a3b332adf98892a3d7e6cfca043d5ccaf3a422756133f68ece8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "c89b8faa-8c32-4691-8e01-575098599341", "value": "T1F353025385855570ECE3383A7361575A23DB16AEA5BEF0F50B9BC101B2B3611086C39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "977a831a-fe1e-4b79-a4fe-0641e1df68c6", "value": "1536:DwLv4v+kT8aaUYiP/mDW8Ern8WoQlgtrVo0p9eYGGJK0Nfbvq02:DQ4zghUYiPuwr8SlAot3ErqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633909804, "uuid": "c8b9c3d8-3d01-40bf-9e52-5f246a860853", "value": 64660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633909804, "uuid": "414d4cf7-4d60-4082-b66b-39f04fdecd41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633909804, "uuid": "310b902e-58ac-477b-8652-7ccb4102537b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa89df8a-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873673, "uuid": "67d2207a-1689-46ea-994f-66403e67ed3f", "comment": "Malware payload (Mirai)", "value": "ac2b2bee40853f37f8d8359cc9c03d30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873673, "uuid": "572b78aa-bd34-4463-a49e-0d485149d752", "comment": "Malware payload (Mirai)", "value": "6a0b27895a9e5c395289e7e4f916fdc5a932eef4e5c38da2ea1be7e312ae1c95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873673, "uuid": "c750cab7-fe9b-4dfe-8aac-06c9ecbda0be", "comment": "Malware payload (Mirai)", "value": "8c207195dcd5b0d18d148762f1fa657d20fb3487", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873673, "uuid": "e7e476b4-c0ee-45bd-992e-e089464bcac3", "comment": "Malware payload (Mirai)", "value": "1f333a709c52fb36ddaf2c07e9471b1142db450092af0c90ef7ce8e3508f3f7ee20b934294fa58333483b535091fd9a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873673, "uuid": "cb801961-e3c9-4126-bb93-03dfac64c99a", "value": "T1A2333ADAB902AD7DF98BEABE80170E0AB23123541053073777EBFC937E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873673, "uuid": "15dbfb90-eb09-4d99-bb8e-2fce30510148", "value": "768:mLGOe2kf9e9X9nberzI2vcv/QP3w5gFHviPuzWeHXpi2UJTMDnH638gi:mL/4f8F1eB0ApFvimzpZi2UJanHY8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873673, "uuid": "b939c37b-bb91-47b0-9f09-af2692450379", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873673, "uuid": "06e9e5e2-db2c-407b-b447-5480c0bd5a37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873673, "uuid": "a38fec83-6b21-4c29-a0ce-e4784e42267a", "value": "ac2b2bee40853f37f8d8359cc9c03d30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aab0347-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866721, "uuid": "1cafcec9-45dd-4247-a663-e0072bce1ec8", "comment": "Malware payload (RedLineStealer)", "value": "98cab24317014d3cd4181cc642bd3add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866721, "uuid": "8db34ba5-4bf9-4046-a6fe-3fe49c11ca46", "comment": "Malware payload (RedLineStealer)", "value": "6ac8bb213bf104bcca23ebeb4c44acea64ddb334f655b956f318e809fd533974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866721, "uuid": "88f54ce6-c4bc-42c0-b8c0-16199b28d26d", "comment": "Malware payload (RedLineStealer)", "value": "ef2bc218cb6d87137f61622fd19bfead084d962e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866721, "uuid": "d09edfd4-7441-46c2-8e25-df90bd72b865", "comment": "Malware payload (RedLineStealer)", "value": "db7e6329f67950a1fec96d6cec2533ad0e5718613bf6070e1d8380c6013590329bf29970e5bf9fb3cb4e7f3435ff4379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866721, "uuid": "a605c346-827c-4a66-a9cc-db788397fb16", "value": "T104E4E01077A0C030F6B626F44A7A9268E93E7DA16B2892DF52C12EDE57356E0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866721, "uuid": "93b4a310-392e-4eec-89b6-d4549dfb0fd7", "value": "d65c67dd6f4a95898a66b39f504dd200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866721, "uuid": "493c82e5-feef-455f-bb25-670dae305ed2", "value": "12288:U9nMPXHy6o/qomTiOyoSU322RPizA/2Jsr1mHiCTg2ytsEpEqUfVAGVKWPCGLc8:UdMPXeqomOOzjClo2tEWqsATWP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866721, "uuid": "837002b3-96dd-4790-9831-4668b17144ee", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866721, "uuid": "69270e71-4982-4396-80ec-6b2b886352af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866721, "uuid": "eedd638c-237f-4d88-a1f4-018f4242aa95", "value": "98cab24317014d3cd4181cc642bd3add.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5fc4f3-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884821, "uuid": "cdde8d1d-230c-4721-a9b0-6dd20e722930", "comment": "Malware payload", "value": "af58c711015282dddc3bbff39e21dfd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884821, "uuid": "235e4c89-4353-4adb-8ac1-b4bba7136fca", "comment": "Malware payload", "value": "6b3fd59f99642c850b08c7cab71d1e8fd74f359849673d685502bc9fd19c2ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884821, "uuid": "62f314e3-f2f0-41cc-b418-840cd8692679", "comment": "Malware payload", "value": "bbe823c918ded7ca4c2c90f1aa86e3d50cb6acdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884821, "uuid": "b3c131c2-5003-4c70-bf61-2b73304eede5", "comment": "Malware payload", "value": "0aa6a61c1dfb6a9437228064138bd83b35c8fb2cb530321aed20f2bfecaf6faee156b549a6f7045ba2f1130e2bd35531", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884821, "uuid": "7d09a815-dc23-49ca-bf1c-721afa85b9c2", "value": "T1E653023E1E25C751964EC9F5297EDC846CA6B61EE230D3B2A0786726ECC3B244F25371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884821, "uuid": "61268358-c865-4a3a-92d9-19378876a4b8", "value": "1536:mmDSB5YFtHm5NZ+7FHgPNRPC8QR6hrbexM5Qnouy8bqQo40atV:3DmSFZz9gPNR6sbexMaoutWV40ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884821, "uuid": "90b08ffd-53cd-4be5-a5e7-eddd70a49195", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884821, "uuid": "1b287b27-7983-4ef8-810f-dd00a1ca19d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884821, "uuid": "00d12947-5351-4d4f-a92a-4d27f2cda605", "value": "af58c711015282dddc3bbff39e21dfd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c793b99-296e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831371, "uuid": "24561c25-8721-4068-a5dd-794d05ed60f8", "comment": "Malware payload", "value": "fccfc053b3d05ea5da05d298d941dd93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831371, "uuid": "1e1fdbbe-8718-4395-9cbd-391accbc2621", "comment": "Malware payload", "value": "6ce224c8c2a6be4489674af8f39bbc5e30b4c7b04ffd6509b5ad6e5171a3fb10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831371, "uuid": "1de0a42e-fccb-4ae5-9771-40a33a9935f5", "comment": "Malware payload", "value": "39887449206c62529069124008cc1dd221874460", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831371, "uuid": "35fcdf85-c109-4f07-bd19-42e2d6496ce5", "comment": "Malware payload", "value": "90dc67846c13d892cc1df7355d2ede6694481e0c3df9c37d08582ab82d41e0d09fc33e4909ccd2e0db3af867893b5fb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831371, "uuid": "8eb37f97-3429-4540-9220-ad6efbd785a9", "value": "T17003F942AD41CB17C1D32BBAB6DF87AC3B2579059BAB33017A2D7DB41B477DC2618214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831371, "uuid": "b1025181-b45d-4590-bd9f-5c3d1dc9dc0c", "value": "768:83HO2yd1Dpc5+c5d2W24j67/dv02JQngCrIep9AzlGQ:4HbyhgX2T4eLOeQn/np9AoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831371, "uuid": "433fb0ec-4719-4070-ab45-0b7339ec3424", "value": 39859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831371, "uuid": "e701933b-9214-4154-b40c-76654f0077dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831371, "uuid": "30ac91a8-72a1-49a1-9730-a54f0acef4cf", "value": "fccfc053b3d05ea5da05d298d941dd93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4dd301-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853246, "uuid": "6ba86aa9-4b9a-4de4-99ac-8a92b5ade4a7", "comment": "Malware payload (Gafgyt)", "value": "cd765cb2eaa569fbbdb3d9b6cab5f122", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853246, "uuid": "ab1eb059-3afb-4c3a-82e7-6c13aab7cb7d", "comment": "Malware payload (Gafgyt)", "value": "6e29c9f8966644eee5b8b16b48e8d3763476daf3442c8af1cf69afb0f4b90acd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853246, "uuid": "1cab7fb8-ce39-4481-9dea-db42458e7720", "comment": "Malware payload (Gafgyt)", "value": "17b8eaf1395343d8f7ebe5274f966d0a1302fcdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853246, "uuid": "c2b9f260-c42c-4655-a4e4-6c4900561be6", "comment": "Malware payload (Gafgyt)", "value": "719731c99b5c278bb7381d36be8d68eab416fb8211b0cf772b449aa83cd16a6c51a24febd4a515aaeafb1ff8368bdac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853246, "uuid": "ac4600f3-9a2d-44ff-875e-e7842d5a7217", "value": "T18DC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853246, "uuid": "735cd597-8a0b-4d58-99e5-818f97a891bb", "value": "3072:4jDy/+mh1vtbPIKaBbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaBbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853246, "uuid": "dfa48589-d007-4186-a887-cacaf54ba2b8", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853246, "uuid": "270f2d04-e6a4-45e1-bc01-91b02a5353e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853246, "uuid": "cce52def-f8ac-4fbf-acc2-61dc3fcee39d", "value": "cd765cb2eaa569fbbdb3d9b6cab5f122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f42598a-2987-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842247, "uuid": "4ca67d2e-faf0-4ed2-9397-47a77235c9a4", "comment": "Malware payload (Gafgyt)", "value": "710e1274462da42532ca162d8bac09ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842247, "uuid": "f63c22b4-6fa6-404e-8a01-0d2eb29c78f7", "comment": "Malware payload (Gafgyt)", "value": "6fabbebf44a026d14cc4da53ecaa7f79895fa5cf81329d6df57202c7a9cc9b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842247, "uuid": "9f7a4f09-bcef-455c-90e6-3e75f439b821", "comment": "Malware payload (Gafgyt)", "value": "b4f518dfb8bade061aada2f8b8f3caf43748057f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842247, "uuid": "acc89eb3-bcd0-4b74-8252-2895f673e3d1", "comment": "Malware payload (Gafgyt)", "value": "acc145babca51835826473c2c9b471f935ae51cb01d9d0d48b2c087a332aa53a167179f88575a6247bf0ed105fe48c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842247, "uuid": "6e0d200c-a682-4eab-81e9-a214376e06da", "value": "T197933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842247, "uuid": "3a366183-f9b8-40aa-bbae-399e21110029", "value": "1536:jW6Jk7jWNEqi+thy5ct1NNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+Nqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842247, "uuid": "f4e0de96-f70e-4288-a9e6-dcdc4a325664", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842247, "uuid": "46a0a2f2-1c19-4437-a925-900e40415469", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842247, "uuid": "25edbff8-890f-4541-9c0d-300f323cec45", "value": "710e1274462da42532ca162d8bac09ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def601d0-2990-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633846273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846273, "uuid": "2aff46f7-a349-4593-a76b-20a22525c852", "comment": "Malware payload", "value": "8cd5b4f7f55459f2b8bc0a04e1b6cb62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846273, "uuid": "991fd053-70fc-42c5-923a-4b4c5e02b42d", "comment": "Malware payload", "value": "7065028e5a7a227c0cca9843529579d0bc8565c4f354a77de8e644703c978fc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846273, "uuid": "924f324f-ff89-4e45-a762-652bcd621f60", "comment": "Malware payload", "value": "bbbda22b53c3c1a18852d708059297afb7c99370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846273, "uuid": "92ed4c24-5598-4d40-a66c-039df8ef73cf", "comment": "Malware payload", "value": "f543cb54e7ae0360d50612e22fc5c655b1ffe88c7e878ba315fe95167bee27bd6d381488c29133008d9ff092a64dc928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846273, "uuid": "1caf6735-1540-4e0e-85f7-193ed85de31e", "value": "T10713E11951C49364FAA01C77AE31051D6B43A5F3DC3FA67B3204DEA9E2D2E67C99C40B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846273, "uuid": "70827ef9-054c-4feb-9c61-0510a467518f", "value": "768:qdAbVhKbDwOehgy58Gn39RNRN/SXAjUtOfEaJD+NpBq3U7qJ:qGibgUGn39LAtOfEqIpVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846273, "uuid": "59881aba-d9fc-467b-834b-594bb6e13471", "value": 42488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846273, "uuid": "a402312b-1123-4ade-a064-1b7e9f8455ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846273, "uuid": "bfea10e7-e3ef-411e-a740-d4f2ddfd7a79", "value": "8cd5b4f7f55459f2b8bc0a04e1b6cb62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf6f611-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884550, "uuid": "b06f2fd0-46bf-4c5b-bf34-fd6d45cb5cce", "comment": "Malware payload", "value": "7b579b373442e5ef467e3aab0ece88ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884550, "uuid": "832b95be-95d6-4139-95f4-b516414cde1f", "comment": "Malware payload", "value": "70775458c7d8c1318834c654a3b5e1eebcf5b1b7e1f63ec2be06494100baec9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884550, "uuid": "9b4c41e3-9b6f-47af-abdb-35e8784d3cb6", "comment": "Malware payload", "value": "2ad698404e5b0a91115e1f713ecf53d345e71fdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884550, "uuid": "444431b3-6776-475d-a948-2453690f5eb7", "comment": "Malware payload", "value": "3a674063d487f57276e736e03165bf5c68bce4790269164bb1937902d1c6d3571c38dd161f413bd8f3fbcfc9a73c752f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884550, "uuid": "cb3e946b-ef3e-4588-885d-d927e59d1185", "value": "T159B318277B274E63C0CA157112E30332A7B5DF4938BA5387A9A07DAC6F37A8434167D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884550, "uuid": "3c4eef4f-1f45-417f-8da2-25ebf87b73df", "value": "3072:YuHrTHNPDeJea2gRLhpmm/N5bNs1n29NH:YuHvlDKt/mm/N5bNs1n29NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884550, "uuid": "0ab3830c-99ae-4f2e-ba83-10594603045e", "value": 109920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884550, "uuid": "d9068d9b-f898-4c7a-b311-a469945affb2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884550, "uuid": "d0b565e2-430a-42ee-b2dc-04a4c0ad7665", "value": "7b579b373442e5ef467e3aab0ece88ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b5a6c5-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843174, "uuid": "43f0f393-4f10-425a-b362-5f11e47f0531", "comment": "Malware payload (Gafgyt)", "value": "d00babe6797beaabaab53d990d35e8e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843174, "uuid": "bc5c8b37-3aed-4326-8408-0b693a58d8b3", "comment": "Malware payload (Gafgyt)", "value": "71ad631524ab42265a077cabd00969aa0016ded195d6aa7257ba1977d9ab7c4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843174, "uuid": "c72b1c16-4e3e-4090-a5e1-6cf2ef6b8734", "comment": "Malware payload (Gafgyt)", "value": "194fa9aa50cb93c87ac19a794d4be5296210d08d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843174, "uuid": "8c6e7ef3-13c6-4049-9d32-627924c1cad3", "comment": "Malware payload (Gafgyt)", "value": "fb2aea77cc5e01e5a0b61799f361638684c0a4de162d2ec3bc22114d7476db33cd73a0d698d5963c4ab583d4a87d5ba4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843174, "uuid": "e49880bf-ce0a-4d40-8d4a-d08ffd2834c9", "value": "T1C1C3F82BBB270B23C0C6007116D71B32BEB5D3D935FA52976AE06DAC6F165843416FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843174, "uuid": "c9eb9fa4-db2b-47a0-94fd-fb59bcb8627f", "value": "3072:o3GN8mgKqz7FhTORcNcmKYFV/esFLfpZe:oW+ZPFhTORIcmKYFV/XFLfpZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843174, "uuid": "6ea5f773-f56d-49c9-bbbb-03d7ebbd3793", "value": 125918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843174, "uuid": "0643f6cf-c5a7-43df-92e3-e697500b990c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843174, "uuid": "b7b47bef-ec91-41e5-9325-4298600b81eb", "value": "d00babe6797beaabaab53d990d35e8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b146ab33-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842760, "uuid": "5634507e-6859-43c1-8dfe-05f52614fb7b", "comment": "Malware payload (Gafgyt)", "value": "b2dad52acde3173a02fceb072d3072a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842760, "uuid": "d6ebf1cf-8a01-4f2f-9f25-3d594003955a", "comment": "Malware payload (Gafgyt)", "value": "72045b636df2dc60b79d09182976a85d163da93e125f0e4176be560e42aa7f05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842760, "uuid": "55b968a6-2316-4f68-bf18-e99c3d4b0c06", "comment": "Malware payload (Gafgyt)", "value": "bd59958957b5b6c60274a715e0deeb9aa0aef2ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842760, "uuid": "3a7ac461-634f-4b19-84f4-d394537e1d78", "comment": "Malware payload (Gafgyt)", "value": "5841ab609d7bca8093422c9cfd7499fba4f96403b4379928552a1f470908247990eaa1793707045fe18c5fb99562ce82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842760, "uuid": "e464c935-11a4-4b24-9ead-d653a693794a", "value": "T160E3926ABB618EB7D84FCE73069A4902148C95C653D97FABB2B0C56CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842760, "uuid": "d29b880f-941b-4e4d-b774-5c4e5c816a92", "value": "1536:P0/eTNRsHrRDjMcZkHNc1PYeH/Qs19FhWW+sPFUmkV0ZF01TDtM2ke:P0Hjn7bH/hFhWkFUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842760, "uuid": "0b956f22-0dc7-4653-a32c-050fe30a1bc5", "value": 147022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842760, "uuid": "2bc9dbd7-2fc1-467b-8a47-17027a6ea49e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842760, "uuid": "95af72bf-1232-4774-b6f0-090daf4333ef", "value": "b2dad52acde3173a02fceb072d3072a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f7eded-29db-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633878145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878145, "uuid": "9b023af9-c7d8-4599-a53a-e07a829743ce", "comment": "Malware payload", "value": "7914510e6ff76a96b3e40b19318e1d32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878145, "uuid": "258ebcaa-5fae-4027-8b64-dc1b8247701e", "comment": "Malware payload", "value": "72c4d8867a04bf45963c4de8a847c6b53ecda8f3b39a417faf1cf04700561e20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878145, "uuid": "82f91175-8066-4d3e-a0a6-f7b29b37bc8d", "comment": "Malware payload", "value": "47626f5e5b2f11b2d34e186f7b4716817874f6f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878145, "uuid": "c6bc085d-31a9-4605-a920-ec5af608a6ea", "comment": "Malware payload", "value": "962e5ca6b1ae3ec10627bbef3f10befe03c13719f1de32f41ad5ef079115693ee26cfa83fbeb6d53a5e301c9e8930179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878145, "uuid": "9f8e5563-a7f4-4da9-97c4-ff98c3918446", "value": "T1D9D5F13FF268A53EC46A1B3245B39250997BBA60781A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878145, "uuid": "10e6a44e-4cde-4f93-bbf8-3842a4c9b519", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878145, "uuid": "3b188093-917b-4d8f-9824-a5005f128c55", "value": "49152:tqe3f6oeEyO/MPTqoPQ3u2zhq6joknuSffPMWrQ0Zkv:8SitW/MPTZPYkkDnPcMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633878145, "uuid": "be81cc4a-6bdd-4b7c-9df1-9e51ddf60b14", "value": 2966979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633878145, "uuid": "c52bbf6e-40e2-41d5-90be-338693d5b2db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878145, "uuid": "0d2b554f-e6d7-43c7-8eac-9dfdf2a27e79", "value": "7914510e6ff76a96b3e40b19318e1d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb05151-29e2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633881137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881137, "uuid": "d30be3cc-d553-49d2-bcee-4878def10bca", "comment": "Malware payload (Mirai)", "value": "f09d3ba0e5664e66fc3054c2d639a583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881137, "uuid": "fc72f8d9-7571-4f8f-9fa7-ed475081b991", "comment": "Malware payload (Mirai)", "value": "7374fe5dc2015da399b930c0afbe719d8518f8111b859aa34f9d6a72ec585edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881137, "uuid": "7d179567-f647-4c1b-9567-26450bc5238d", "comment": "Malware payload (Mirai)", "value": "08bd6777c11741414daeb774dc8169fcd322f298", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881137, "uuid": "1b40f797-aa8d-4af4-8d28-a7c417ed139b", "comment": "Malware payload (Mirai)", "value": "079e230be6a4cf63db832acf323e0873dddfa866a8bc34cec0ee44259d29581b0c227945172d383a3c34bf70f1410d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881137, "uuid": "92738f4d-bd51-4246-a9e4-9adf1dfc9b3d", "value": "T1E1A2D134995AACE0E3609933AD3807872AB713B493B5F1320B25069AD9D990317B5BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881137, "uuid": "adf9fe98-24b8-401a-8fb0-9721e0b7be9a", "value": "384:vnBBjVs4tiGjCjmnDlUljvzEYA9KeijLhymdGUop5hXZ:vre4sHCnDkjbGifs3UozJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633881137, "uuid": "0da1c8f1-8bb6-44ee-aef5-967effde90cf", "value": 21604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633881137, "uuid": "0d8712e7-84ba-4683-8859-254f0210a630", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881137, "uuid": "f0a66244-c359-43ac-bd10-19a353fa38ea", "value": "f09d3ba0e5664e66fc3054c2d639a583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a668fce2-2a0b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899006, "uuid": "0ae0e3d2-f29d-4c16-87e4-88fe13725ec3", "comment": "Malware payload (Mirai)", "value": "56dee9827bbec73308012e03e3eb0b13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899006, "uuid": "ff23af5b-3a4f-477d-8c57-c2f132515759", "comment": "Malware payload (Mirai)", "value": "739cad59e8e31ef90719589c3abf75e9fedee1cd38d51d7dd3b1b14668a803f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899006, "uuid": "f473d27b-65fa-4598-9f35-e444014548e5", "comment": "Malware payload (Mirai)", "value": "bb140e73ab6c1473be95fb9bf9cc0281361e973a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899006, "uuid": "83af378f-803f-43ff-b9c3-1a579b12c982", "comment": "Malware payload (Mirai)", "value": "64024fc33eb8fd5751088fe9cc5ab45c2d979cb5d8a0d4c12a55850e2a6b4df2df305151ec412c2f2bd2205f9b4f4019", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899006, "uuid": "91091d1f-2084-402b-bac4-2dc56b171da1", "value": "T1F8132AC4A983ECF5DD1506B571B7EF728676F47B2159ED83C398D432EC42A02A60B28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899006, "uuid": "f9839642-9eff-4234-9d34-012015593e7a", "value": "768:ztlsnYOMd4C2U0spoobSc7oHTbXRbEr6ReDcoMf6hIfWGLcxQrrCuws9b:ztlsnYOMdx2U03O7of2gSNefWGLwQrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899006, "uuid": "c3f43ff2-331c-467c-b5ad-49074bb5db63", "value": 41936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899006, "uuid": "c2a8a032-6940-44a9-b9dd-149ca25e96e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899006, "uuid": "0f9094b2-3b00-4bd5-8dec-7dba577aff85", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2e86ae-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633877407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "f351faaf-24ab-4a11-b17c-a1989bf42f73", "comment": "Malware payload", "value": "84911e219d8a497e40f1daccdfc84b0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "40cb3ec0-7928-410c-b753-245c7d6d36b7", "comment": "Malware payload", "value": "73b49e6de2c2339674a7b7f2a9692085acbddc616fd2bdff04de8db3b46f8076", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "2ed914ae-ebe6-40f1-a0f0-8bd1108bb4ea", "comment": "Malware payload", "value": "2e8830699bda108b3d06cd754c2267dacfce9991", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877407, "uuid": "50b832c4-bc82-48ba-9d67-6996b1d8382e", "comment": "Malware payload", "value": "24c32d598cbe5f62ad121c55b020dbc0314228a1598085c43d471bad9017b793d07c9829336a7a5967cb2bfa40a52425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "02046ae4-1189-4475-a2ef-41ce89389115", "value": "T1CA731B5BE7408E47C0A117396AEB82053333DB5097D76306562CABF43F467EC9E63A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "af36eed6-60c7-474c-9001-79209dd9a77c", "value": "1536:CalnEG6w+PGRzeQYieTGIFeliViOksZToAzH0zw/9uZ2c2:Cu6w+95ieTGIFeLSZTLzUM/9uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877407, "uuid": "f771d625-1b3b-4f05-8555-c0109d8b8c17", "value": 74417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877407, "uuid": "5dec02bc-dc86-477c-a425-6154b424efd4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877407, "uuid": "2f39846a-a02c-495e-ba24-ced2e7661742", "value": "scorp.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d34c47-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873806, "uuid": "a95fe334-e19e-444e-97bf-a8d138e6ed20", "comment": "Malware payload (Mirai)", "value": "f876edfc5f8bc2c805459053cde8e5e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873806, "uuid": "ca369cb8-fd21-4080-a68c-770bb2e5ef31", "comment": "Malware payload (Mirai)", "value": "7421df23c004f41ef51d8f651de6c0e32ffe69f8c1bbd114845400ae4a6b6e24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873806, "uuid": "155d008d-7d22-417f-801d-2463f5e60225", "comment": "Malware payload (Mirai)", "value": "b985673430ea2cdda45ae4bb4ab46a1a3178ae94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873806, "uuid": "c8a6d27f-6831-4722-aba7-57cb48e22798", "comment": "Malware payload (Mirai)", "value": "d190808b4138cc5b75e13b4b3389755f8dbbe18c4a950ae41a72c1db86ad5278214f76222845798202c0c3281c1c5960", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873806, "uuid": "36f9ce6a-1a34-4880-a134-db67ebe36044", "value": "T146D2E1693D476CB0CB101C77DD78868C3EC566B497E6363A14C0827C0F1A8C635BAADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873806, "uuid": "978d5192-2a10-4de4-baa3-8a4ff0ab8441", "value": "768:jJj09dy2kPlqjX+xBjj+eAoahvGX1Gs3Uoz3:peoAZGX1rz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873806, "uuid": "f58d7e59-502a-4907-a69c-daba81390ad2", "value": 30552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873806, "uuid": "a1d733bf-27af-4a70-bd70-8efe0a0da6ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873806, "uuid": "492865ba-2939-4dd6-922b-a6e0092a04a2", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c32d251-29a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633852979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852979, "uuid": "2d93e1d1-9a94-40b3-b1d5-df7a8174009f", "comment": "Malware payload (Gafgyt)", "value": "c1bdb2b49bb94697ce7e879e3dd7a767", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852979, "uuid": "c3060fe7-76b6-478c-aa19-f168e18f6627", "comment": "Malware payload (Gafgyt)", "value": "744e8cd2b9fa4349bd2c967c4243da06928e12974d5286621ff1be1aa0833d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852979, "uuid": "ef8d2eb8-551a-4deb-90bd-3329206f9993", "comment": "Malware payload (Gafgyt)", "value": "438126429e799245c614f1e76f03335578973ced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852979, "uuid": "7dd65a17-77ac-464a-9868-c601a06f2764", "comment": "Malware payload (Gafgyt)", "value": "5be505e3f5c9a7c630919d5ba9150ea0822ce8e572fe90b3a75f175b9e24e5fa603312864c4fe2c78cb91af3114e96a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852979, "uuid": "ad447c15-7a7d-4268-8b7e-5becf68d8ab3", "value": "T172B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852979, "uuid": "e8b6a616-32bb-4397-bfc7-3960dc1906b7", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZAoamm/QcuLB1niDNb:YuFX0GIk1MHyphZamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852979, "uuid": "351707ad-8b95-4a6f-83c6-b514b4d0de04", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852979, "uuid": "1de06917-f817-4fe3-bcd9-a67d4b639ce4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852979, "uuid": "4c4a6d6a-2e61-48d8-a9cd-564e99f21cda", "value": "c1bdb2b49bb94697ce7e879e3dd7a767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a2806-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842756, "uuid": "94fa14fa-854c-422c-8d43-3de5cfdecae4", "comment": "Malware payload (Gafgyt)", "value": "b0164817d332171beaf061ee73baca50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842756, "uuid": "e44c701e-2e69-4e72-95ec-00bcce651195", "comment": "Malware payload (Gafgyt)", "value": "7455e99dbcc38bc3fd1287be76ca411ca98368fdc13a16e3a76b26a24a96d257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842756, "uuid": "07fa3fdb-7586-4c6b-8c75-30c21c51249f", "comment": "Malware payload (Gafgyt)", "value": "7ce75ed22867e53cf997108d78f91874f7bfe75c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842756, "uuid": "2b5a15fa-ebd0-49b3-bcb6-1555b5b69d89", "comment": "Malware payload (Gafgyt)", "value": "d32d7d4ed93d6930cb425e34c7bc82c6a990f8dd21e89d39d790754d63b00e1b1dbf65fed7b513187aa608b65b84132a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842756, "uuid": "798d2024-58be-4679-884a-7452b4b6edec", "value": "T188B31845F9408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842756, "uuid": "9032b577-9f74-4efe-9d55-d3e940ac1aec", "value": "3072:MSk+U6m1qW/w8tlPbiRq6AmkZrQAhPDCXFke:U6mgW/1tlPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842756, "uuid": "c92c3f41-aa05-404b-95cc-5b230f92a7c8", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842756, "uuid": "e59ac1fb-e31a-4705-9684-cf342f9e35f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842756, "uuid": "8c17155f-b042-470a-8afb-247f9ad281e8", "value": "b0164817d332171beaf061ee73baca50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bc775a-2992-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633846848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846848, "uuid": "6b8c087e-cc3b-4aa1-997b-e28b873e1a89", "comment": "Malware payload", "value": "1a8bd4035dc589b687ed2295497594e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846848, "uuid": "bb39db52-c3d5-4cf3-a834-6e5d50230b70", "comment": "Malware payload", "value": "74741d1d13fa5fc1247e65ca7ca4e06c0f7983405bf6445d114bd996bab81acc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846848, "uuid": "ce8a3175-5224-4b47-ae96-3239c36bf423", "comment": "Malware payload", "value": "fa1e4ff44bdc9eab24f0a25de250e1db6ca22c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846848, "uuid": "631e2dc8-926d-4f12-9bca-95ef0903fcbe", "comment": "Malware payload", "value": "ee658638e37c976647f3f6eeaa9bdb02a9d0238ddda340af24ee4441f5e52b24fa4bc068e668f500e75761209c904cb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846848, "uuid": "2a6c86c9-cf36-47a0-9c02-2266d4797a69", "value": "T13EE2E02300B1578CE5D7307808AEBE194E6D331E45518DBA8FE433B794A2B607678727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846848, "uuid": "d1ad3a7a-ccd5-4e9e-bc37-d055d970a9cb", "value": "768:NyIuM3LXhwY2Xylm9lohk1pzgbo/YK3ZvuxyGlJNjkHPnbcuyD7UryqY:Qm3LRZSyOCC8UQKJcyCJtkvnouy8mqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846848, "uuid": "fc81dec5-6cbd-4f38-861a-a296f80f1920", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846848, "uuid": "4687fd15-969b-4e3f-8e05-85adc4f2bb73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846848, "uuid": "dced42e2-c9ce-44f9-bdf7-93bfe9e9d50d", "value": "1a8bd4035dc589b687ed2295497594e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46351c1-29c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870710, "uuid": "fc790b66-8820-4b2a-b3fb-49978f7c1db0", "comment": "Malware payload (Mirai)", "value": "782e52612fbce35ee381842ded95d057", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870710, "uuid": "9289bffc-77d2-42da-b340-48213d6cd326", "comment": "Malware payload (Mirai)", "value": "75a9ba1af1dcf48017749e21cc59615e34b929e9e04e387cba798ba39a850696", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870710, "uuid": "631d9e16-4702-43be-946a-d6904e8b9f3d", "comment": "Malware payload (Mirai)", "value": "858098c7eb7decd3c16fe0121a24a80392037230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870710, "uuid": "328e7276-3b9c-4f70-817f-bebc102aa3da", "comment": "Malware payload (Mirai)", "value": "bb7b79bd41205f8036b218b34df7efce361e9e00926de78220b1acb9683a0ad568f171628eeb23a09cac1eabb2c0c964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870710, "uuid": "cc289056-0664-48b1-80b4-db169129dabb", "value": "T161630856BC918F01C5C412BAFA1E118D331357A8E2EEB3279E146F6077CB92F0E7A456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870710, "uuid": "3b1b6b26-9c95-4267-ba01-a20179b3a49e", "value": "1536:I4nONFgdr1N/AJUcR+A+GsW2/9LeA+y1cPIiiIr6NVEd88:iNF4/2UcRXUz914r6NVEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870710, "uuid": "c3ed45f7-6b68-4ab4-9a77-cf6f82a5c9a4", "value": 66992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870710, "uuid": "82decbca-29d7-42f0-ad67-d3c4d80f9a06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870710, "uuid": "d9220555-44ee-4e41-a8c9-100de75eeed0", "value": "782e52612fbce35ee381842ded95d057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee27c71-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899987, "uuid": "1863d394-6541-43ad-9ecd-690ef084d6f7", "comment": "Malware payload", "value": "60310d0cae80435c0a6f93574debc50d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899987, "uuid": "8f6d0977-11d8-4386-9785-4a0a9f182e44", "comment": "Malware payload", "value": "7779416f79a63967739defd0a4f3210ee5b217951a368f5d24e8fd950ba7a4c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899987, "uuid": "b15dbfa1-977e-4c7d-bd11-a0180dc73a6e", "comment": "Malware payload", "value": "15f38e68c4fd0f8c9262ccf0c907d7e0dc2c5434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899987, "uuid": "288d5457-a8fb-4151-bb17-0cbeb4f71faf", "comment": "Malware payload", "value": "2d0a4d3bd1c2a430a8404b50e8db44aa7795a1dbf4a6f5f3ac2f0033b6ccc3fbfa4676c5fd05b5c8c0fc4dc1fadfc7fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899987, "uuid": "ce59ea5a-96e1-4026-aa7d-4759424ead97", "value": "T163833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899987, "uuid": "68155d14-f2a6-4f1b-a647-853ea49fa0d7", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCidojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JlBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899987, "uuid": "703fe96a-cdca-4790-b9c3-a11319765c95", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899987, "uuid": "3f586afd-5145-4d7e-99aa-63272834890c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899987, "uuid": "89cce116-4052-44b0-b137-64aa118958b9", "value": "60310d0cae80435c0a6f93574debc50d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e3445d-2990-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846280, "uuid": "65eb0d7b-82e1-4db7-b540-e4fbadbcd76b", "comment": "Malware payload (Gafgyt)", "value": "604a9808c94c7b7d2ba310b63337e851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846280, "uuid": "78f15151-159f-4d36-b59c-24ca959ff7c7", "comment": "Malware payload (Gafgyt)", "value": "77c63d1814d154b65582a14ff890ac5ed0c3726c750e0390a32cb6fcee0beee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846280, "uuid": "b752f9cf-1713-4d3a-b5ec-9a28d0883376", "comment": "Malware payload (Gafgyt)", "value": "1856bff055434eca4c4407e24c7a6296b70e9c64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846280, "uuid": "206100e8-4996-430c-b0fa-e12659be581a", "comment": "Malware payload (Gafgyt)", "value": "5d3c9dc9d3cbcad3ffd35f196dbdbcf503032853011eae6fefd7772db3c104d7057ff298d00d800ffc67f80d99333f4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846280, "uuid": "fa342659-9bb9-4b10-a7d9-3d6e6b187ab9", "value": "T188B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846280, "uuid": "d692912b-9fd2-4ca3-884a-a164cbfcd1f2", "value": "3072:MSY+46m1qOzss6FPPKNy+AmkZrQAhPDCXFke:06mgOzJ6FPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846280, "uuid": "6d264741-aeeb-48ef-b247-5c28148c93a1", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846280, "uuid": "b4156c91-97c8-43c6-967a-bec319826580", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846280, "uuid": "2fffb130-3401-400f-8136-cbd896fe4980", "value": "604a9808c94c7b7d2ba310b63337e851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2f90e7-2a16-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633903797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903797, "uuid": "1e9cf09f-d5bd-4ccd-b9e3-1d0e577d690d", "comment": "Malware payload (Mirai)", "value": "f4c24e4a1f6a90cdbe6facd9e2eca37c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903797, "uuid": "d12633cf-4e06-4167-a1de-4ceeaa6c1133", "comment": "Malware payload (Mirai)", "value": "77f469777fc9f7cc8877d1b766b9b3f098fed180b05d1f15d0baece40577671e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903797, "uuid": "afa0bf83-8677-480c-ac86-c704c5d1ca7e", "comment": "Malware payload (Mirai)", "value": "76470aeca2620fb4a0242b8f2879adc7b0cc76c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903797, "uuid": "0242f62f-d105-4b2d-a6af-8d1defcdfcde", "comment": "Malware payload (Mirai)", "value": "81ed693ee23ba5b404c019475824e6fe768b43b6559eaed5758e4fb9be3d70fd4fb23ccb2f68d1f933acbe2c46a3e9d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903797, "uuid": "08f22f0c-a259-4379-9395-3822d0165156", "value": "T172735B24A97A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903797, "uuid": "aed87179-ee9e-47f5-acab-dfa0afc4bed7", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfiFx8:kmcjaq+Dcc5J+vN4FzfO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633903797, "uuid": "fcc35581-dee3-441c-9edc-c70c3e9d67af", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633903797, "uuid": "57cdc1bf-7a91-43dc-ac56-1e35aea5d3a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903797, "uuid": "02770646-26a3-4e29-a635-7aa166f43b87", "value": "f4c24e4a1f6a90cdbe6facd9e2eca37c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dbf197-29a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856651, "uuid": "c59b2271-77a4-4f2d-b7db-5a6109b80e24", "comment": "Malware payload (Gafgyt)", "value": "db6ca045a544ac0e415755487a0328c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856651, "uuid": "827fee0b-97a8-470c-b3a9-5b2b2fcf2240", "comment": "Malware payload (Gafgyt)", "value": "7975923129a94a9c9edd1b034e193e650eb1ef935d1341ea2d7e5bffc5f72cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856651, "uuid": "2960580b-51c9-49b6-834a-b164b4d899e6", "comment": "Malware payload (Gafgyt)", "value": "aac1b41523bb7f4d0afb23532f5a78ebb08017d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856651, "uuid": "70de36ed-efa9-4d80-a3d2-f4cf0f523eb6", "comment": "Malware payload (Gafgyt)", "value": "2aa40834ff1da65a014361549e5b686c6fbe068e6b39223a71656c37e7fa8db8ad65902111c28e397260e13e9648fdc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856651, "uuid": "ac3740d3-d77b-4ebb-b838-ceb859328f1f", "value": "T12CD33A05D8909767C6D227BAF79A428D73236B68A7D733115A28AFF42FC1B9D1D3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856651, "uuid": "8528d4c3-35cd-44af-ab8f-8dbde1984f00", "value": "3072:gVfyQ+d+pceQGfUbvTapLFhWOiwTteqHJ45hLPk3H94G1ZZTMmydQCYMhEFg:/bvTapLFhoUHi5hLPk3Dv4mydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856651, "uuid": "f5b2bb86-2713-4911-9b0e-d94f9d6487e9", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856651, "uuid": "bf208f56-ca56-46f5-aa22-ac19194f7bee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856651, "uuid": "6f812b16-0e4f-465b-8774-9be1e35f5381", "value": "db6ca045a544ac0e415755487a0328c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ad5d34-29a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856669, "uuid": "e7f10ba5-e0a3-438c-9117-6b8956cd0360", "comment": "Malware payload (Gafgyt)", "value": "1554a4cec572cc252da4a2f845e984a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856669, "uuid": "39193611-85d0-44e2-a4f1-66a394f5775f", "comment": "Malware payload (Gafgyt)", "value": "79886dc0102040b3a98da12c39c1e25abe0563e17fc2f78557bf7c2b10f2993e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856669, "uuid": "8012c3db-6dea-4208-b4e3-3e8365bcf78e", "comment": "Malware payload (Gafgyt)", "value": "4bcdd61cb18d7101dfa98081bd16b2242de7c044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856669, "uuid": "fa3c7c8d-36ae-4945-99a7-1e623555c3fc", "comment": "Malware payload (Gafgyt)", "value": "c2152cae854b8826a748e0fc8ee94ad7327a0f74f9aba05bd705d9d0b35cda96d0431e6ad53247535aee49304f8c73f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856669, "uuid": "035f03c4-f182-4988-bc2b-e6900ed17bf6", "value": "T15FE3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856669, "uuid": "cc7a5de7-0d5a-48ce-9153-6d2cbd685edd", "value": "3072:4nF0BZ1GPyaT/+5hKIE2aWURxuZq+1uPNd5R:suOR+5hKI3URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856669, "uuid": "369712e0-f4c2-4652-90b7-b399bc260faf", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856669, "uuid": "3efed1fe-c535-4550-92f2-48b6a3f4718b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856669, "uuid": "7fc1d8e4-aa9b-4b6d-86e8-f5e1a04f57fa", "value": "1554a4cec572cc252da4a2f845e984a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76b3e26-29df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633880244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880244, "uuid": "75156952-889b-407d-9819-db875ef8dd4d", "comment": "Malware payload (Mirai)", "value": "e5bbb1132b5c03b9215b7fb79d19b41a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880244, "uuid": "c7ef4558-8398-47b9-909e-869a673dbdfd", "comment": "Malware payload (Mirai)", "value": "7b69ceb5865759855e55746945681a44e0162077802cf4368f6c1e9ebc006c9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880244, "uuid": "16bcaff3-1e7f-4fe4-872c-b72b856a3f69", "comment": "Malware payload (Mirai)", "value": "ce26ae8d6a163389187a2299f1798da70230d5e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880244, "uuid": "af5c163a-85bc-492d-ac6c-a7540e7ba396", "comment": "Malware payload (Mirai)", "value": "eefb80ef06012b1fe0aad1a8452b3e31c6d2f4206af7ca8a11c83a93c5dee5885b26a9cabc78f31c366eb1618a357073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880244, "uuid": "3ef98ec4-de41-4b81-984f-0897e86597fc", "value": "T138C2DF7EFE80B949C9CEAE3B504D57E0DA8071A1224D5BBC53315E189CBAB4B764E0F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880244, "uuid": "e8386cf2-a23e-4e4a-b99d-4b79309d6f27", "value": "384:+skmDNMec84Q9jpfxFiVmnWIMG4DqZgr9LFbZCWrR3RWGVCz0Nvi:rkeNMeX19jBxFWmnWZG2qm9LdZ3rvWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633880244, "uuid": "28676e3d-dec1-4d1f-b6d4-82532f94a560", "value": 26768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633880244, "uuid": "13d77e67-85e9-4e86-8897-825eaa763c08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880244, "uuid": "d921666d-aa3a-4005-9273-9a5a824c1918", "value": "e5bbb1132b5c03b9215b7fb79d19b41a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfdb3d3-296e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831400, "uuid": "c3282ed7-579d-4698-a4ce-65a1005f6f50", "comment": "Malware payload", "value": "34b36003e1fae63f527bbd8a6a8be5ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831400, "uuid": "caba6695-887e-4cae-9d57-dc05e5bc3f5b", "comment": "Malware payload", "value": "7ba660b22bb7c3203dba878b4d84cef49ee1f770439ae79a770cd46ee376b040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831400, "uuid": "37a902bb-fb54-41a4-8f48-570b6b8cc14f", "comment": "Malware payload", "value": "4ac75401441a3f81cc7dce34e1b17a599838666f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831400, "uuid": "b67ef919-d1eb-43f5-b3f9-de8ace7bfc8f", "comment": "Malware payload", "value": "bcb36300005a28220b3cc775f444576447a53824fe229f8ce6fde81b05d554404cd32ea18e30d76c6bcfb84dab892fd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831400, "uuid": "3c335411-0237-4cef-a5e1-2c06c274be57", "value": "T1AE03C5A37906EEB7E40EE77A44C347247270FD564A531A32736A7CB69E322D43826F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831400, "uuid": "31fe3530-3e4e-4b91-b4d4-93cce168cf2e", "value": "768:yFtnISqwqps/YfG8mkVf82568a/8prkwRkvaJ5CZgWxepQ8bQ:IJISpqprfG8mCfNM8aQav25CZ70pQ8bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831400, "uuid": "600db4e2-7531-4d1d-ac33-f55842ebeedd", "value": 38555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831400, "uuid": "7a2a3832-da84-4b51-854c-5bedff0f8aa4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831400, "uuid": "9554e6fd-9528-4aef-bc4e-abb9879fb423", "value": "34b36003e1fae63f527bbd8a6a8be5ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2a388d-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851664, "uuid": "311aa02d-74e1-49da-9e0a-239e285a71a9", "comment": "Malware payload (Gafgyt)", "value": "fef4556058a61738fb6ff5a3503ac072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851664, "uuid": "6ccd7657-da31-40c1-a823-9de4d74ce460", "comment": "Malware payload (Gafgyt)", "value": "7bb625b082f0d53c6300baed2fe53ec6bf780ceb0578eb8dd426c99963b8297d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851664, "uuid": "61c655fc-ff4a-400a-8737-ff2538793fce", "comment": "Malware payload (Gafgyt)", "value": "90bfdcb1fc50b9f6df989982766b46c4dc7c0328", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851664, "uuid": "68c2ae05-5003-4137-beb7-4092e2256ea7", "comment": "Malware payload (Gafgyt)", "value": "c6805b63320b4ecc5d460c07ca13093dcfb0b1653cc10e55a3010d249683dcf3789b463d5302d71cfab960234499cd2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851664, "uuid": "1c3c4e96-055a-4656-b0d7-3162055a3173", "value": "T1CBC3C567AB50CEB7C80FCE730A9A4501108DA95652E96F6FB3B4C92CE74B94F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851664, "uuid": "46bf1917-e26b-4b7e-8ba0-0fc36c07aa15", "value": "1536:IfeTjSQWs8/tMfxZCvTOoxMcSYODkKG9MWUG98dMUmkiSFxfC7xoXe:I3/tUxEVtOUDUGbUmkiSFxfKxoXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851664, "uuid": "ef60879d-377b-40f4-8894-b7e45cb2b0ba", "value": 121527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851664, "uuid": "a907e370-d615-48cf-a203-ef74f177dfaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851664, "uuid": "75632824-3b4f-4ba2-9c3a-79ae5aa41ef9", "value": "fef4556058a61738fb6ff5a3503ac072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fba2b7-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899161, "uuid": "e8325b57-2835-4486-a1f2-59fcb73457aa", "comment": "Malware payload", "value": "edae81ef6f382d2f90d5e8566d8716d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899161, "uuid": "21bcf2cd-8087-41c9-bc65-426ea35538c6", "comment": "Malware payload", "value": "7e64521473a201247e00625ed80cd0c90bff3d1c5aeae6ddfe299dbdc8f5f353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899161, "uuid": "09faa55a-ad2f-4ec4-8c86-f70d058bc0e3", "comment": "Malware payload", "value": "fa453d106d263004ff1fa469a014c2eee659c370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899161, "uuid": "1b429b10-4c50-48bd-9a9e-d1211e69d3f0", "comment": "Malware payload", "value": "60c1277812c24c775ce3b5d75e46b2a71331a67b578e9dc284573ea19cabec02dbcb2a41ccf4436693454768c482d28f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899161, "uuid": "4b8a1736-999f-45b8-8d2a-89555706acbf", "value": "T1D5C39517BB618FB7D81FDE33059A4902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899161, "uuid": "7c087ebd-9ee9-4eb8-a15f-bf01e57db69c", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpE+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EW+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899161, "uuid": "858bae6c-fd7f-4c35-9ff8-31c31bc7a62f", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899161, "uuid": "e99a838a-40f1-46c1-a8cd-6f7c3531f869", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899161, "uuid": "8462fd70-b332-43a4-99c8-70b92cfde991", "value": "edae81ef6f382d2f90d5e8566d8716d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf56fb56-29c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870701, "uuid": "a721c23b-fe20-4a0a-816c-6dde7d2e16cd", "comment": "Malware payload (Mirai)", "value": "9b716982e9625a59912347408e8b0e22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870701, "uuid": "5f842e0a-3cb4-42a9-a218-02972b1e0530", "comment": "Malware payload (Mirai)", "value": "80591045e24def3ee02aadbe884159e7e68394e5541ad633fb5abb91e3150f16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870701, "uuid": "686f4c4c-c82f-4eb0-bbbd-33c5e7c35bb7", "comment": "Malware payload (Mirai)", "value": "713ca7358e388d0a66d67c2a20ecda0e37f3ead0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870701, "uuid": "29b662e5-7bc8-482f-a987-608eaf796558", "comment": "Malware payload (Mirai)", "value": "454e6cbc3954bf34126127bf57cdbccbb4e933a736eb366cb0841d9edccea0e8f710cba710a3b9d41c4b179122326e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870701, "uuid": "21398f21-8944-4813-9a50-fa66ff20efd3", "value": "T1E4433AD6F400AE7CFD5BEA7B80120A0AF571B25149630F77B363BC93AC320A5593AD06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870701, "uuid": "4fbb68b5-24da-4100-b014-bf9aeeafe761", "value": "1536:oL3iOkim7GsSBR+nuVXaJeMqY6ty8Sn2f8/:CorSBcnSXaJvpAS2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870701, "uuid": "954f6fbc-7e60-4eb9-826c-acb15ea3cd3b", "value": 59292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870701, "uuid": "68839aec-0778-4cdb-bd2e-c4fe4105d87a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870701, "uuid": "10e20023-1df3-46cb-8a03-d8de1d72f68f", "value": "9b716982e9625a59912347408e8b0e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8962b493-2991-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846559, "uuid": "cb59cb36-2ef2-4f71-a39d-c7d3e9004170", "comment": "Malware payload (Gafgyt)", "value": "46dc0f31e9aad0dafc46c2ea59d45440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846559, "uuid": "a3aacc50-c554-4f36-a865-1702a17a5630", "comment": "Malware payload (Gafgyt)", "value": "82c06b5da04a4dd7525a7b969559951e862224d853c6ab383e92f22c5aa13f2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846559, "uuid": "eb4d3be0-94f5-4b82-9d6f-8eaa3757f3d8", "comment": "Malware payload (Gafgyt)", "value": "1177a8a1c83296a281b71215903eb912ee7a1d65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846559, "uuid": "9d067836-4d6b-4c39-ae9b-9c1c54c6f9e5", "comment": "Malware payload (Gafgyt)", "value": "bd928dc6c0a334cffa2fb134a76e34d0c75660616510fdf0c5de961496961a24b8a659105ccad9e6578e3c5cdd3e8570", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846559, "uuid": "e1e0bb88-1ea1-425a-af37-db2ca215fa60", "value": "T178F34905E6408B17C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846559, "uuid": "8245d146-d3e7-4c42-885b-f9645f6323b9", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBBYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/7YnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846559, "uuid": "20285590-5326-4cde-8dbc-68faebfceb68", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846559, "uuid": "e1734b64-09cd-4a86-a540-6b992272aac4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846559, "uuid": "26c5613c-bf4c-4e21-a4a6-64d1f0e5299f", "value": "46dc0f31e9aad0dafc46c2ea59d45440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a3026-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873666, "uuid": "3bf6fbae-6893-4226-9fd9-5c484922833f", "comment": "Malware payload (Mirai)", "value": "a34fab27ba966ce2531c8e16a912ebf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873666, "uuid": "be3bca2a-0cbd-49e4-914a-8ee1e92819b1", "comment": "Malware payload (Mirai)", "value": "82dc4524c3a351a02565ae7c8af7888255ff9ee0ba0fd4a59b73dea8334aa9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873666, "uuid": "da0a7383-9632-47bf-9c0f-b50f4a0b88d4", "comment": "Malware payload (Mirai)", "value": "669f9f53c2f2d173d3929ca221f1be9796f09154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873666, "uuid": "e930a3e8-e836-4bc0-a157-0c7c2138745c", "comment": "Malware payload (Mirai)", "value": "fa8f61a51f307aaf5351e96bee22921ececb1b4353369b5284fb84f094d4b18b619cb32180077fac59e0b818060c515e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873666, "uuid": "7fe283d1-ee27-4209-b92f-4b06ccfc1400", "value": "T1CFD2E1016640FEE1D5B00231E9668A9B72263D79C1D134FB873C0DF8A6E961D47F8D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873666, "uuid": "d3be23b5-7ec6-47d4-92b2-a53450c74d11", "value": "768:tusHfRavjynNKnjFcZIhQzhKMXgK9q3UEL7s:9RwynNIOQQ1KMw/LA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873666, "uuid": "9d73f3ec-be28-44e4-8d6f-d1a17bee2b46", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873666, "uuid": "e8cfe36c-03d8-4546-b5bd-9f8240496583", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873666, "uuid": "8c756f03-9d1c-466f-8042-28ab80f10cf0", "value": "a34fab27ba966ce2531c8e16a912ebf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f69ab24-2a13-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902216, "uuid": "ccea5d49-d342-4be9-96a2-7899802202d0", "comment": "Malware payload (Mirai)", "value": "80a150c6f33263d6f9f394239134d8a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902216, "uuid": "ddd0adb7-53aa-4742-9355-19a125c1213f", "comment": "Malware payload (Mirai)", "value": "83616b296808565801efe0e29af92769ecea5fc50b54ac9d2fdf28496902e68b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902216, "uuid": "085cbb40-26cd-40ec-b1cb-fbda3fd21fac", "comment": "Malware payload (Mirai)", "value": "47c35e9570a54e362d6b8d619cb55e913fa92e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902216, "uuid": "98050217-9ecd-4063-9be7-07a2c7104c3a", "comment": "Malware payload (Mirai)", "value": "892c726511aa6040bba2c980d6bd4bc79531fbf855be4961a382f024b1ba5f9db48e49100bc075bd2c1b394d53f8b856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902216, "uuid": "b2ca1ecb-e850-4f08-b8da-830515c9a9cd", "value": "T15C33F155B4047461C6703637F8261197BF4A1BFBD2E23837056D43E8A8E90B37AF6CA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902216, "uuid": "3192313e-4962-4269-9326-881ca250e960", "value": "768:BMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrWLk92/nf9q3UELd:BM84ISRX63dZQbS5rzZWIHLIVmWjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902216, "uuid": "5a38656e-517f-4682-9b93-7fe17d60b64c", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902216, "uuid": "27b317bc-fa86-4214-8b48-c4ca2caf6b53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902216, "uuid": "98c81953-a26b-40f9-b6ac-ee7c6a98de40", "value": "80a150c6f33263d6f9f394239134d8a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356dad6b-296e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633831386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831386, "uuid": "329982f6-139d-46b5-93f2-de3b5fb728cd", "comment": "Malware payload (Mirai)", "value": "3b25a3c456db7c4aed904daf19cfdfd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831386, "uuid": "1899064d-183f-4424-aafd-f1b96fe2eea3", "comment": "Malware payload (Mirai)", "value": "83ff71642bf36888864cf5c4c523776221905ccfee78e21774356bbcf0ef3be5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831386, "uuid": "5c1b79a1-1ef3-473c-be63-60e09dd8fe3b", "comment": "Malware payload (Mirai)", "value": "e0f1f311bc83b19a33187fb8ea5227ea69657840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831386, "uuid": "90c8edb4-0609-48ca-91b5-24b1e5e6b397", "comment": "Malware payload (Mirai)", "value": "cbd2b7c4014ad6d86bd93d427b80a16cfaad5692f9838208c4299f32c56783ae989b7876a1f313a4b696ed7c16148ccb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831386, "uuid": "01c2b459-f677-474c-b5de-779e21b5739b", "value": "T1D5E20943BA959F77C1829AB816A74A300753EC165F1B0ACAB13DFDF4070B9CC791932A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831386, "uuid": "8c0758af-12b0-4eab-9942-249e9444921a", "value": "768:NChw6yUqLo5XFCw/QZCCnLYNGvDFlcgOxepq88Q:Cn5XFCwMCCnLYNSXcx0pq88Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831386, "uuid": "ceb65bd5-9e1e-4db0-9445-8d0766c4356b", "value": 32248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831386, "uuid": "04e88437-7710-4656-a0be-c50629a3067e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831386, "uuid": "772285d0-c66d-40c1-8b28-b1787968981a", "value": "3b25a3c456db7c4aed904daf19cfdfd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad35d211-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633862510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862510, "uuid": "a98a0b97-022d-420f-bca6-6c87d40b500a", "comment": "Malware payload (njrat)", "value": "ae62669c03c4705ceae9e46f33148e70", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862510, "uuid": "cc3f8621-08c4-40a5-b8f2-a8224d59831c", "comment": "Malware payload (njrat)", "value": "844777d11931b7ee8214c6c38a751a1c7bf850ea2bdd5a9341eb8e4133a42ba2", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862510, "uuid": "bce20610-9409-4b15-b4c1-bfcb5856fab4", "comment": "Malware payload (njrat)", "value": "531ec05e0d7b97e79f8de0248fd0ee4705b10954", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862510, "uuid": "b4621369-c482-49cf-82c4-ef162194bb04", "comment": "Malware payload (njrat)", "value": "f25c14e264f6e56af9e2360afbfbe48a9ec08c26a5eda6a7877d2c2090b1a407515d8d4e73bed83fb8e77ba6713672d0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862510, "uuid": "111993d4-c88a-4a96-aa18-9ad6d80be91a", "value": "T19CE49D30CB1EE5DF461295A2268A99270E914F0367D8CF8934ACC924EB1E93C4DF9533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862510, "uuid": "65722e40-fed4-403e-aac0-d33ffffc4152", "value": "48:Q7/nt1L3Geqqqz3LH/IxPf70ZvuEraXE7WfuNzPL:QjntpbqqqrLfqPfYFuByWfuZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862510, "uuid": "4af83cc2-31cb-418e-be3f-87e4a6516903", "value": 718430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862510, "uuid": "1ff4ec8c-60b9-4e87-926d-6583cc2b3698", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862510, "uuid": "e3ebb774-a560-4b5c-8ad9-5b650e82d1e8", "value": "Request#474552121.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe5253e-29a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856690, "uuid": "9c6ea023-97bf-4474-a247-c62af36ab514", "comment": "Malware payload (Gafgyt)", "value": "268ea0d87300d092ffe922829c49e51e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856690, "uuid": "2e6f2bc5-aee0-4f03-9254-4793e657035f", "comment": "Malware payload (Gafgyt)", "value": "847383e171751abe82c75bd0a6d7ab67c4c644db5c6c53e563018d81a9dd3c58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856690, "uuid": "e2ba54e9-642b-49ab-935e-d38cb5d4d694", "comment": "Malware payload (Gafgyt)", "value": "d7edbc770d0bec4d5fa951202ef6ec18705000c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856690, "uuid": "fc69800c-af7f-4aca-ad35-ac3356d3f2d8", "comment": "Malware payload (Gafgyt)", "value": "8f2cfac211fabf302bd0b892625e4fbd76b2dfaad5572529a54b2a168d799423e65ac2266abaa33b277cdc40a48a8496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856690, "uuid": "cfab62f8-ebf8-4870-8419-47f935c2f00b", "value": "T11FB33A57671C0B43C59B9AF52D7737F187ADEA7102E221C1A40EFF801B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856690, "uuid": "c2b68cff-bcdc-48aa-90e8-eabb30400270", "value": "3072:hHXj8UjfsEsbN7ONRwQw5hnJLfNK62QnI0PDG4gQNcR:h3rjsbN7OYQw5hnJL12QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856690, "uuid": "5e40a06e-6570-4807-8630-dbab4155571d", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856690, "uuid": "787c3f0b-588f-4bd6-b761-894b1e6da31a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856690, "uuid": "e4640229-41d5-4b1b-a62c-f104540702dc", "value": "268ea0d87300d092ffe922829c49e51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2562a8-296e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633831394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831394, "uuid": "5e1a7760-2ade-4351-9daf-1f47d558866b", "comment": "Malware payload (Mirai)", "value": "36297b1943375f5b20e04d8f78b38d3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831394, "uuid": "e2e8a615-43cd-40cd-90be-c31bb2786461", "comment": "Malware payload (Mirai)", "value": "86832a0a34fd8faf5c16f56cd01767c718ec03ded79e5fef6b93847dc209493f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831394, "uuid": "b5605379-26a9-49cb-a2cf-f4d5a00d0807", "comment": "Malware payload (Mirai)", "value": "a84cee169d2a0259d39dd60de789f7e6b3984b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831394, "uuid": "470cbc6f-2663-48df-962f-c50a2684a60c", "comment": "Malware payload (Mirai)", "value": "fe1f557980f7ecd701abafc3905c2a3595243770ebdc6a520882b646f5d4eb00828c7fd441dd2ebb6805d359ba7481ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831394, "uuid": "c639279d-2ab4-4924-b8fa-1f8f5a28e229", "value": "T128F2C642B941DFB7C8931BBA42B75A245631BC1A4F228F06E36DBDF86B075C8712B345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831394, "uuid": "caead0f0-b7aa-4f16-b75c-37fa91caffe7", "value": "768:V9iauzmR7i2sFq3SNK+JEDBYU3hc9oksSCjQOzgWKepf8u1:OauzmJ1sFOcKEEt93iyf7MOz7xpf8u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831394, "uuid": "19f47969-dc0d-4751-9d13-3489378e49d6", "value": 34351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831394, "uuid": "38ccb23b-5fdd-4151-8be6-40457ef4672c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831394, "uuid": "33225a7f-22bf-4e9d-bbb4-e4c250db0ce7", "value": "36297b1943375f5b20e04d8f78b38d3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9277b7-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633883900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883900, "uuid": "6902e9e9-5e08-42dd-b0a3-c58342b3d582", "comment": "Malware payload (Mirai)", "value": "b17622792af9f96d40bb7fc2368bef77", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883900, "uuid": "c4780097-43df-4def-9526-4d7bb9fecd06", "comment": "Malware payload (Mirai)", "value": "871396914f2eba708d08bba792514cc696d6e4a38efae5bc0966bbebd91dad2a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883900, "uuid": "59f6e5a4-6f09-477a-898f-c405d8a59643", "comment": "Malware payload (Mirai)", "value": "cf1f34b2ecb2a097bc532a4300990167104f74fe", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883900, "uuid": "b21f492c-ee28-432a-a570-36f986fec091", "comment": "Malware payload (Mirai)", "value": "e320e36e1ecbf441722dfcfd94a5cebb9d65407f24b466946cae1cc636e5a262d92b5ccec0b74cff65f9054c0c6b6828", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883900, "uuid": "5abd9f04-38e4-4fe4-b6b8-6a8d801ff1cd", "value": "T1D133390BA58081FCC459C17443BBB13AE466357E123DB1EA6BC8FF176D4AE605E2C8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883900, "uuid": "29b7b732-ee8c-48a0-9cf8-ebbd8562b36d", "value": "1536:q/5RfbZjWt5bvVMJtdJDhTBrdw9dfKTJX7:i5N1jWXvwvZhT7QdSJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883900, "uuid": "d11b2a6a-15b3-4b9b-971c-5bf5c0041f65", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883900, "uuid": "7cd7978f-38ae-4c67-a0c5-20d82822cca0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883900, "uuid": "2e92c9a8-702d-4c5d-bdec-e97d6e0864af", "value": "b17622792af9f96d40bb7fc2368bef77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466fb822-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (WSHRAT)", "timestamp": 1633866633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866633, "uuid": "18008e6c-e3f8-4357-9baf-f19b69dd4326", "comment": "Malware payload (WSHRAT)", "value": "3151f194fcfe3b210732d3f6bed59cbd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866633, "uuid": "b9dcd833-4912-444b-b2f2-77a9335b86c3", "comment": "Malware payload (WSHRAT)", "value": "878057fe16a4f4bcdf4e3cf5e28c5e5686da8f24ebb03ced117b34a3f76571aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866633, "uuid": "e9e6e9ba-46ac-44be-ac86-e49bbda8cb44", "comment": "Malware payload (WSHRAT)", "value": "84d181e892c2c51d29c70daa7f785aa4b9a256bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866633, "uuid": "17cbb864-fcf1-49ec-bf49-a0610bda4d17", "comment": "Malware payload (WSHRAT)", "value": "acf48715876d310b9bf87865ecc83c48d10a95e072a71af74337d157528c63ba52854c7bc5f1286d2d4537026f808b29", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866633, "uuid": "047bf11b-6d7d-474d-b989-9dab838c7592", "value": "T151355EC539843314A700962C832A612BFD79EA22356A4CEFED5F778F7E60C191C9A7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866633, "uuid": "fb3347e1-5c90-4c14-8cdf-6cb8122de52a", "value": "6144:wudMSpv050dB7J697LAmFm1uNJ7RychdKGqhCa1fEpZVHFQpcRa+BlI4w8CqPHz3:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866633, "uuid": "1b7fbadc-69b0-452c-92d5-010c384ce495", "value": 1101448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866633, "uuid": "5df58bab-6903-43ca-8520-6277affaea37", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866633, "uuid": "885f3d3c-13b4-4002-ad59-6e5e0cb6206a", "value": "3151f194fcfe3b210732d3f6bed59cbd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9be38b-29db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633878164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878164, "uuid": "0ab63487-64f5-49c7-b57f-2b9bb89609e3", "comment": "Malware payload (Mirai)", "value": "f14cffd07e1d6fbe01121d330ab451cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878164, "uuid": "acd88938-ca16-4cbc-a748-f6a9df0e5504", "comment": "Malware payload (Mirai)", "value": "884bffc448aadba392b4a685405a6d1ef27bef0a610f87953cde0bce72f89cf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878164, "uuid": "53804384-9355-4cab-8a1a-b476a87bb86b", "comment": "Malware payload (Mirai)", "value": "f418cc47ce431d11f2c1923011c80f055b37944b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633878164, "uuid": "457b670f-20be-4c44-a4cc-fcd763645f59", "comment": "Malware payload (Mirai)", "value": "91bb2a2ab81f149b0a450720928fae4cc0ff5b137d6a8c50e3aaadfc5ab84518712e6bbbaf1d6b3ce12005854f066ec4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878164, "uuid": "63ba530d-b35a-4723-970d-d67c50ab9ea5", "value": "T144D2E1B8189B5971E5B14A31CAE5DFC232030B2ED87BFA32251206D1DB8234F6A7F595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878164, "uuid": "c429023c-4092-4d2b-a96e-dfe97f8545d9", "value": "768:3XQD3WV1wjry5HfJVih/y79gBfTzbs3Uozw:QD381bHfWJyZgBfvGzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633878164, "uuid": "8999dbbe-d6c3-4783-bcce-1c9eb5d515ed", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633878164, "uuid": "244c7573-c1d7-4cae-8bbe-ad8432c94ea6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633878164, "uuid": "f8bf9278-3f82-4f21-a753-787efb88809f", "value": "f14cffd07e1d6fbe01121d330ab451cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5d0c5c-298a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843480, "uuid": "ee435dba-48a1-4919-947a-a8111d7901c8", "comment": "Malware payload", "value": "671b43f4ac89cf9079752cd88b108aea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843480, "uuid": "f73a91aa-8ac3-4643-962d-c9270db57fca", "comment": "Malware payload", "value": "88ac4d9b9c108c8a6b94aa5d9c710efe02245fcd7fe19abbf93ff1cd50d2fdf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843480, "uuid": "535dd1af-075b-434d-bb4b-b3d761d57dbb", "comment": "Malware payload", "value": "8b310c0c9d03ed8c716e24096f087319e1b85bf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843480, "uuid": "8c3f832d-12e1-4d24-a066-6de38b126edf", "comment": "Malware payload", "value": "af371f036243e69e2f9f290d70c2f66b41cce5d63731e1f8fe1b3b5fca5de60d7339be277f01e1c0e471148b471dfdf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843480, "uuid": "9dfe33f4-a06f-4179-97e0-872c7398fd64", "value": "T1CBA33702D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843480, "uuid": "074d25da-9398-4b58-a04b-5c339e7e9be7", "value": "3072:iHobm0w+aSP+wosGZmDYgTE+mBQO/IXZFW:iHo6+aGosGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843480, "uuid": "8c7b6727-cd47-4409-8a78-de06e710ad6f", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843480, "uuid": "76a7b4e7-9a3b-47a7-a648-d6fa9ac354a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843480, "uuid": "a2dbf79d-3e2d-45b9-af68-39c737d0f618", "value": "671b43f4ac89cf9079752cd88b108aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc98f2b-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633877408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "29da0044-d7a4-47eb-81eb-4ed66cd08be4", "comment": "Malware payload", "value": "a5af4ad870ae8b99968d79d595efe779", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "1e4da86d-1669-41b2-a9ff-cf6a3393fad8", "comment": "Malware payload", "value": "88b545e64eae82fd0c319c90dd7f399f901242fa4d233b3bc9d3b5a8fa1f5d9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "1b2998c4-65af-4f87-8b7f-521d4fe2d0d2", "comment": "Malware payload", "value": "fa0db3c592cfaeacf400c27bfa48da97f8228cd5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "530ef37c-aac2-453e-9ab3-893180e59f19", "comment": "Malware payload", "value": "9dac06798a7854f4f34476c69f25ef052749d9a6d694683a00f2242fc64099413767e8e1d911723e07cd43b943b7fec5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "48694cb0-8ada-4498-ba10-77726beb0500", "value": "T13D82F701B993D4F4EA1418B22653CF36BE75F5B6206ADB07CBA1EC3BA420691D71375C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "dba8c935-22de-4ed8-9db3-02ef5fb0ecd5", "value": "384:fenyF4MrFYT0ZuueAMND4p1ZVW4QXzwrCgM00h:2yFF+8GKZVW4QMrM00h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877408, "uuid": "471eba34-9854-4d58-87f5-8f48baf58839", "value": 17784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877408, "uuid": "2266789a-3a2d-46dd-8e02-dbcf824d8924", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "b47d4809-4212-4868-ba8b-7323b92d0d33", "value": "scorp.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ca6372-299b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633850789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850789, "uuid": "5affd715-f0f9-4495-9990-89f40e2fc074", "comment": "Malware payload (Mirai)", "value": "f12ffd0b4ea53bd58af40a8438237ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850789, "uuid": "a055eb88-41c6-49d4-88bf-b8e4bb9a5640", "comment": "Malware payload (Mirai)", "value": "88f83b7f00cd90634757d2f195da81ce2dcfae3d791ea88290c99458eb0493f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850789, "uuid": "bfdb4b85-8e88-4b2e-b8f6-3003911664b9", "comment": "Malware payload (Mirai)", "value": "adf288229c7ada5b91a7886c93e2106176f313c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633850789, "uuid": "4b6921d8-5298-43d2-afa4-cca295a60b2a", "comment": "Malware payload (Mirai)", "value": "00cc7ccb03e87f0a6697b3e736ea22789214d335489d4c54ff10366785852c88679850c44f41946f25da02c14dd3828c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850789, "uuid": "802785a4-d7ea-4495-8f82-58663adf1363", "value": "T16423025320A3BA03E0345CFA4562CCCDB65A66BDB1BF77A725484E254C34D93ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850789, "uuid": "02a3b190-62cc-4605-bbbf-86fcaf152882", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFwm99q3UELWt/iw+kvBGg6+fYtrBHP:P12O1LCNguovDPH7TcrrQLWhiw+kvBGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633850789, "uuid": "9315f09c-4815-477e-ab52-3f8263459065", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633850789, "uuid": "17735bcb-8d40-418c-9949-aa01f13b285c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633850789, "uuid": "a1151ab0-cb67-408a-9461-ed111ba2cc11", "value": "f12ffd0b4ea53bd58af40a8438237ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07457a78-29c2-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633867386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867386, "uuid": "6ca3c8c5-280f-4ddd-a542-feadf1f9f968", "comment": "Malware payload (DanaBot)", "value": "5f4731a4ef7d1484893213caaf6a6685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867386, "uuid": "aa35957e-bd48-4c14-b35c-5478c616befa", "comment": "Malware payload (DanaBot)", "value": "8a70f9b5ae2d2283111a69fc8db8b66656dbb82f08b089649033064ed59c6d8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867386, "uuid": "9a0804d4-a7db-4764-8754-f7048ef24d31", "comment": "Malware payload (DanaBot)", "value": "a49dce6cd5f76b5da4e1f1403dbf1da822eebcb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867386, "uuid": "49017994-e32c-4086-9dcc-aa785899e6dc", "comment": "Malware payload (DanaBot)", "value": "ed5e91ebc948484091dd042ee7d935675800033f8421b20d81ab036316dfb5ea1c18b8170dffd05d0e5565ea3f9f1805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867386, "uuid": "59098b53-dbca-4c11-bfbf-cb4c4258fc5a", "value": "T1F356338ABDD09921EF27257D5038CC254FB0DC1D492E836DBB62F63D642122E993A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867386, "uuid": "53022db6-5158-4c2a-bd62-34d824ffeb10", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867386, "uuid": "6adad298-dd80-4282-b98b-5e734636a83b", "value": "98304:MZxH07TiLjaUIiBZSgrwwOdx10DdC+pzDjLgLEEAuYR1XtZT4XL5kBGMibmCg7ty:McwjamLwwOdwJLpXZv/0XL5X0vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867386, "uuid": "2094a59c-5059-4f4d-8928-ff5778d552ea", "value": 6156416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867386, "uuid": "8b2af5a7-4ef0-4ab9-a96b-a3daba42a3ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867386, "uuid": "a4301efd-0ff1-4791-8c77-a582a4dfafcb", "value": "5f4731a4ef7d1484893213caaf6a6685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbdc676-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902968, "uuid": "f3d31d09-7e5e-4780-9e05-92646f8a7c62", "comment": "Malware payload (Mirai)", "value": "b30bea4c9ee213a599f7f7c3aaea3b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902968, "uuid": "fe4bea9a-7eed-407e-87f0-0664521130ee", "comment": "Malware payload (Mirai)", "value": "8b5bfe8436e1ddc91597007e011b674833e6ee206280f67fc25b333374d60ee5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902968, "uuid": "7925b2d7-1bde-4635-b4a9-07fe4320a354", "comment": "Malware payload (Mirai)", "value": "5a68e7388351853148d5b4485be607cde7ed6692", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902968, "uuid": "fd8c4f98-6ca8-42a8-8f12-9241972e74b2", "comment": "Malware payload (Mirai)", "value": "29c521860baf3bffccfe6585d7b85c442aa3d640deaeed2874074e6cdc104ab96604cbd9db585caeddc56d15efe5970f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902968, "uuid": "cd7dfe72-2335-4253-9404-0c84be8ac64f", "value": "T17BC2E054D3102E89FFDF6CB59D2A91C4372B178F674BA4A2B67896137063D2B6C01EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902968, "uuid": "dee52e56-0eca-43e6-a039-55a58c2feb2d", "value": "768:BUbgeS1f8Dnz+AHyRas6JAshPVmid4uVcqgw09d:BUbfaAQGAiNH4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902968, "uuid": "f3c6b55d-3964-477d-ba31-fdeb09b68065", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902968, "uuid": "bcf55a4d-29b6-4bab-9c81-16c7c94a119b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902968, "uuid": "95280efc-7b73-406e-8336-85c864f677c0", "value": "b30bea4c9ee213a599f7f7c3aaea3b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d3f9b4-29d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873957, "uuid": "4753174e-9705-424e-b73a-ba390024103b", "comment": "Malware payload (Mirai)", "value": "ed21037917acd3c00814b48e120a44af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873957, "uuid": "6c000f96-34ef-4dac-b544-5901bd453510", "comment": "Malware payload (Mirai)", "value": "8d60f0a03fa289c7d4c5c148720ce2cb663dd74750852cfa827e8a54510df418", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873957, "uuid": "2a7710bd-0eb5-48da-9dce-ba592eca2309", "comment": "Malware payload (Mirai)", "value": "ac190fd3dbfeb6ea02cda54ea4e1688eea2a30a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873957, "uuid": "eea88a34-8be6-4270-9d63-818f4b5a2b6d", "comment": "Malware payload (Mirai)", "value": "0800936295750f5e3622cbafca727f49c86c965ac52c7e3451bef050e2a4506befe140c286e948314de71d9af1316109", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873957, "uuid": "e4a19f1e-2769-4b1e-97b5-5ecc19b81a47", "value": "T195C2D0981B4959E9C2F9C17C43B80B6D19A40F6AF809DC8578F8F7A69D8E4753023EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873957, "uuid": "11acd454-3d58-4dc8-b90b-d65db92a7a1f", "value": "768:f2G214DFyosXqgvV9o1ndB08gJgGlzDpbuR1J8:f2GdDgosaaO1ndKVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873957, "uuid": "e4f904de-b495-4698-8c1d-816ed0012fe7", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873957, "uuid": "dbfdc569-eefe-4590-aa3a-a107b5fe7860", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873957, "uuid": "805eee8a-c2e0-42fe-a4a1-b8cc501e2aa4", "value": "ed21037917acd3c00814b48e120a44af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bb0083-298a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633843486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843486, "uuid": "9ff8d583-0ed5-4ea5-b564-b64b1a6ced15", "comment": "Malware payload (Mirai)", "value": "17ac3df1d6186efb2ef0f6f5e0fb4eb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843486, "uuid": "867d9a8d-0451-49cb-87c8-92275e0bd555", "comment": "Malware payload (Mirai)", "value": "8e47bbd098437cd2d7e46ad172a03ce712efde0172056286c26f31b7afec5f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843486, "uuid": "3382ee5b-82c7-41dc-9096-24c995cd45af", "comment": "Malware payload (Mirai)", "value": "82ef4e577f3e9b49b6de7c025d08d00cdee5fca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843486, "uuid": "876ab36f-8a55-4979-ad69-9406140a86f6", "comment": "Malware payload (Mirai)", "value": "92c93855f216996ba561491dff8a47c17fc7558fac4a1cadce0420bd540b97a34c4ce797c65deebb45598b9f09193128", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843486, "uuid": "7bc4a273-63d6-47f4-aade-56c53c9cdd1e", "value": "T14963290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843486, "uuid": "9e745485-4e66-4bbb-b98b-9bac4930f365", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96CDf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS6E9/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843486, "uuid": "0a77b8e5-c1be-4596-82b0-4d4a2eb5ade0", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843486, "uuid": "d5c1bf0c-183a-415d-833f-12361f4a597f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843486, "uuid": "d5c3f1fb-036a-4aad-9649-00579cac6a37", "value": "17ac3df1d6186efb2ef0f6f5e0fb4eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d81dad5-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633877409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "c55c5708-8d23-4dea-9a5f-d574c9465acb", "comment": "Malware payload", "value": "acf8eb23c08babfecf428936fe38d30a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "f7a6d390-b6ef-4e1d-bebc-30bc14811fbb", "comment": "Malware payload", "value": "8e654d703e4ebc2ccc7da6f51b047d6af48fc3d611c28da221183a8fa339be8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "74a0ff8c-1433-423e-bab2-e870c2a2e6d1", "comment": "Malware payload", "value": "c626c9632c5e54e42f1aec35652e1628f9c056ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "5e87b8f1-61dd-48fe-a36f-3bbc25f025bc", "comment": "Malware payload", "value": "4f00f3ef867eec6146c7aaf4d5270e4de9f05dc4234fa0280e4278da2fc8fd8bffc49203ab11e8e266002839d1158b21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "b9a190e2-5692-4bdd-99cc-582573606778", "value": "T164720A46FE46CA15C3C0AF79B9CF8A4C3396D2A5840E37479918DA521B4AC1F4E27F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "fcb63aa4-91a1-4ce5-ae67-19dd309d3efc", "value": "384:1FLL6mvkU5UuuwHvDh25WfxYtohwQ6/g5knc:P+ckU+uueh2sfUoYo5knc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877409, "uuid": "b5d6db2b-8543-47cd-9a27-fbfe33b8dbc2", "value": 17560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877409, "uuid": "cdc99dc8-1641-47f8-95ab-9d6330f1cd18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "064a57a0-facb-4fd6-b1c7-32b63e9ae3e0", "value": "scorp.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c780861-2973-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633833652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833652, "uuid": "ff310380-1a14-4f62-bf41-c66047cb8044", "comment": "Malware payload (RedLineStealer)", "value": "50211d573c8d9201df616fe5dae3ec2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833652, "uuid": "1f8eb1d3-2527-4d48-9216-662f324fac42", "comment": "Malware payload (RedLineStealer)", "value": "8fc76e4b14fc2f43e710a43ad79e168513b97a4dccee37af410405f9836faca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833652, "uuid": "9bc05977-1961-4095-b5f1-a2a38453a208", "comment": "Malware payload (RedLineStealer)", "value": "355967fc74b291ec99fb27a24f85e025f8503c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833652, "uuid": "877a8768-8296-4ac6-b8e8-40c2fe289b8e", "comment": "Malware payload (RedLineStealer)", "value": "43b0d2df13f00a9e476cbe0cac34d7aee4ad0d2b129e7346645da0b188dd9f65ef9a5290c47c9ce556f9df8311102bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833652, "uuid": "bb35bc99-04d1-4532-8d6d-c948414fc593", "value": "T142E4F120B6A0E034F1B766F4597A9379A93E7EE16B2494CF17C116EE1A306D5EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833652, "uuid": "e5e05dcd-912e-4830-b850-34b7e08291da", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833652, "uuid": "12077ce1-ea3c-45da-9ba2-f937f532e2da", "value": "12288:HRN6MwDdsS4MVuPUzYrHRUAKznjrch7OVQ+VDsFVk1MuoLKg:BwDdgkuPGDA0jOOVQisE1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833652, "uuid": "9461a1bc-d56b-48c3-aaee-3c3bd233a39c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833652, "uuid": "9a5cf91e-b69d-4592-a883-1a8f9531d277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833652, "uuid": "69019390-dc42-423f-8067-b96aba77698c", "value": "SecuriteInfo.com.Ransom.Stop.Z5.28605.28489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7384e701-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883888, "uuid": "98ba4fe1-521e-4346-be95-b84923fe9b30", "comment": "Malware payload", "value": "16a8d4db05d0a5922c5fd28090e7fbb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883888, "uuid": "4d04919b-ddf8-4b90-b611-0ec3b6c9fafa", "comment": "Malware payload", "value": "91b66c483f1075c94e3ab17a590d039bcd4c827f5ed9904af1f3b9bdedfbba79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883888, "uuid": "6e227c78-4b33-4b93-9446-a8400c68bf6f", "comment": "Malware payload", "value": "65640c1efa479900ccf00bab0ba38f0fd70746b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883888, "uuid": "e81a0b94-be7e-4059-a516-0313303a2c3e", "comment": "Malware payload", "value": "df04fd6502e0d8a34aee07849ea9d10680390dec88dcdfd4822ec8823f51898e9d2283821f24ec370fae5e3d2b708595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883888, "uuid": "ae196d1c-a7ee-43a8-93f1-42e6ac3c57f0", "value": "T1AC44E745C4299EFAC040E93239FE6B65876C79C21B2F159A5938EF900B3F1D7A04FE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883888, "uuid": "1e7f1db8-f616-4fe9-b372-ab89497c54ee", "value": "6144:G3631251m+SmJTrv65h6MTaTyBDjL3MF0k5QziM:r3w5umJrv65h60BDjL3MF0k5QOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883888, "uuid": "0ecdc014-7922-4cc1-ac1a-5af09c0af424", "value": 253688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883888, "uuid": "776bb757-f14c-46a3-acbf-7b8336608072", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883888, "uuid": "b3bb898a-f1ad-4999-a16f-0c9224bfc5bb", "value": "16a8d4db05d0a5922c5fd28090e7fbb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f5ef2d-298a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843491, "uuid": "e8a24cfa-752a-4b04-aaee-58c235be5d34", "comment": "Malware payload (Gafgyt)", "value": "b2be04b4806ecd5e2579ef84876deef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843491, "uuid": "5e1cfc76-cd34-4ec7-9c80-988f1fafc466", "comment": "Malware payload (Gafgyt)", "value": "91b9e8bbd33bd24582fd8581f02fd5ac092ec276504f1234db57eb1981173436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843491, "uuid": "4b57b8af-5817-4eec-8d90-c4bbec4784d4", "comment": "Malware payload (Gafgyt)", "value": "2ffe375719d75ad1ad5bd994d94d35132557065f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843491, "uuid": "0254242f-fd5d-4e09-8c59-223f1ecf8f70", "comment": "Malware payload (Gafgyt)", "value": "dc7949370875b2837fad2e2b2daed77f0b638455fa382764002337a7df318209e46493b691b19fbe213d31d185748ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843491, "uuid": "951f1e3c-0a65-451e-b90f-a32799c41958", "value": "T180833B01E643C6B3CC8307B2029BAE661931BDAA5E2ADF49F31D7DF4AB128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843491, "uuid": "8e75da8b-58d9-47ff-8b78-26bbb2fb8652", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8LLGDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YHGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843491, "uuid": "5ac47b7e-04b3-494d-ae7a-228bb9691a6b", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843491, "uuid": "81ee0eb2-56c8-447f-8518-af8f0ba21259", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843491, "uuid": "af9b4375-f1ef-4f80-bf89-23802d46f85b", "value": "b2be04b4806ecd5e2579ef84876deef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454db24e-2a06-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633896696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633896696, "uuid": "a7efee5c-3872-44b5-86bd-56b2215590d4", "comment": "Malware payload", "value": "99854fad01d4d709cb0f609463491ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "SilentXMRMiner", "colour": "#F693B4", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633896696, "uuid": "d9c20539-8611-439a-b2bd-8a002d886a58", "comment": "Malware payload", "value": "91c43b63ed3549c521e4166ab7358e29ce19f8087c9053a8c6b6e4f17ddeb4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "SilentXMRMiner", "colour": "#F693B4", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633896696, "uuid": "d1b8d485-0f1e-44e6-a716-9e4331187cf1", "comment": "Malware payload", "value": "dad4de38bedd0dd97a7e76f1e78c60f5dc26c35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "SilentXMRMiner", "colour": "#F693B4", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633896696, "uuid": "6fdc76c2-aa18-423a-b1c5-4a71896f1dc9", "comment": "Malware payload", "value": "5602ed1abaebab559d25714e4aed79327093f93afaed6631dbd4bb907e9fd3fe866b4e05f72a47dd48bdf6937333666c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "SilentXMRMiner", "colour": "#F693B4", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633896696, "uuid": "38635510-7262-480d-a3f1-f682164a9a3e", "value": "T13C1633EB7B95C16ADE153C7161314B6662E8612334A6A323CBC747C860A2FBF02F54F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633896696, "uuid": "e650871d-9ed7-4f4f-9d0a-21f84d297e28", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633896696, "uuid": "6067f36a-a2d6-43be-b9a8-57f9ad3a9c8c", "value": "98304:J3yTpHIoJjZst0p/7xuJNT01cxHxFkrVFXggLUGypTLnoBcDYxkg:JQeoJjw0pmT01cxHGgILW7oC0kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633896696, "uuid": "33e5c464-8b9b-466a-9c73-dd1279ae7566", "value": 4054065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633896696, "uuid": "72217114-ae68-42e7-a41e-1f0c454a7661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633896696, "uuid": "84874ede-dcdc-441d-824d-f0458810ec73", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce61efda-2986-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633841950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841950, "uuid": "6c276bac-511a-40f1-a267-7ff446cfbf25", "comment": "Malware payload (Gafgyt)", "value": "71f475fb458ae712233cf3a337c92b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841950, "uuid": "d3d3a38a-e09a-4ae5-819e-0d66df95f3ff", "comment": "Malware payload (Gafgyt)", "value": "924096254023de510de6648e5f1f9962112abee52bda475d96c1e3cb4b04bacc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841950, "uuid": "f6e196d8-5d5a-467f-9564-0e349ffd52d2", "comment": "Malware payload (Gafgyt)", "value": "e66f0ad5f1d894ade2a5a0ef949cbb0634eed4e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841950, "uuid": "b5d2da6d-9617-4ffa-abf9-ecedb013f901", "comment": "Malware payload (Gafgyt)", "value": "6c8a22c676b6afb914bcda340b3f3f2a1fa7d61f44c8b7400828df8842ce3dcaff8b5e11290d9ed95d81717b4dbdb5d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841950, "uuid": "b92a98c5-c50b-4f7d-80eb-ce202c26cb57", "value": "T1C0A30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841950, "uuid": "73dae13f-dfbd-48e8-8b50-f0857afabf3e", "value": "3072:BdKLGdUvuXwyKQlU8fzX6mumuxVqDr78fz1e:BdKLGdUfyKl8r6mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633841950, "uuid": "e730483d-a29c-44f9-92a6-667574c7b5ac", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633841950, "uuid": "116aed23-224e-4393-ac4e-0fbc527cd385", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841950, "uuid": "71357c6b-7faa-44b9-b3c3-2c3ee1fed620", "value": "71f475fb458ae712233cf3a337c92b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f19f36a-2973-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633833657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833657, "uuid": "9e3e22c6-6bc8-4e3f-8c49-d43b0a4cc8f9", "comment": "Malware payload", "value": "8a4717d749af209862823294ebfc83f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833657, "uuid": "5391b314-fc29-456f-ae41-fb87f8913656", "comment": "Malware payload", "value": "9261848a09d52eac7df38114afaf823474d880dff4d1a5b61def5c24b27b79fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833657, "uuid": "8805df23-7645-402e-a19c-b02c7c0bc9d4", "comment": "Malware payload", "value": "16f5c0d81047223d782c91ea7db7c607fb703c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833657, "uuid": "3f61e62f-ef16-4670-b52c-8cb7965de1b6", "comment": "Malware payload", "value": "22f64bb64e96f48202c858191414b917a16bf7c8bc7d3f64d19377d48388f2d6b13c7855bdeb1c82f5ef0abfb93226dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833657, "uuid": "7063ef4c-e874-4335-9a84-7036b1a6f806", "value": "T1FE03F220C2171FD3FAABA7B04E69D3D87F259AD9BB708C05AAD68F01392643D57244C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833657, "uuid": "db451d1a-db93-4b4a-aa99-f1211f06f54e", "value": "768:GN9cBGOHq7XQCsQoMGqaqREQquFdGgLQ6xwF4uVcqgw0z/KuYJGEQy:IKEOHqlsbTqREQdnLQ6x64u+qgw0z/Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833657, "uuid": "fe3bfb30-e9a7-4cb9-af63-794e8f58350b", "value": 40104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833657, "uuid": "2844c705-5dad-4ea9-b8be-b6b8010191fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833657, "uuid": "704a0a28-6b95-4e43-96d2-f096b0827ad3", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.3744.10774.14146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72ced86-29f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633888807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888807, "uuid": "0398c867-7bce-4738-83d0-88187ac0c396", "comment": "Malware payload (Mirai)", "value": "456904fe4f103e9b370027806e5f51dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888807, "uuid": "b92570e7-958c-4405-bc57-47527655efe0", "comment": "Malware payload (Mirai)", "value": "93c613a077a665c6072bdced279a1b49fb67edc860a77ef6faac1ad3c5a07912", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888807, "uuid": "13374c12-1807-47bb-a355-78e6cb0cfe26", "comment": "Malware payload (Mirai)", "value": "83e0b3246bf8e34e93f9840265b52901a1b9a3fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633888807, "uuid": "6a5c1070-1034-46e5-9b68-1d73c4716623", "comment": "Malware payload (Mirai)", "value": "1927b12c1097d22a623430b85ac661a1132bcf491d989c5c95160fa601f518a7df482589422767cc0d2fc7e1e64fb848", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888807, "uuid": "7ee9aacb-03b6-49d1-b718-947bb472ba93", "value": "T173E23BC6DC83DDF8ED1605725232EB32AB7AF52E2159D977C3988822EC43A02D60775D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888807, "uuid": "991193ab-bcf6-460a-b9dd-e535593a46c3", "value": "384:fBxxDb90pbMa/fhhRTh8MMEbpGopC9+NQQHxZhDSlMmF16Z09B8e9U6+SM3C73l:h4PfhbF5Mop3AyHcFxXG6+VyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633888807, "uuid": "5f88f131-a2b3-4101-98e1-61cbc4dba29d", "value": 31456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633888807, "uuid": "1dc36878-00cb-41b2-ac26-31bcd43dc22a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633888807, "uuid": "1b0046ed-c085-4d53-ac1d-b6d9f68ed3f4", "value": "stainless.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae70ed3-29ca-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870962, "uuid": "607d30ef-f328-49de-84fc-f23218dda9e7", "comment": "Malware payload (Mirai)", "value": "cab182143cda65101d71734cd4516d57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870962, "uuid": "329eef61-d811-4dae-8635-4e3435029439", "comment": "Malware payload (Mirai)", "value": "9433edf008dfab2be33778d6e7639496a6816cf32726d1733795add101fb210e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870962, "uuid": "30802d1d-df78-45c7-a14f-898264a1d4a1", "comment": "Malware payload (Mirai)", "value": "f61e7962a49372f793a64e569297fc9f0de92783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870962, "uuid": "4df51944-3ea0-464c-a208-356e904917a8", "comment": "Malware payload (Mirai)", "value": "4b26da420beacd44cf87e91a6f921c496ef0af1077a0a4606198b445bce1c7616873e1a4414b7b21d1baebd53d223fc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870962, "uuid": "dc8efee6-73f3-496f-97c7-e6bad8bd5061", "value": "T1DB334B01779C0E47E1671EF5263F1BD083AEEE9011E4F589264FFA4A8276EB34189D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870962, "uuid": "778d29ec-1c50-4b6a-a8bb-aa5a4610d6ae", "value": "768:3CijQhvi0GP8H/ce+cCWRo4TOKqcIOYpitBF+eYs3bNGbL8kS12UITJ3Oq1C:ZKGetQbsLYI28BUUIN3Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870962, "uuid": "6315e559-9cd6-438d-92c1-060e34da9cdc", "value": 54756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870962, "uuid": "3337924f-1a11-48cb-9338-d9598fe6cee8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870962, "uuid": "e835397b-d225-401e-927e-c7d82012f08f", "value": "cab182143cda65101d71734cd4516d57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad9e694-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853272, "uuid": "adf103b8-8005-46e5-ad84-8f1a20f94157", "comment": "Malware payload (Gafgyt)", "value": "6ea6590f30081871e25ffebde9324651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853272, "uuid": "d0d3153d-f53a-474f-9d16-e502977775b9", "comment": "Malware payload (Gafgyt)", "value": "95f0ab5048c23859453ce317204b925a437a9227e65dda1c8c1b24e769895416", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853272, "uuid": "17d41374-848f-4bf9-b90b-7cdaef497fe8", "comment": "Malware payload (Gafgyt)", "value": "2d7f7a073d07c4ebd5443bf71a0665903cfe5c71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853272, "uuid": "105a143a-8543-47b1-8f7d-06d3e480884e", "comment": "Malware payload (Gafgyt)", "value": "2f6a4449df41c27dc938a1fb0cacddebb5932a8d92a94aa684c17db1e4276b86410a856ee4c72752caee7fbc46627572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853272, "uuid": "18556db3-36c4-47b9-8f88-c0bce0ac0c06", "value": "T183E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853272, "uuid": "03c69054-4360-477c-8452-461c8a5c1a89", "value": "3072:Cv/WwsLgaq353qHiCOvhOpTqkDQHbeskmhxQwoVSUNu:KPLaq351hOpTqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853272, "uuid": "22334641-191b-42db-b5de-f4b1de66904d", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853272, "uuid": "7d7572a5-daf1-4e43-baeb-a3a4e53827f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853272, "uuid": "3d5cb6cb-6cda-4618-a23a-9acd720d327d", "value": "6ea6590f30081871e25ffebde9324651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdfa03c-2a0b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899151, "uuid": "14d07c56-0726-407f-b388-63b1e874a015", "comment": "Malware payload (Mirai)", "value": "64ea42e44db4a591551102e55b1180a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899151, "uuid": "d30fe9b8-5eaa-466b-afe6-b2abb0cea323", "comment": "Malware payload (Mirai)", "value": "97c3656db0d63fad87fec8fa614f4b875c2578e269c1b1419bc459915f3b1100", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899151, "uuid": "18d261bd-b7f6-42e1-a1f1-b1dda693c0c3", "comment": "Malware payload (Mirai)", "value": "711ee1343a194282ae8e07a606b24dade554d5d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899151, "uuid": "f9aa548e-e8e2-4d82-8564-8d6b486e6549", "comment": "Malware payload (Mirai)", "value": "7dd2383b98a0a51d8c7fb10e24056b3aa3e3dcafb275e8eb660097adabfd66c44f2612271caf6c4d1dfbc69ccb448dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899151, "uuid": "30e8ed6b-a71b-41d8-8e5d-c4b068c7807b", "value": "T168431956B9818F15C9D4127AFA2E018D33235768E3DFB3239D106F507BCA92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899151, "uuid": "5c4c6a2e-d438-416f-93a4-2986cf27a813", "value": "1536:itn7c9HWKX4wQTyUSODwPRqR1tchYn72zRILiTqxu/R:hWU45TTSOycRXch7qxu/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899151, "uuid": "500154a7-437c-4999-b487-87a97834296a", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899151, "uuid": "08fd099e-732f-471a-8b85-bc577b57fb3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899151, "uuid": "70d500b5-0445-41b1-9f66-df05a97f8650", "value": "64ea42e44db4a591551102e55b1180a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3092f5ca-296e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633831377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831377, "uuid": "8d18bef9-f46d-4787-bc35-44adbed7b4fe", "comment": "Malware payload (Mirai)", "value": "2d1ffcf095a2c656598a03a127b17b8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831377, "uuid": "bbd384c0-2e23-4b6b-9dc2-78fdfd3575f1", "comment": "Malware payload (Mirai)", "value": "97de62d07d09856ab8aa1abe23ecb666ec3795e0d08e0b833f05ed558edc9d07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831377, "uuid": "bf9a0702-6d95-4c9d-829e-2867b7424619", "comment": "Malware payload (Mirai)", "value": "79b1b0997845419fa85185f53b9098200bf151dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831377, "uuid": "7f6da60c-0427-4cda-92b9-6ff7e129377c", "comment": "Malware payload (Mirai)", "value": "2e5a2ceb15c24070639302636ae2828c191e5986f5c58647f4d3ecc2c07ed3edd1e441056217900187bb66b416baa197", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831377, "uuid": "854668bb-aec7-491b-ad20-420246d47e70", "value": "T1CDE2C7426641DAB7D5932BFA17E74B204232FC3E1E029F05E31DBCB85B465C8B267729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831377, "uuid": "23bfd8bb-54f4-4cb8-9995-bb39dab6d731", "value": "768:2Cv8V39M1vkZKApnjFIcE9TrhSRjQOzgWKepf8u1:Tv8T8kbpjFI79J4MOz7xpf8u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831377, "uuid": "2b3b739c-3b09-47fa-8dcf-c209ac077ae6", "value": 31823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831377, "uuid": "f7f4cb50-258d-47f3-8e32-34174f9bef4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831377, "uuid": "54d687c5-3a12-451c-a38c-b62f194937be", "value": "2d1ffcf095a2c656598a03a127b17b8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddd760b-296d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633831078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831078, "uuid": "d95753fe-008f-4796-bb2d-97654ae8f51f", "comment": "Malware payload", "value": "9897c1bfb0970b0b783501b70a9621d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831078, "uuid": "fc56ec50-7414-4ab9-a134-2c8f65438473", "comment": "Malware payload", "value": "9974c9d80a5b51752bd6f48ee737e63d2e0491b62d61fad956b7b50d1df9d80e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831078, "uuid": "e86ffb7a-9191-47af-869a-7cca77b7d1ca", "comment": "Malware payload", "value": "5d51308a464f56ba03b0befb93bbc907eb3d1ad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633831078, "uuid": "24dddd65-f3d1-4af0-afcd-c6ee46974ff4", "comment": "Malware payload", "value": "0c7deab34b8676e8843cfebbad474c3b2cfa4c357ab47e1bb0c2223efc0b5b16f6a99be142034280a15213ce967f53c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831078, "uuid": "0512e6cd-cb51-41e0-b7bd-8cd27751730c", "value": "T12C933C05F7408B43C4E21B79BADF43153323DB14A7AB63065628AFF43F867AD5E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831078, "uuid": "e1f49a27-0417-48b5-9584-e01a97df27c4", "value": "1536:d8n+2iINWxB3ybl7WlFyqUiEqvPy4+PlTeqQfn1EJk4zw/9lQAlhWNmqfw0QovAx:rB3yMOqvPy4wlTJQfnkRM/9aAgmgw0XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633831078, "uuid": "cc5afb05-d8d7-458d-961c-0112647691f6", "value": 93959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633831078, "uuid": "7ee223ae-dea7-4373-a7fe-aaefbe833c8a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633831078, "uuid": "03e776dd-f8e7-4739-b0ba-10e464ad2c4e", "value": "9897c1bfb0970b0b783501b70a9621d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf2e1fb-2992-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633846832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846832, "uuid": "2c4aa169-4378-4bbd-aa17-ca45a34a5dbf", "comment": "Malware payload", "value": "503fe40b13f2ce64e4baa44936dc560a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846832, "uuid": "66938721-929e-418a-95f5-eecff0535bd5", "comment": "Malware payload", "value": "9a2617c590331d368b4e79903ab22529bb5f3e3c77e3af0370bda616fc6f8bae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846832, "uuid": "4696d899-fe14-4a5c-8b0c-c97a57ac8eec", "comment": "Malware payload", "value": "fc7a73b4ab8f94c667e5ecc1be4f39a7a32b6fc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846832, "uuid": "c6876b92-755e-4ace-a0c9-ebc6701fccb7", "comment": "Malware payload", "value": "9b79afb0b05e28db7934a7fbac184a1b4c579c68c64b925b2afe0cb732025056448997164781e94b2c21ec7e4ddf03eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846832, "uuid": "2c651734-6bd2-4a1d-8f4e-633215e56371", "value": "T1C1F2E1B109848A21DDE218B8FD78076D26551BB5CCB639D32C21027CE8F5971FAD0AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846832, "uuid": "35d213d6-68b1-4539-8211-a3505fded6c6", "value": "768:SWL/3AIqMD7D5unD8SlIWvG3DeQ20UNSVuI0q1r7P3Ue0:SWL/3ZqM74nD8a23qQmNeu3q1f70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846832, "uuid": "1f0e1d47-be13-4998-8827-ccdcca2f2ff2", "value": 36656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846832, "uuid": "1318bb96-e524-4516-a3ea-a941bcbf34c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846832, "uuid": "0c8b6548-2c08-40d8-9a2d-0f425d053ef2", "value": "503fe40b13f2ce64e4baa44936dc560a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8531cf65-29d6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633876187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876187, "uuid": "b386a1fb-0065-43ba-9c80-318c95ee62d4", "comment": "Malware payload (Mirai)", "value": "3d0fe7af02b75bb0ef22e2291055e7ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876187, "uuid": "acb6b524-aaa2-4e2d-957c-e6de7fdc51cb", "comment": "Malware payload (Mirai)", "value": "9a5fbafd00b19140a778c7be82bd31ffe306d1410b44fab79167e8b0e922622c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876187, "uuid": "8a3e4f43-73c7-420d-860b-d573ff2bcd83", "comment": "Malware payload (Mirai)", "value": "fe9b123425fc68563b51c730950f2472b06d0ad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876187, "uuid": "56f15eb5-6eea-4de4-b174-ca9a15efa7e6", "comment": "Malware payload (Mirai)", "value": "bf408d584cbe4dcfd0f8bb798133f5a6fadba297c15bdc612da9a7e0efcd85d80ca532336aa9570003ead95a2f1bd5bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876187, "uuid": "a7576cb8-4889-46bf-963a-a39588cae7dc", "value": "T161732ACB64125DACFD6BE5B585220E0BF82122125FA31F27A2D7FDA37D23190DD0AD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876187, "uuid": "af371d42-f766-467b-90f6-74d2f7a63a9b", "value": "1536:LotNVzntCv6TqCr4r7Ov4g1ptpmFHmjEXrg36RAZT08C:LQVFLvdpMsMhAx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633876187, "uuid": "3181660b-127d-414b-add3-16c5dd5fbb6a", "value": 77328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633876187, "uuid": "a14207c3-5f57-46c8-a575-68cddd0094cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876187, "uuid": "0f214eed-ab2d-4a7d-ac9f-d237ecbdff12", "value": "3d0fe7af02b75bb0ef22e2291055e7ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3077fd0-29bf-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1633866466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866466, "uuid": "793f1090-31f2-4ccd-ba63-a0fba6dff788", "comment": "Malware payload (Stop)", "value": "ac60b43d159dcac0a93ac6dd12ce0bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866466, "uuid": "52d613b8-e939-41bd-bc9d-3ac97ee1679d", "comment": "Malware payload (Stop)", "value": "9afa91c839d958185548eccf40690eb7db7859a852ac06f3870a6165c287d6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866466, "uuid": "f0decad2-253d-4414-a3d6-6a37d53d2dfe", "comment": "Malware payload (Stop)", "value": "eb83e395c2f3c39eb297d3a192d4174a96e10455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866466, "uuid": "47bcb7c5-3d09-4be7-8bab-c773bacc8b90", "comment": "Malware payload (Stop)", "value": "26724e7eb9f960cfa7b150ab2089349d30c2f4437d1ea88ff8cb74b8ba2ae28ff36273951d77ecaee7b3a2e861eed2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866466, "uuid": "48942c65-0907-41a9-b577-dcaeb81f27ca", "value": "T14915E010A2A7C034F1F3E6B85A759278A93E7DA1AB2454CB22D11BDE5634ED3EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866466, "uuid": "2531c681-756b-4f13-a26e-89abae677435", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866466, "uuid": "7b5e38df-1205-4c8c-815f-3c2b8217b369", "value": "24576:Sxuysrd0jFXVrcKyV56ySC9q9in/1lAASnp:SUWVr5O6ySIHn/1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866466, "uuid": "95f95d25-04b9-4ce1-abef-dbcc3e8baf50", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866466, "uuid": "75d8abfc-ac5d-4abc-842f-5b351ffdd9d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866466, "uuid": "c6621a54-3b27-42b3-a747-e9009c76e5a5", "value": "ac60b43d159dcac0a93ac6dd12ce0bc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a4aa4f-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884830, "uuid": "9fea871d-ff48-41e3-800e-6bd766c0d766", "comment": "Malware payload", "value": "ddd9a2c6eb299eb1575ee8a0e8c2dd94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884830, "uuid": "0ebf8082-7381-4d14-bc49-ea30c527b29a", "comment": "Malware payload", "value": "9b005c4a4c45e8e57cc56ac58df805bf3e7f4f932c327ed68417753944b1b078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884830, "uuid": "c8afe897-f63a-45dd-8f33-80892d494ec7", "comment": "Malware payload", "value": "8e96a9edba1447a6ae7ea8fb38ffed8fb345b77d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884830, "uuid": "fd6c237a-f4f6-48d0-a2e3-82290450b90e", "comment": "Malware payload", "value": "87e8bd330dc4adcc88c01974b8179356042b5f27b7824e51e8e0aec05305a2e12dbe4a59e388b9f0b89b6f06a6362435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884830, "uuid": "18486fa5-43f0-4ea9-ad1e-02f5ce503da4", "value": "T181340882F908DE7AF00FB67504D34F38A774AFD18A53C662732B759299371C29A17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884830, "uuid": "4dd65f45-a150-40f3-a59b-fa2547a18009", "value": "6144:lOgduRuHOR54yW2J3v+T0T7sD31I3M6LO5QWiw:cgd6RJ3vlsD31I3M6LO5Qhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884830, "uuid": "d0fa8d3c-84b3-4ff7-bba5-b81d38cb9b2d", "value": 238855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884830, "uuid": "92759a15-e6f3-4d3e-98db-fdf9455fd4d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884830, "uuid": "1db2421a-a9f7-48c4-b437-94b221840309", "value": "ddd9a2c6eb299eb1575ee8a0e8c2dd94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8a19da-2a00-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633894235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633894235, "uuid": "4f2b85fc-6c5d-4deb-b091-7fc503142c40", "comment": "Malware payload", "value": "a4d23ac3c7172b9aa02e35b6bf0fd21f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633894235, "uuid": "f94c9882-ac36-4644-9b44-2c5d90932a11", "comment": "Malware payload", "value": "9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633894235, "uuid": "fc27af4a-d7aa-48c7-a845-f46bc8d76548", "comment": "Malware payload", "value": "0326aab7deddfefc048c9a67ac9ce4ee14ea9003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633894235, "uuid": "7d11018b-32ea-4e16-ba89-59613cc33a7a", "comment": "Malware payload", "value": "a6fd2ecfa8180c8be14bb5e6b2bfed730635930ea210824f8b637c82ddd6f2f1d53c31cdfa5c56f665425fc6d130df62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633894235, "uuid": "62a60b4b-faf8-4bd4-b543-4d218e547b77", "value": "T1291633D97789FA73D0CF40B940B1DF4A0C736BAC1C176941E3A39E5A5E1AE513A2A1F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633894235, "uuid": "37cdd997-6c8d-4081-be4e-ce0d288ccb71", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633894235, "uuid": "6f013602-e377-4ae1-ba66-df2779876939", "value": "98304:JwOLAdLUm3WFTzOzZfkT2Ribt7xkk49JBLHInas2Xzr+:JwOcN3mWZfkTIibtik4honas6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633894235, "uuid": "253f4004-76a8-477f-bf82-014bcccedb44", "value": 4054502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633894235, "uuid": "05c0eb68-1e3d-48b7-bff6-f7d22b9ff44c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633894235, "uuid": "9a1368f0-5a21-46bc-9814-5b2ed7c47e0c", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a64cb9-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856349, "uuid": "a37c95e3-544f-44cf-be0f-0dfcd8f8f0e5", "comment": "Malware payload (Gafgyt)", "value": "1dc677528debb443c9f2cc1ae7abf54a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856349, "uuid": "31deba29-ce4a-452f-9663-7e4dfbaaf7d8", "comment": "Malware payload (Gafgyt)", "value": "9c10a80b790d9910f2f81b00ee862e6c5072f9e47f67582b198a20c44bc2c192", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856349, "uuid": "03738417-bd28-4cde-b59d-5179e6e3f49d", "comment": "Malware payload (Gafgyt)", "value": "d431fc80439522797d1b8da79bfbff17ad4a225a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856349, "uuid": "6d6c90e9-c2ed-408d-8965-a9b7f2c07888", "comment": "Malware payload (Gafgyt)", "value": "89eeb5ac6bc0dd234b979cc4a1d5517dd030b670540b4014913dc3e201457afcdeaa1dcb7d8e5f8ac52cc83043aa48e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856349, "uuid": "aaa15678-5563-48cb-bfa5-11dbb72fb3f1", "value": "T128C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856349, "uuid": "8a6aa0b8-828b-455a-894a-654dcae4cb0c", "value": "3072:/YNa/GLBNPoQQphakniQ9/nYEP/UnSQf/R:6a/yloTphakn39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856349, "uuid": "3efa8428-bdba-4c0c-8c7d-4319dad4caa4", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856349, "uuid": "5de6de27-8789-443b-9cd7-2b055bd8f0ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856349, "uuid": "68c5ed5d-e80c-4327-a608-221c851900c4", "value": "1dc677528debb443c9f2cc1ae7abf54a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d34a49d-29e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883878, "uuid": "464099d4-5533-487f-b4c8-7693d81c3e86", "comment": "Malware payload", "value": "a28a7bb6ff19c354b75caf06e10ca743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883878, "uuid": "86d529f6-76e3-44db-8cfe-507776a11a3c", "comment": "Malware payload", "value": "9ce2bcf352b7447db1f9e4dda3442ff8f0c026b72c56cc980c3db1110d1226a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883878, "uuid": "e50c9f13-9013-4b08-a24f-38f1109d963c", "comment": "Malware payload", "value": "2d5c745c7e9d1059da2debaba39dbdbec7df0577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883878, "uuid": "13c8972a-44fd-4b93-a164-ec560a959b33", "comment": "Malware payload", "value": "49b0dbc9d1cfbb1d83e3d7fec6e3a6524804056671c8b420d4c00c941341e0637440613d901699e78c716febf1789a47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883878, "uuid": "974c21a8-6ca6-4175-8aba-20f2ba7bb1f9", "value": "T1E413F16D110218F8EC379E3ADAC50253A91A8FD97B5DEC0B3EC59F57CD205413AA39B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883878, "uuid": "f67eb608-b4ea-499d-afa1-66cf72a0770d", "value": "768:DL+NK672iw0tuOREaBu5VjsYs31k9XAt3/+/73ssJgGlzDpxYsNLQ2X/D9A0O5:DCNKi2NuTngbQ09+/6bskVrYyBX/D9/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883878, "uuid": "b06c615f-a214-4635-af43-467b421dbe56", "value": 42008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883878, "uuid": "47887a84-7937-46b2-a5e5-091d455ad460", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883878, "uuid": "fe25fb65-0e24-47a2-b647-6f63b0dc43b5", "value": "a28a7bb6ff19c354b75caf06e10ca743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583b84ca-2a0a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633898445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898445, "uuid": "bf65bd52-e703-4173-9029-cdceff6768ab", "comment": "Malware payload", "value": "ad74dda467f62cf8e37226ecb0502ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898445, "uuid": "3577ef75-b01f-4c56-a4cf-1c2cc95054b2", "comment": "Malware payload", "value": "9ebd2db021e7423ea13def07da2e9fe74828d065efefdff99452520af41d725b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898445, "uuid": "9c8aef05-2a4d-4dec-af5c-490abe880055", "comment": "Malware payload", "value": "6c815a7804e791586c061a4b67b0cc12329df653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898445, "uuid": "e6dc0abe-975f-415f-b4fa-c593a69a218d", "comment": "Malware payload", "value": "c30d8cb3334290a4aad36fe823f838ba0505831f9648f206d79525765df40324ad8104438e8ddaf1b5b79fdb113faccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898445, "uuid": "a45ff4f8-99e2-4380-9301-3cc80afff891", "value": "T15F747D10E7A1F335F1B312F949BB9268A5EA7DA16F2490CF52C52ADE56306D0EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898445, "uuid": "7f32e5a3-9939-44b3-bc19-872d594c1fae", "value": "d8470aebc2200bafc1ff60318f406103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898445, "uuid": "5593a8e7-f322-492f-a7a1-d58324da4535", "value": "6144:oUunuCA8dZbYFMVUA0vHWHsNV7BLZZ28:7P8TbyMVU9vCsT7BVw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633898445, "uuid": "50296b2e-adb1-46b3-990b-66630da5e46b", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633898445, "uuid": "8b91e470-fd5d-4e7e-b496-87a170a82ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898445, "uuid": "306277d5-167a-4b1a-b0f3-7a5f01e5b9c9", "value": "SecuriteInfo.com.Ransom.Stop.Z5.24076.3842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa1d51f-299e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633852171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852171, "uuid": "662484ef-b068-4cbd-89b3-2b07e5e34ea8", "comment": "Malware payload (Gafgyt)", "value": "398f178ce40d726c597eb2abd6b5e4b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852171, "uuid": "367613c5-6c91-4cdd-8b89-daa0e3b15d33", "comment": "Malware payload (Gafgyt)", "value": "9f239c0f321a27ad46d955101688c56883f9dcdcaa786621c2fb736287cb9c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852171, "uuid": "abcfc572-a361-406c-b753-1dd412afdd07", "comment": "Malware payload (Gafgyt)", "value": "6641d54ccfa72ffb4e5b75e76fbc64e867dee665", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852171, "uuid": "86612351-1bb9-4094-9f3f-3633be3ea3a9", "comment": "Malware payload (Gafgyt)", "value": "26522c069060117312988d03bfc1c08b82f756ee4336f62ea95f4ff88949eb74c5be3d2c8ee4c8b9ca9a2b1b5a9840c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852171, "uuid": "f475f830-7101-4165-818c-6e7737fddf55", "value": "T151E34B09E6408B57C5D2277AF7CF424933239B64A3EB33095938ABF43FC27A94E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852171, "uuid": "7944a481-8a56-4d78-a69d-fa2b929d9ae0", "value": "3072:2dsuRa3CFH05+8tCC935B+0snCRiM/9ckRmpwfvRQAZn:exRa3CFHo+I93H+JnCUM/9ckRmpwfvag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852171, "uuid": "2328c90f-9dd6-4496-9940-fa2fc5c609a3", "value": 155009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852171, "uuid": "15b15443-5fcc-44bf-acc2-6363c72e4f59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852171, "uuid": "f73ef318-537d-47af-a7af-fdff13d73372", "value": "398f178ce40d726c597eb2abd6b5e4b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fad3b5f-2992-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633846838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846838, "uuid": "99d17102-4fb2-44a2-918b-1c69a0300002", "comment": "Malware payload", "value": "a7e0120630ced8018f8d12ecbbd42d63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846838, "uuid": "cbb2b6b4-8f3d-4f43-9403-84643560665d", "comment": "Malware payload", "value": "9f4c38543f913a418f52d68c64fa4eda1505b33bc4e43b7e6cd7d03abbbc1aab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846838, "uuid": "014dca6f-8121-4b86-9586-ae4dbb6449c6", "comment": "Malware payload", "value": "00d355243639dc7059b296806d29dd85af8224db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846838, "uuid": "91aa8404-7ea6-4b84-b5b1-6f26f782f3f8", "comment": "Malware payload", "value": "5d65ef958932fda9e33a23436ad61519bec2b9e74ce33d8c397954568990686c92fb6eec9abb3c0bdd8ad3e3275a842d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846838, "uuid": "3f1f6a8e-ffa5-4517-87e8-0e5983bae62b", "value": "T1D5F2E1353316A2EDE53254F145A407883AB50FF891D3BD039623E2D7AF550AEA493EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846838, "uuid": "961c1ce5-a7d3-4a58-8d1c-425f5641054d", "value": "768:hHkmWBWfJ1WnzqzmH81AnYgq2XLRIiG5IJgGlzDpxYsI:hHz1OGmH81AYgziIVrYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846838, "uuid": "22cbe23b-6a45-4be1-8b20-921b312566a0", "value": 37280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846838, "uuid": "df574fb3-8ec8-46fa-99eb-0b066403147f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846838, "uuid": "58b8629f-8250-4bab-9952-51f279893a2b", "value": "a7e0120630ced8018f8d12ecbbd42d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7cfa30-298a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843474, "uuid": "0079e083-5962-4be5-ac29-3c028e83a460", "comment": "Malware payload", "value": "0a79487ebc1e939b6389c92960c15300", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843474, "uuid": "142bffa8-0cad-4d00-9fcb-9e10a89d8a5c", "comment": "Malware payload", "value": "9f4e48e322468f523fe9eea71738bebe9a16d80bc95969504ac8a1a1462cea3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843474, "uuid": "53cda341-30c5-4cc4-9112-3c61048430e7", "comment": "Malware payload", "value": "e4e32fed3287ed7cbfc805459fb569b9d3f7a9e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843474, "uuid": "906c43c9-eb03-4e3a-b91f-658c0492e142", "comment": "Malware payload", "value": "35aee6a3cde1a4be1119775f25c83f8a65e319f1f9946d44d343c2d2b025027a37ec13f25cb1d8420fdea397ad36ff35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843474, "uuid": "d50284da-51aa-4d47-bf78-cbcc494b7ff8", "value": "T168830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67992E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843474, "uuid": "3e9b36bd-7f7d-46bd-a939-930e2fc7993e", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1f8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3J8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843474, "uuid": "5475fad7-87da-489e-863d-efcdcbb39ff1", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843474, "uuid": "65b3ca56-14f4-45cf-8eae-6c7f473271d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843474, "uuid": "e06b026d-8499-42f1-88b0-1bc8b3a40b7e", "value": "0a79487ebc1e939b6389c92960c15300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4822a0-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633866567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866567, "uuid": "d464fc56-bb50-49f6-8a44-44fc62d433ec", "comment": "Malware payload (ArkeiStealer)", "value": "8317ff2b4bb06eeace6c94685af5ced9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866567, "uuid": "b05d6284-d0c8-4982-a550-a9764cc82559", "comment": "Malware payload (ArkeiStealer)", "value": "9f7ec3f3f79487db03b9051d9b8fad8a199c2a53905c5cf19d0fd9ad90f58ec2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866567, "uuid": "9c6bbb17-75a1-4c92-adc8-0f962f9a13f5", "comment": "Malware payload (ArkeiStealer)", "value": "577cc6dd7d11e06c1c8c67610cac7cff90daadc4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866567, "uuid": "4b122b54-d93d-4133-bbc5-5e3de0825c52", "comment": "Malware payload (ArkeiStealer)", "value": "f7b8199b8bf6ead680dfab8819820e0447cd92c3d3d7e5713c91c9c1dd9e3b57d6817b84ca46dc209fce998251159fad", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866567, "uuid": "d992456a-f306-4f54-89e0-a20b399a282b", "value": "T160F4F110B791C035F5F712F849B597A8A92E3DA1AB2495CF12F12EEE92345E1EE31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866567, "uuid": "99fe3551-744f-4216-9019-83f699e1498a", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866567, "uuid": "3dc093f7-6f6f-4731-8614-a2e4ff20b501", "value": "12288:RCyxwcOnYaFoByqndunR/TQpaumB9pds4DB20TJGcwJfnJ9sXjnFSvkHCCEz:4WOYXByqndunFrZB1s4qcwJvs7FL5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866567, "uuid": "b936634c-fc18-4f77-901d-9a8adda26eef", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866567, "uuid": "6d2f939d-5a49-401e-b798-5914dcacd4e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866567, "uuid": "73542e4f-291e-4c62-9db0-2e88fc4155b5", "value": "8317ff2b4bb06eeace6c94685af5ced9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5166d7a8-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884261, "uuid": "781677be-2322-46f9-8a2f-213a5270ab19", "comment": "Malware payload", "value": "a1ddc6fccb21affe31b856818b3bf133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884261, "uuid": "a6fcbd30-0852-4c4b-aa11-70027c1559a7", "comment": "Malware payload", "value": "a043c25b3ecafdab2b2f81ba1b9957e45c1de4857a72c4bcc112a479ef0b85d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884261, "uuid": "2eccd99b-632e-491e-a101-1e91a70bce62", "comment": "Malware payload", "value": "ceea33bfc1f6eacaaf747ff0fb0d203acdb1692e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884261, "uuid": "f184cc0e-e174-4484-8615-5e12a15173f8", "comment": "Malware payload", "value": "6bcb02e75e16437a23e75d78cc1cefa89a16907275a9d706e50ec33dbe6666e4663a96e500bb9e42a880d7379843584c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884261, "uuid": "bb62caa1-4747-4b31-a3df-5be5428e8c14", "value": "T1F003E0A0A38DDFADC8E242714CDF38CB4C28F04DE7B155A362EDB87744B19611358A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884261, "uuid": "53980c30-35f8-46f4-a3d1-1e20ca28e1b4", "value": "768:jV7HvdJdoERLk7M+dtMfKgcNE/ho5knbcuyD7UryqHyUqpGbIFm9m:B7PvdvRL7/hmknouy8mqHvWGbFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884261, "uuid": "287d479a-338f-45f0-a7ba-cf253af1557f", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884261, "uuid": "b42c7bb5-f54b-4a46-89e2-32a50e7bad21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884261, "uuid": "3497fe18-480f-4ad5-b07e-6716b75805d1", "value": "a1ddc6fccb21affe31b856818b3bf133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533f940e-29d7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633876533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876533, "uuid": "054089f8-f911-4244-8a3b-5b41d0893243", "comment": "Malware payload (Mirai)", "value": "e55a635af9ecf346b217fade892a33c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876533, "uuid": "09dacbf6-6753-44e7-b6f5-f10eeb6c56fc", "comment": "Malware payload (Mirai)", "value": "a0c4c88159905bfff41f098cc8d1c251e887de2c25ec78963f7505b75d3d33bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876533, "uuid": "6a907ab7-de16-4da3-b1a4-2f9b2260c1b1", "comment": "Malware payload (Mirai)", "value": "22b6bfa5e37414c67f618ef89f8d9c2f870f5ff5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876533, "uuid": "48fe4713-c770-45f7-bcdf-66ecb12b4a4b", "comment": "Malware payload (Mirai)", "value": "9b2cf1119497549e3d1799e60d0f302db59049c37fce16b9a9931fb95a3ad315c1e47b5592fc595e5ee3fbf181ab7be6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876533, "uuid": "97820b57-6c1e-42f7-91ce-b8c84ca73154", "value": "T15DF2F1525346A4B2F33219F2FD91CAC71B150AF4A08E30E1DE457A29CA857C16EDDF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876533, "uuid": "63c1fe31-9e2d-44e1-b953-300d3da01bf0", "value": "768:m2WTfRwfxSTjnCRl246UA2Qz4pZyZfCW25J7pEL9q3UELxO:0TfhnL4hbQzaZianpEqLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633876533, "uuid": "34c06cee-023e-4bf5-b184-95eae0fc1c73", "value": 34592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633876533, "uuid": "ae9184e0-444c-4e91-ad47-20c721939390", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876533, "uuid": "881bfa00-602c-49e4-8cb0-f1e0cbf0e47c", "value": "e55a635af9ecf346b217fade892a33c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c575dfad-29f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890039, "uuid": "95bd7cea-f8bc-4abf-a8b3-19c95e96f515", "comment": "Malware payload (Mirai)", "value": "968de0d228d6ec6255eefe98184ea323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890039, "uuid": "0f0e1a12-21f2-4206-8e5e-3c88b2dc012c", "comment": "Malware payload (Mirai)", "value": "a111277841d617b305095440addc01966ce51575c0bf655ba55ba44f13691e35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890039, "uuid": "699ca197-1e33-4537-9816-fbf2503621ce", "comment": "Malware payload (Mirai)", "value": "d61294fb7e88eb607bff3973a3ae38b26b636b9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890039, "uuid": "407f282b-1fae-4472-80eb-8ceed70bbee4", "comment": "Malware payload (Mirai)", "value": "f19daa960cd83982aab3d0b71f8ef2caf1b8fd71163a01e15abd81168a3a7156b64237a1d65d9050e0b9d1a18f246722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890039, "uuid": "ef9517d2-88c3-4b87-9637-907b6633176d", "value": "T13D238419BFA54FB7DCABDC3705A91B0124CD651B21B83B297934D828F20B64F59E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890039, "uuid": "a5ffe3aa-00b2-48cc-b0c2-789e46b67b5c", "value": "768:r30CZqXzSWX4RzWeU5poeye2OeJbannhX6VjXib8HP40KHbd10H:r30CGGW3wHPOibannhXAYiKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890039, "uuid": "0f907b53-6440-4d85-90a5-5a4aba9b6be0", "value": 47136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890039, "uuid": "c4a3992c-77c9-4044-8923-a2f0cac8b074", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890039, "uuid": "6132f9a8-3a9b-420a-aaa4-b0b6b434fa89", "value": "968de0d228d6ec6255eefe98184ea323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5c557f-2992-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633847101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847101, "uuid": "b749e792-8e2a-4fec-b32c-305c2266ea9a", "comment": "Malware payload (Gafgyt)", "value": "1a962439505492dfeb105bd333c7ebfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847101, "uuid": "e3509349-7c6b-439d-b32b-c8891f81da30", "comment": "Malware payload (Gafgyt)", "value": "a279b14f3a886f6c8334e985a4d5c1530d634720cae2baa7eebc7c88c6c2aa2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847101, "uuid": "e6b5184e-962d-4838-b81b-c52e061f4ecf", "comment": "Malware payload (Gafgyt)", "value": "d84cd94fe14a23ca54eed66c5875195c922944fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847101, "uuid": "d2bf5235-9123-4a5c-99b1-8d136d4a2e25", "comment": "Malware payload (Gafgyt)", "value": "ee12662636170dc3b8b7f80881e9cae81e1f64fbb71d691544a3f919718afccb7a850c0fabc4b62b5081c9cb6ddebc8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847101, "uuid": "b78e720e-5e2b-41b5-aae8-26ccbb900060", "value": "T1E5C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847101, "uuid": "d4200cfb-81ee-4103-9815-17fed7a453bf", "value": "3072:ekYPUfsgnsb0J2ag/VfSkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0SkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847101, "uuid": "22ede67a-a87c-48d7-95ce-465c05712854", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847101, "uuid": "8bc91d15-5cf6-47a9-aab7-84da85df1174", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847101, "uuid": "85684e21-6e55-47b3-af92-bb3bf55c141e", "value": "1a962439505492dfeb105bd333c7ebfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219bf9ff-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633866571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866571, "uuid": "f7acc8e9-15b4-4f6f-b70f-14b5172ff13b", "comment": "Malware payload (ArkeiStealer)", "value": "8e5264b96f37d907077bbb8683be2985", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866571, "uuid": "79f192cc-d2ed-4995-b019-175c3dc88bfa", "comment": "Malware payload (ArkeiStealer)", "value": "a2872c8f6a4e0bf3538f83c8b7660d5c2b0cacf643a847faf0695b2a717ab317", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866571, "uuid": "e7b8b016-a5d7-4ab8-8361-76cee5f61716", "comment": "Malware payload (ArkeiStealer)", "value": "7e36a413cfbd14250aa8d6247be90152040a0a9c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866571, "uuid": "10dcdd43-b5bc-4a30-81f3-337100ad1aa3", "comment": "Malware payload (ArkeiStealer)", "value": "90daf330ca74d5939bea8225192ff172066bc3eb82f10b7022d376f3b0fe9016745441d2c3b8420113865a7770322bdd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866571, "uuid": "96d9f9a2-08d3-40e7-92a4-c6097d3e9d03", "value": "T182F4F11067A0D039F1F726F445B95379A93E7EA19B2498CF12D19AEED630AD1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866571, "uuid": "ba4536ab-baaa-4ee8-90b0-047f801b8869", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866571, "uuid": "7c346f85-405c-46ac-8569-ae33f28726bf", "value": "24576:n5N6Nxu3sxwfyQh/qghSyfEaZwawAJD8xO:n50zucxwLVqghFEaZwmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866571, "uuid": "6552d3ff-6c8d-479d-8df8-94c374289697", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866571, "uuid": "320a8991-222f-426f-a1c0-eeb01e23bb0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866571, "uuid": "7141e7eb-79dc-48a2-b275-aeeb2fb66bcc", "value": "8e5264b96f37d907077bbb8683be2985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62b0eff-29ca-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633871223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871223, "uuid": "1eedca71-e2de-4323-adb8-ac4a23787db3", "comment": "Malware payload (Mirai)", "value": "4f20227626a6811d1f8e723b4bc04c0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871223, "uuid": "c9ba7661-bc6e-415c-9ade-5f7323f850d0", "comment": "Malware payload (Mirai)", "value": "a33c0643d553e40eb77f441c11346d27b64bb226ddf49c279ad2813e105707b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871223, "uuid": "aebad5aa-94b6-4c82-b3fd-6e3bcc5025e3", "comment": "Malware payload (Mirai)", "value": "8edccd4a364f8ec3b317ea3145127cb5de7ef79c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633871223, "uuid": "efa1d4ba-3b4a-4e61-bfbb-d76d0a4293ef", "comment": "Malware payload (Mirai)", "value": "638258c96a08bc0c480440bd23226ddfce4878b9981c07f5daae0a45c1567fe970652c41e489732b922fc1c90f392e99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871223, "uuid": "e83220a2-2dbc-48a9-9189-a05d168ef032", "value": "T12F73744D3E319FACFBAD863447B74E21964923D636E1C584D29CEA011E7034E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871223, "uuid": "269ab888-2d7c-44af-9c91-ca1f99ece87e", "value": "1536:dqihD3icyt1dt2sQZAfnksFBhiQ8wadJ/Hn0EZmGaOd5ZDrNA:siN3Ryf2lAknJ/Hn0EZmGae5dJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633871223, "uuid": "000a3d24-570b-4611-a9d5-4a429351bc28", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633871223, "uuid": "0d3f91b6-72ea-4214-a819-57e7d94111f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633871223, "uuid": "90b3ad27-70a1-4e7a-8808-f8242c7f8549", "value": "4f20227626a6811d1f8e723b4bc04c0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c27bd94-2974-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633834028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834028, "uuid": "4a25e12c-bd21-4126-bace-ce869519995e", "comment": "Malware payload (CoinMiner)", "value": "31475e9afdd7c8effe32efa217120b30", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834028, "uuid": "f3a3eceb-193d-4fbc-b175-ca85f7d6b08a", "comment": "Malware payload (CoinMiner)", "value": "a42f294adc0ab6382f374ae7f2792a83f37ef79d149deed12c3bb9feeba7b8be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834028, "uuid": "eab3d88f-2958-4b12-b8e4-8fc7acf5cc45", "comment": "Malware payload (CoinMiner)", "value": "b04b4afeb65f9b161886025ebc01b3043f0d3303", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633834028, "uuid": "5d05ae5c-c382-4f64-b7c3-6c696f12b281", "comment": "Malware payload (CoinMiner)", "value": "6a06ea5a3127f1a0191078a1f624391a4f08cf3d336c7f0217fc1839b5c8dfe856d9ff4c2d400aca8ea813fc8724eab4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834028, "uuid": "fda42a67-166c-423f-acea-546b53ea3270", "value": "T1A2E4F195B50439DFC857C4B2CDB95C20AB707C3A831F4203A05732AD9A7EA87EF655B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834028, "uuid": "339803ee-5445-4199-8ad1-b7014dcc0c16", "value": "12288:TWZWXYUQYtNrXwQcpP289FbX1LblEo9LSfYMFj6IRJVdTK:TWUoUrrJIBFbxmo9LQjvTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633834028, "uuid": "2feb3bfe-4650-4c33-bfc6-a83cc1cbf6e4", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633834028, "uuid": "88134d6a-949c-4da4-9580-5bfe00f90f1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633834028, "uuid": "71fb4d62-c0d4-4db6-a489-0183ab08b220", "value": "31475e9afdd7c8effe32efa217120b30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5410f73e-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884265, "uuid": "649240fd-75d9-4c5c-86fc-9afe494ed56f", "comment": "Malware payload", "value": "15934f8c7e789b8c205cbeabf39e1185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884265, "uuid": "6693556b-e1be-4e0d-804c-e2bd8d33cdba", "comment": "Malware payload", "value": "a461c9e7afde79a8867b25daa17c83716883a9447fb8d9cbca5f0ff8ebc4dcdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884265, "uuid": "ac6f56e0-942b-4c59-ada1-3d1b882a2587", "comment": "Malware payload", "value": "40150fc1aa58507dade060a1bc5dc0006bd4d97c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884265, "uuid": "47b61e77-41b1-411c-83f2-3026b7f90d14", "comment": "Malware payload", "value": "33f0bf4cb596a6811ec3ead1c55799e5e99f1d6b588dfedb6c341efabbfd1954298c31c66c2fa649dcb9e7ddcafc0f43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884265, "uuid": "61be48fc-3b86-4679-b91c-b823039fc57f", "value": "T17203F16293BA6C2CD4BF4DF06DE81B0257E6DE921B56E1B936159FB40412A3353843CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884265, "uuid": "0452d00c-1696-4299-b81d-39c3c2ad9b51", "value": "768:7hECa/Zo68yjwEKX7atJN5GrweB1eQoHq4uVcqgw02NWXoQHQa:lEzZo68Iw9rwzUpBgq4u+qgw06WXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884265, "uuid": "3b6824c4-1071-4ad3-9479-ace5502dd3b7", "value": 38308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884265, "uuid": "2beb576c-0408-46c4-aff3-6962bd5738d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884265, "uuid": "fa5cc209-fee4-461a-9b4a-57a0b2b51d1b", "value": "15934f8c7e789b8c205cbeabf39e1185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874da833-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866742, "uuid": "2327a5c4-b80e-43be-8549-880790e47460", "comment": "Malware payload (RedLineStealer)", "value": "36841c10797b63c848f336cebdf8a8c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866742, "uuid": "683883b7-d32b-4ace-b136-ffe0a8bce36e", "comment": "Malware payload (RedLineStealer)", "value": "a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866742, "uuid": "0ebf4c22-4a4f-45c7-8c16-02945ac602be", "comment": "Malware payload (RedLineStealer)", "value": "a5b55fedb6e746db7bea4a84dc1a53db9f1a1cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866742, "uuid": "3fbe4baf-aa8a-4760-8823-334277e195f0", "comment": "Malware payload (RedLineStealer)", "value": "81976db21860d17d95905bb3230b9ebd1306a0965ffdfff25992b88b5524bb9c534b1d828f7e3258008a00521371f45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866742, "uuid": "e30c9a35-ac9f-4853-9db7-9145e133cca4", "value": "T173E5CF053D0FCA52CCAD09FCA83BD6E453567D40ACADE0B3F56A73AB1A30747D666248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866742, "uuid": "e68100d3-f2a3-4d52-9baa-885bc6132189", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866742, "uuid": "507935dc-b765-4fd3-8843-93209152d204", "value": "49152:dUhk9BRVvdWaiicHkZf8hu/QplVxK32K8QE6:dv9BRVvU+EnpnxK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866742, "uuid": "1c33a4c8-1645-4101-a4d7-5026468b105a", "value": 3228160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866742, "uuid": "6a474f60-0a03-4918-a34a-deda760619ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866742, "uuid": "66e351de-ddbb-4ba2-a961-342db7c35ea1", "value": "36841c10797b63c848f336cebdf8a8c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3e1711-29d2-11ec-843c-42010a9c0014", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1633874617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874617, "uuid": "092323c5-79d0-4557-8fd7-da1d9827a65f", "comment": "Malware payload (YellowCockatoo)", "value": "df7b2ece343c52df774d72e12ea09009", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874617, "uuid": "60aa8fa7-8371-4665-8972-527e8b5cfb12", "comment": "Malware payload (YellowCockatoo)", "value": "a57eb7bfeac633b9312c6490499f40e654cb1b8d68388da4ce63314cd6abbbcc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874617, "uuid": "e82c57b3-e2cf-49ea-b16e-13a338d88f77", "comment": "Malware payload (YellowCockatoo)", "value": "a3e03f4856ba5a113183324cb6c7e1006cf87854", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874617, "uuid": "3cec7d5d-e3de-41f8-a249-47fd9e878019", "comment": "Malware payload (YellowCockatoo)", "value": "f1767e7808e7ce1b1082e7ce7516ef102c14264d63a7771ba9f8d9e6a626e2aea89d3d1b7acaf1db9ed9b52e63eaff9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874617, "uuid": "a083ec8b-8a01-4833-af59-a378b7be1d1c", "value": "T17513F80D26DA4296CCCE9FFA487196164734B0039707FB9D0FE591B62F93B22CAC915B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874617, "uuid": "896a15ad-73fa-43b0-b308-fa71031118d4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874617, "uuid": "f4882b6e-d431-4e1f-a6e8-f41dfc2f522f", "value": "768:puwiggzojg3k+pqrjb6neFJ2sjo9RcneUWFc:puwizMg3kqqrK4o9Rceu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633874617, "uuid": "ccde71dd-c289-4c22-9e0a-1ac654749604", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633874617, "uuid": "7569d343-606b-4b57-8a8b-a26e18db6c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874617, "uuid": "735f136b-e080-4a35-8c84-7b22c9a7f25b", "value": "bdacd092-ecb9-4376-98e4-185a61b8c6f2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5930e7-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "757038d0-f3d0-4f85-836f-0cbdc154aaef", "comment": "Malware payload (Mirai)", "value": "92b2eb91c06cf1ce766d6403b9f32931", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "763c82ec-ac00-44dd-b86c-1585ca326f78", "comment": "Malware payload (Mirai)", "value": "a5dfd191abd203f34261132ae3c27c0ff6656ca0df46e27142bdd063aeb3e01b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "5b93f22d-5c82-42e8-995e-25934c7f8f42", "comment": "Malware payload (Mirai)", "value": "29eae64bb8bf5a35275fbb42aa8ae3a77d6b690d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "57679641-3f17-44cd-a210-4730115e3c0a", "comment": "Malware payload (Mirai)", "value": "a6ecdb9f60152ce3b8fc93e2f4f3698bb0d04b8df57f568170e9e329012f1214caba37213948e6fa34e7fda5f7c80c8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "21f7ce8c-8b02-4682-a591-9fdb7aba5be5", "value": "T17EB2D018FEB20D26C531447FACEBCB4363DB067592B9277B962817417AD102DB6B42D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "a2f989e5-0961-490c-8f46-bdd3bd68ce32", "value": "384:FzAPNTwTuRIvzGPsDmJStcTKkGW6JArbQ7HEotP6VeB2MUDNMLRQGC2dhymdGUo+:qTSYIvwtStcTKkB6mrbQ7HEoP6VeB2IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877409, "uuid": "ed7b545b-30e4-4ee3-b34a-822cf71a8497", "value": 24400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877409, "uuid": "5a9b7317-849e-44b5-9fcf-83e42826ec11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "856d7964-1989-4739-b9c3-67657ad13351", "value": "sora.arm-20211010-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfaee5d-29d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873945, "uuid": "a2dd334e-cbb2-4979-a44f-f86cb3fdcb36", "comment": "Malware payload (Mirai)", "value": "346cd9bebbd2ed9d86be95b1a09b15ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873945, "uuid": "f2af902f-50aa-436d-9924-331077373f5a", "comment": "Malware payload (Mirai)", "value": "a69f714943c47b8464dd2d4a9af8e22e0a0de973d0ac0d01918f9ec9a13599bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873945, "uuid": "674e70ea-06a6-40f8-8626-0ffe202d4873", "comment": "Malware payload (Mirai)", "value": "314526dbe67f02a08dbbff0771628b9a697aa28e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873945, "uuid": "0d75ebe0-4087-4742-9ff5-bf9a8f45858b", "comment": "Malware payload (Mirai)", "value": "3be7ebaf609c61d383d500e3fe7d194711e6303423c0dce01af0101fdc890ed9fad175b961526191f61cd2a042b82d1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873945, "uuid": "9abb0bf9-a30a-4918-a458-05daaa39686b", "value": "T1B8A2DF0825CCE972D1B0943EE23DC247FEDB47B652FE323A1E180799A494916D3BE845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873945, "uuid": "cc4fe92e-4e2b-40de-8abc-21d34cfff3c3", "value": "384:8mmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbbhymdGUop5hXi:8noh/DxCvhdR4IjWVFbSXs3UozJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873945, "uuid": "618997ac-fc40-4cf4-afe1-bfa76ed30a58", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873945, "uuid": "326adb29-6ed8-443d-921a-89cb7cfe1f84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873945, "uuid": "19a69c73-9339-4b3a-8eaa-d4f2c122f8ee", "value": "346cd9bebbd2ed9d86be95b1a09b15ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc76cf8-29e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633882882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882882, "uuid": "56856321-24d4-4318-9daf-e040ebc628ac", "comment": "Malware payload (Smoke Loader)", "value": "1b4fe1aa33ce4b0e1813d355aa8af721", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882882, "uuid": "42baf877-158a-4140-a316-11534bf0631e", "comment": "Malware payload (Smoke Loader)", "value": "a6ba2757626667ec6ecd5ff3979b19747d28bbb0d94f45a1697eda7f8545e168", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882882, "uuid": "a5cd3530-f08d-4781-a01f-53db2fc89406", "comment": "Malware payload (Smoke Loader)", "value": "cd4d14ee462354bc6c0df3a9da90dbe1de90c0b5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633882882, "uuid": "ae3b45e1-b831-487c-9189-47e9d86b8e9b", "comment": "Malware payload (Smoke Loader)", "value": "9a8d8377227a4b0bb873ba93d4b235429455a94085b20b5e949171388ba966c14e46825c897cb1320e6f5f553df8df3f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882882, "uuid": "90d80eb0-9669-4a23-84aa-3ac788a57cce", "value": "T100748D0076A0C035F5F21EF979BA52B8A53E7DA15B2490CF52D42AEE5678AF1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882882, "uuid": "8c7a8679-f370-4871-a396-aa539dd11da8", "value": "2759338740611d60458b005743168e13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882882, "uuid": "bdb2ca60-4ca6-4cbc-af9d-cde6bb263eec", "value": "6144:AE4YCXZ2dDNG7NAd0foQAlcmw4dKaZyjE8p5:H4YCJgZG7NAqficmw4oawj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633882882, "uuid": "8b1002a8-25cb-4b17-a786-9c1934f4da13", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633882882, "uuid": "b6967566-6f94-441a-a422-5e2a77a72b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633882882, "uuid": "d63f639b-e0fb-489c-adae-461dd4772721", "value": "1b4fe1aa33ce4b0e1813d355aa8af721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b05e23e-2a13-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902208, "uuid": "1114a0ff-146b-4184-8ec7-09ee6bc71e56", "comment": "Malware payload (Mirai)", "value": "0c4c5a18c8baf4403526cf546f239c55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902208, "uuid": "2dad507b-0fe0-49dc-b9f7-7371f295cca4", "comment": "Malware payload (Mirai)", "value": "a7b6c71697bf97163ac938c6a1fa2d5e053fb48c3e0e54d4c4ac25eb469ee60a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902208, "uuid": "1d8f6f34-7431-4c68-a194-21ff7b369fd6", "comment": "Malware payload (Mirai)", "value": "3f8aaa74f8fa5c5e84204616e8771edd28896ceb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902208, "uuid": "942c0dd6-d6d3-4689-b115-e0f93f3925eb", "comment": "Malware payload (Mirai)", "value": "c25107f3588d0e603a664c63b275b3a535cfae69f622949315cffd1c9a041f9fa67ca96f4ad7fd54a114f205ad19da87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902208, "uuid": "fc9f1411-2c8b-4af9-bf49-6cf29b6e7c84", "value": "T1D0D2D1A95304137DC97E90F8176607A53D758F25A083EFAAA2C1FEC1EC405E47DA3AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902208, "uuid": "7bfc11e0-d4dc-48e8-a84c-58032ab61222", "value": "768:2yvYLznDEB2iC+sDqC6NtxsfzxPnNsGbpTX2JgGlzDpbuR1JH:xYnnDEBI+smATfp2VJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902208, "uuid": "d5ffefe3-8ee3-429f-8bad-6fdd7574599f", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902208, "uuid": "6b925c0a-0021-44ba-a36a-20ffb2382e7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902208, "uuid": "b541b44b-07d2-4a4f-af95-4368976f74ea", "value": "0c4c5a18c8baf4403526cf546f239c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e523aee4-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902977, "uuid": "cb546403-c380-4a42-94f2-d5ccd339d3d1", "comment": "Malware payload (Mirai)", "value": "e76d74b984bce4b4f1334b66b74a5992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902977, "uuid": "98099edb-3e15-4e9c-83b8-ec4787174bd7", "comment": "Malware payload (Mirai)", "value": "a90af864cbdb100ce4587c31445705f9ce774906aedae7b1f51fa5cafcda038f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902977, "uuid": "cdfdab5e-596e-4ac8-a217-9b53d1e51e30", "comment": "Malware payload (Mirai)", "value": "602081413c61fee54ab512fab215d1f8415fbd0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902977, "uuid": "a832bd9d-e6dd-4e3f-9b99-a845e23dec4c", "comment": "Malware payload (Mirai)", "value": "6d4f04a367933cf80a4e35f72c8561434315b76fd671c1bd95019eead02fe6d639277692f2804859da2656d69054e2ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902977, "uuid": "0a5a1d46-eab6-4e90-a26b-1f4c2238dd01", "value": "T120C2E07428006570E370053DFFADC6875BA790F482E431051A5457FEA64F896B9BB78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902977, "uuid": "dd2bdd13-0f91-4f18-95b2-ff6221206863", "value": "768:xRSa8ZS/L6rze3OXrFKg9KZrqoDug8As3UozY9:vSjFJXZBCJDuggz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902977, "uuid": "d3a59e02-7713-4697-9651-485a390ee85a", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902977, "uuid": "4597b715-db78-48f0-8548-d85869e97adb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902977, "uuid": "afe02076-91e5-42e5-a90f-500b25f2019b", "value": "e76d74b984bce4b4f1334b66b74a5992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcfac60-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633867206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867206, "uuid": "cdc1a382-6411-4541-9d0a-bc11f4f56d30", "comment": "Malware payload (Mirai)", "value": "a002750073a07b2b335dc3f7a7a9ddcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867206, "uuid": "f71c4c71-945d-45bb-9b5e-bfc0ad85bfb7", "comment": "Malware payload (Mirai)", "value": "aaf145b6991d3da491c5bc074c6a6a036d9ad5eac180118a68bf45de0a02af0e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867206, "uuid": "b5b3f87d-7a42-4c1b-8bac-a29ceb039e28", "comment": "Malware payload (Mirai)", "value": "712a6dd52b71f21c7ec07d4e309e573bbab4333e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867206, "uuid": "ba102c0a-9ce7-43ca-9fa8-fc971e64b986", "comment": "Malware payload (Mirai)", "value": "c6a946d533a6fed4f4b5fdb01ee23557b47f371072198d77e05b2f5936044e2e05b31f696204cbeb57b6a0db0adada8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867206, "uuid": "a753bda0-1478-48ea-b1ce-04e1cae79c53", "value": "T1CFD33B46EA808F03C4D51776BA9F424933239B54D3EB33069E18AFB43F86B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867206, "uuid": "7a5dc39e-e220-40a7-b320-0cf1ed25cdc3", "value": "3072:ZAkE/mrRdVKvc+uFer+LPJj1EsKugvAM/9Dor3u5:ZAkE/mrJicLFer+LPd1qugoM/9Mu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867206, "uuid": "d77fb48b-5648-41d7-b5fb-4e1caaae6ae5", "value": 130708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867206, "uuid": "6652b8b3-64dd-4c66-b23e-f9979e6e9cd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867206, "uuid": "dc430b9e-39a2-4c63-9783-28c8fe0da16e", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68245cbc-2a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906203, "uuid": "23a0428b-a048-43ea-a78c-4b2e31233f07", "comment": "Malware payload (Mirai)", "value": "3683cc2a41b1faaa7d17c2d2656f2e5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906203, "uuid": "2d30f8d6-58c4-4f62-8876-59992ba969a8", "comment": "Malware payload (Mirai)", "value": "ab062092aa3862779331418c8baf001feb4c4046a69e9a743c55228b951fc96c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906203, "uuid": "0d9d8d3f-5c0d-4e4b-b5ca-07072c8a7216", "comment": "Malware payload (Mirai)", "value": "a2d535db48ece83539608cbff02b38f789750640", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906203, "uuid": "efaade3b-c38a-487e-9e62-e4e9b7f178b0", "comment": "Malware payload (Mirai)", "value": "0350322dfc84ef82655b2d51df8cd1ed05c8908a8f8e0d0c1657c891473010fcb9c25e290f693b975f10a498df5f604e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906203, "uuid": "a1949bae-e013-4489-94e8-785445b0de71", "value": "T12603E1E64322F570CD7B482DE2E84B95A181053C677C781B7538497C7B9738EEAA8383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906203, "uuid": "e7004c2c-d954-45cf-9adc-e5d79f2b5c9e", "value": "768:Rz6H2u2Yk3juLTjaoqRyG3GmWfuyjWrkwJovz4vBdYJK3UEJGGt:0WIk6iyWGmosrNJwUvf9U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906203, "uuid": "4311ae98-e2dc-4e65-8889-6f14de7e8c92", "value": 39316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906203, "uuid": "d0943cbb-9e5a-4ba0-a075-de432864b885", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906203, "uuid": "155bb865-0f29-4fb2-a7f1-31096edc790d", "value": "bz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1679f385-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853238, "uuid": "340de946-c594-48a0-beda-b6d2aede2951", "comment": "Malware payload (Gafgyt)", "value": "9c16f2659914a22b24b89f2650c726b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853238, "uuid": "2d8a80f9-8af1-4e35-ac7c-8e0731bfca1e", "comment": "Malware payload (Gafgyt)", "value": "ab2b42122b24b7db506749a319e24c5c1b15458ee8875d9ec61ffbba8c2b3bc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853238, "uuid": "65bd78da-a241-4fa6-a054-af0c001df145", "comment": "Malware payload (Gafgyt)", "value": "d5a823a9282d8d23113561b9531f1346f47235ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853238, "uuid": "7ae9627c-8aeb-42fd-a902-86d5cc2a2bf9", "comment": "Malware payload (Gafgyt)", "value": "042e685440536b87a6c7e3037b7401e2fa9ff4c873393f37ea4c2f954e600896c3a927aeff2a19b7b9bece4b327ab20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853238, "uuid": "da99e2d8-c21e-4156-b786-5c7cfd1755b9", "value": "T17EE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853238, "uuid": "31371baf-95de-4d39-8c06-cb42737943fb", "value": "3072:dgZc9h1jlnLA2PiXYeyCcVVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZVVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853238, "uuid": "b6409cbb-9ecd-4b67-a39d-3a847a219145", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853238, "uuid": "208042ea-dc84-4ecf-863f-bccadebc0d16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853238, "uuid": "838bd4d3-d3dc-4bd4-896f-cfc778efcc70", "value": "9c16f2659914a22b24b89f2650c726b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af46a34c-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633884848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884848, "uuid": "c307ed19-a107-40d4-adba-943765db376e", "comment": "Malware payload (Smoke Loader)", "value": "e8b88a93da1c389e3a302441ff775a76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884848, "uuid": "6b3d2b27-e780-46bb-b49d-2f37093aee74", "comment": "Malware payload (Smoke Loader)", "value": "ac016bc4c3f859c8a10b18b36f013b92f30c287e7ff90de51811b319d7adf1ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884848, "uuid": "6eddc0f7-3d06-46d2-94cd-d1c23689c99a", "comment": "Malware payload (Smoke Loader)", "value": "274c3577a5af84ca678cfa201e3cbaa99301b930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884848, "uuid": "be48c7c8-1465-48d9-a4de-d717e88a3f03", "comment": "Malware payload (Smoke Loader)", "value": "06a6e6042cfdd0c095fd86936096b02fb4e5f7af04de8110fcc8703995c24410ee26919398683a36123ea14a4dd469f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884848, "uuid": "fbdb8c2c-4148-4f91-b387-9e312a30ac00", "value": "T17D746D20B6A0C434F6B276F989BB526CA52F7D91EB6490CF52D42AEE46347D0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884848, "uuid": "9b18b206-0762-403f-9d29-2617cfdf8dee", "value": "d8470aebc2200bafc1ff60318f406103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884848, "uuid": "cd4a4d40-bc08-4d52-ba6a-a46133ae21ea", "value": "6144:wx3QQobITthkUCRnLGkvMBbUxxv9hCWFVwORbgmeC:pQobyeUeLhvMBbUTvyWrwO9xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884848, "uuid": "7db3ecce-17ba-421e-8964-9d01058ee243", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884848, "uuid": "7c9b1dcf-948c-4b58-9e32-babedb523ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884848, "uuid": "e7b8dbd5-754e-41a4-a1af-1d85c8fbb0b1", "value": "e8b88a93da1c389e3a302441ff775a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a07c3-2973-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633833655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833655, "uuid": "7dedd3d0-b41b-418e-b2d8-88c07b4bcd43", "comment": "Malware payload", "value": "116c16c2b7a98de12674e77222e35b8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833655, "uuid": "df49d1d7-1974-44d6-ae03-34ae32e093ee", "comment": "Malware payload", "value": "ac436ee75764b0a829d05abb4c7209ad82b47b2591866c53fe589ca2a5a3ba59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833655, "uuid": "bfbe7428-e816-4e6c-8455-ecf0311a632d", "comment": "Malware payload", "value": "19c7007cb1f6fcbf9894fbacf5bac2d60e8347cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633833655, "uuid": "bd231311-b25b-4083-80fa-05398cb9d466", "comment": "Malware payload", "value": "2b2fdef5c274f3133349f880f5f5c7f56562f0f7b4a065551b84679d708a5cca9679f8f9f4e384fce366bd46c7af4ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833655, "uuid": "bc54076a-badc-47e9-ae84-d3235bb6e6dc", "value": "T1D83302B856159470F6330570979C08CEB4C6EBFCF2AF50B2B7459860E59384B4EF1784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833655, "uuid": "63fa9a9b-6ab4-4a53-83e6-ef9f160ed3d2", "value": "768:vg4jha/kJjpCD48/Aj6IdTY+f4fJkvXXAwU3WM7RBBZ49q3UELhbjXLFQfoN1s6e:42hDpCDfAjtJMuvX2mM75LddTne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633833655, "uuid": "265b1d02-b767-4236-bb34-40f75981577e", "value": 50124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633833655, "uuid": "b753ea47-fc8e-4a69-9f4e-36bd26d2fab7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633833655, "uuid": "a5b66426-7bc6-47df-a3cc-7e7473fe5ac0", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.1755.15792.30402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f959c7d1-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873805, "uuid": "b91fd3f4-eea5-4683-a927-f6334bac6ff2", "comment": "Malware payload (Mirai)", "value": "9c56fec2400926e3d8fc78cbd050cca7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873805, "uuid": "e3a82cfd-41ed-4ce1-a8e4-c68db252d0e0", "comment": "Malware payload (Mirai)", "value": "ad6fc0675602c93c575ea821ac7710cf5d3a2b8592a73edbcc9a4156879c9610", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873805, "uuid": "024dc8a4-d8fe-4814-a5e7-ace7e463a28a", "comment": "Malware payload (Mirai)", "value": "5231d9ee461534fe0459948b733a1447bf0456db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873805, "uuid": "6ae40d09-6eb5-422a-a2fb-5164448f5c58", "comment": "Malware payload (Mirai)", "value": "2485d2010004f50d82ad8716087f7cc1ad7921d76c7e4f54487f23b5e78f6ce7e51151afb2cf2eeb5b6ef7c46cad6428", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873805, "uuid": "75f7d44c-3419-486f-9b13-a525ea9ac42f", "value": "T117D2F18059BA894EF5EE61392CBFFF4941C0D318058A47336A886B3EEE80B5C7934581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873805, "uuid": "c79c1896-9441-4028-8e0f-3c3812172a5c", "value": "768:sFU+Lq02tqQJoTTMRq2i0bL0i9zCp8XXnbcuyD7UHQRjz:sasqBtqkoPMo2t/TCunnouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873805, "uuid": "a6d2a1a7-5dee-461f-9451-acd83ecffc59", "value": 30420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873805, "uuid": "75e52286-c9fa-4714-baf0-2d16991b2c43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873805, "uuid": "b325efab-2a00-4ec3-87f8-d52629b17c6c", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea78603-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899262, "uuid": "12dc5058-655c-448c-8ee7-e85e210318a2", "comment": "Malware payload", "value": "211ca7c8d5fd20f7dcaebdbe354662be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899262, "uuid": "562bb19c-12b4-4698-acb5-27991313ccb9", "comment": "Malware payload", "value": "aefb4a2472f0517d58cae7e5e0c9c51b4e36b39f6096dbffc6b8cc18d0be7175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899262, "uuid": "de834596-dd64-4e68-8734-42fcc3020032", "comment": "Malware payload", "value": "1111e864f3e9d2e6879c5179c4136638b05b67c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899262, "uuid": "f8252ca1-bea0-4086-a27b-101ce3130823", "comment": "Malware payload", "value": "4b7bc7de552b879d265a1d34a1d45f3ff81f8b2cdcebbb34a66b55384a50535f3d14dfbfb310aa5978a2de984c2a7ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899262, "uuid": "7247b165-0efc-4c5e-9ae8-8fa690a9ce71", "value": "T153560103BC9164B8C5E9C33289B592913731B899073537C72F95A6BA2FB77C01E79368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899262, "uuid": "11699c37-6a72-4f7a-9a6d-8337eea5cdf8", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899262, "uuid": "1f95cab3-8128-4a77-baaf-b4c2efb7933c", "value": "49152:sr/U2Wrb/T/vO90dL3BmAFd4A64nsfJ1gBO55+1TEf1q7NOVuZnsm/QBrkdL+DLk:srDnOOWmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899262, "uuid": "4ea54fa2-4f58-4b8c-b252-288c99ba7321", "value": 6024192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899262, "uuid": "6dc03766-bc63-48c8-baf9-7f6250cfcaee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899262, "uuid": "b5353075-dd92-45c2-8d45-9ebc5f0d89ab", "value": "5t6yujh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0c65ea-29cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873378, "uuid": "9751002e-c446-43e2-959b-ba008cd32d11", "comment": "Malware payload (Mirai)", "value": "663f3a4ce4178e79a5b5fea629bb0896", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873378, "uuid": "9ce0193b-6991-45ff-ab2d-c8b8c4c93283", "comment": "Malware payload (Mirai)", "value": "af8b85e631ead895067ddaaed0ad009d9be1dc5f0379ce974f52cf5c145dd5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873378, "uuid": "1845f87f-34eb-4903-83b4-c36980023f2c", "comment": "Malware payload (Mirai)", "value": "ba873061d6034502c4f13083068d1f7bbc2864e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873378, "uuid": "6ad4ca7b-fac1-4bf2-8781-85b2fc74fee0", "comment": "Malware payload (Mirai)", "value": "83c0a764c1eb7477d2143d9b6a4e4ebe05552479dc938797d92f0641c7a15cd31c8ce6b1c9158cf2200133cf41b00d7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873378, "uuid": "32b5fd8b-3fbf-412d-8a66-3f697f3dad17", "value": "T175338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873378, "uuid": "61bc3b56-3e3b-474b-9ec7-5359452fd0b5", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCve:jaQFwtOGBvQXxfs3kgCJt/qMF/RCve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873378, "uuid": "39514590-79c6-4c78-a8c6-492ac3186e98", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873378, "uuid": "5d023c90-dd4e-4a91-a367-ccd138dcf599", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873378, "uuid": "38249fad-ca53-4eb8-869d-97e0caae6264", "value": "663f3a4ce4178e79a5b5fea629bb0896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727d6549-29a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633852963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852963, "uuid": "573d5860-123b-4627-a0f9-ef66b708a021", "comment": "Malware payload (Mirai)", "value": "2c919ad0316fe693318b5551a10a726a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852963, "uuid": "89e3c874-427a-4965-b5bb-b6655a87b59a", "comment": "Malware payload (Mirai)", "value": "b13add461d5334b2b895d0592aa5507423edd994d20b214cd9ff632248f5b151", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852963, "uuid": "4fd03698-63f1-45a0-88e9-369150971c77", "comment": "Malware payload (Mirai)", "value": "5660cc6a3cec7a993f28d36bf23643b82862333e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852963, "uuid": "c474bc97-63a9-454b-9768-1723df1f2f94", "comment": "Malware payload (Mirai)", "value": "80bacebc4be65d16f07b3b8230c2c0eff1e2303741836ddf816a2b74f6c3d5d9fafab202682064d8a60c74bb77f17799", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852963, "uuid": "4c7351b3-cfc5-495e-97ba-3a3611344470", "value": "T12DB33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852963, "uuid": "78b134bd-593a-4c67-9913-555698fb5c5e", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAf+TRCm7FnVqfJXFWbNb:T9a2aLqkrMmsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852963, "uuid": "fcb8ebc8-5c94-46c1-b2ba-5aae3bfee5c3", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852963, "uuid": "c161b1f1-f121-4124-b6bb-5e94fd107a99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852963, "uuid": "0793eaf6-ef69-4089-8567-9f002059120b", "value": "2c919ad0316fe693318b5551a10a726a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417fccf5-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633866625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866625, "uuid": "567d146b-b415-4d0b-aa55-46bb0242609c", "comment": "Malware payload (CoinMiner)", "value": "79f0563e8beba230c5d49f8eae0340fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866625, "uuid": "d95f6d10-064b-43f0-9e4e-9f08cc1d68d4", "comment": "Malware payload (CoinMiner)", "value": "b2e27f70d33fce7c036f221ce6b2249b63eb465b1c0abdfcbeea0f7585884448", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866625, "uuid": "25fd5baf-0551-41ed-b00d-4c5712fe5b79", "comment": "Malware payload (CoinMiner)", "value": "714836c9f597cd6dadc298ed6b6d37ecbcc01d78", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866625, "uuid": "a9c5d5ec-6b37-42c7-b1b3-01840650dd66", "comment": "Malware payload (CoinMiner)", "value": "f91c3643f3a064e3e8aa4b4b397c4435d5c9e47576fd4cf1b96d60201f3565bca0f0a4afd474257d6f974087056cb4e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866625, "uuid": "fd6e01e9-4582-4573-ac63-ceb14e42ac42", "value": "T1F5E5CF053D4FCA52CCAD09FCA83BD6A453577D40ACACE0B3F57A73AB1A307079666249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866625, "uuid": "ef08d7cc-0127-4298-b47c-14389821d31c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866625, "uuid": "4af00b0a-81e3-4b4f-b77e-8baf44a9c41a", "value": "49152:QsiiklBiRfX9/GZDCBywJgqfbcuXgzKHpsIb0ssmTFJdAHT:H9YoR5UDwbHgY6Ibs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866625, "uuid": "33cf7fc4-2f48-4fba-acf4-28c61db0635b", "value": 3142656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866625, "uuid": "8331a401-a78f-47b0-8c08-9f8314fc4c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866625, "uuid": "72396c10-d972-4fe1-a1dc-9e2ff16606f9", "value": "79f0563e8beba230c5d49f8eae0340fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b355b2f-2987-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842240, "uuid": "b609c2d6-e0e4-44a1-9b60-66aadeda3f86", "comment": "Malware payload (Gafgyt)", "value": "e2f6aa39448c7fa5e6704c498bd46d9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842240, "uuid": "435e3aab-ae5b-46ab-9b14-1304f03e2f3d", "comment": "Malware payload (Gafgyt)", "value": "b303b7a74e8f34df4e42770a695d7d22368483a951d8556fe038ee7277e55851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842240, "uuid": "81b4c83d-98a6-414a-b93e-f2d7ccd33b5e", "comment": "Malware payload (Gafgyt)", "value": "2affa1ee702c059d27ff5c4460613293240c9b51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842240, "uuid": "2c644ead-5c99-498c-b97f-0868a66255ae", "comment": "Malware payload (Gafgyt)", "value": "aa84a1995ce529ecff952c2a56610e3b64643959b53914be5fb7f3fd90741e18bf4c1c492895f06ab12300464b5b44e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842240, "uuid": "ac9d1af1-9d0a-4635-b111-309f6dc4f047", "value": "T1BFC32A04F9018767C2D327B6A68E474E3F3517E453DB33166A38AEB42FC27992D25E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842240, "uuid": "a92bbe50-4131-4cc4-97a0-50666cd14b71", "value": "3072:jogfqPdx1YA2tFhGS5iqvIwLmUwrQRhk4rNXhLe:0Pdx32tFh15immUwrQRhXrNXhLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842240, "uuid": "5037c1cf-5f41-4ff1-bffb-6cd3020ebe0d", "value": 125549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842240, "uuid": "db7cb4a1-deed-4509-8bb9-a8554cdfa1e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842240, "uuid": "2d8522c2-4216-4ca6-b6ed-194d235deff4", "value": "e2f6aa39448c7fa5e6704c498bd46d9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbb94c1-29b3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633861008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861008, "uuid": "522a52fe-aba5-4196-b7e9-7a0d3aa7e927", "comment": "Malware payload (AgentTesla)", "value": "77d0521505f69632ad6740ff52a29790", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861008, "uuid": "43fb6e19-1d94-4056-9e84-c15ffc244802", "comment": "Malware payload (AgentTesla)", "value": "b36fafecaa9f3252bc38d71ef8d16cff142337c8f5f8e98c414a057277c7cbe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861008, "uuid": "45b02009-b398-428d-8933-7a39938c30b7", "comment": "Malware payload (AgentTesla)", "value": "a771c88ec2e7d267474ced87d047673de3d86df9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861008, "uuid": "6351b84f-72de-44d0-a767-7977598db896", "comment": "Malware payload (AgentTesla)", "value": "458de24ddf57cd2836241bc77a8e82deee2025209f6d51498dd1581c08ba7902133fd4c5a9133afd1fdbfb463026c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861008, "uuid": "37509abf-8c31-4586-8616-d328d038253e", "value": "T17DD4125827D095F2CE580178868791C07BB9C13138A3E77ADD17A7F01E87BCA41BB6DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861008, "uuid": "e63bc412-2cb6-42f8-a0a9-ae50c8351dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861008, "uuid": "e3ff1775-0804-44a4-a3fc-ea8b22d12d57", "value": "12288:6spOCWdZKUZ+SPwGVG5uzVOfxYxcUR55Oue3UUBTpV501/tQ:BAVdZrZ+SPw5szyWCUHYpV5C/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633861008, "uuid": "7a23e543-ef1d-454a-a7ad-b456d0926d1b", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633861008, "uuid": "fdf2246d-4581-4898-b3b0-b42a6fa1ca9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861008, "uuid": "db2b1a6c-1600-408e-b199-279a534915f2", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48ac955-2989-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633843168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843168, "uuid": "ac721e4a-d3e4-4087-98f2-237af3253add", "comment": "Malware payload (Gafgyt)", "value": "acfe3733d84dfb7b68462c8851f8d1d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843168, "uuid": "9a05b753-39b4-4089-a60b-be6aea52715b", "comment": "Malware payload (Gafgyt)", "value": "b3817e093790a23a1549668036f2a9271182aca7ab643bafe7c051c18fd91270", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843168, "uuid": "c7e61d7b-b0ec-4c79-8303-85332ade6239", "comment": "Malware payload (Gafgyt)", "value": "48d5f09d2f6f3c20652cd8c8f76776a9e31b5173", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843168, "uuid": "5961b6d3-cdd9-4146-a82e-bf6647e7092d", "comment": "Malware payload (Gafgyt)", "value": "e51ea6a5ee303d99f0e123c39aa7f19678a36042cea8d99f75fe2f01ad15034e64b4a75a43f4f1f75284bef850478fbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843168, "uuid": "6c34661c-138c-44c1-ae05-9acae0024135", "value": "T129C32805D5508727C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843168, "uuid": "ffae864b-e300-4279-96be-e8d0e6de7424", "value": "3072:WkYPgPggnAb0JWaY/VfpEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8pEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843168, "uuid": "6b1bf266-6a72-4e27-8cc6-a1ec9056560a", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843168, "uuid": "c93c31c7-3359-4d76-8743-356caccf7c9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843168, "uuid": "0dd57fd5-4a7a-4594-85ab-bd8d45ab86ec", "value": "acfe3733d84dfb7b68462c8851f8d1d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc07750-29df-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1633880253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880253, "uuid": "8fe77962-46e4-46ca-9e9e-073f5093897f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "60007c052e7372566d09c3402db31915", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880253, "uuid": "2eeb7ba3-3da5-43bc-b5a0-93f848fdbb90", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b41455dfe45bf98bd2f1acec07d7a0df02a3c83e1fdecfb403df3984ab794761", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880253, "uuid": "61f36cf7-beb3-48a4-8e5d-5b3b2e92e663", "comment": "Malware payload (CoinMiner.XMRig)", "value": "c2f4d5e6504152bf11371ef0209c006ed92258bf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880253, "uuid": "f1df6fdf-2ce0-4dd8-a352-411027ba2a20", "comment": "Malware payload (CoinMiner.XMRig)", "value": "cb3a7f678d262d3d3d6054ca95d03458463363f3006fa5febbd313c0b3c37b16d52e065b5c7be84ff0c01759c54d3fe8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880253, "uuid": "d3f27e5d-fa47-4ff2-8b12-661337ccca55", "value": "T1DA4412378AE4FDE2C1582A71051FC23B56141E72C44D3735B6987453AB3A7AEACB03D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880253, "uuid": "aaefab09-9af5-415a-a11e-9182cfba1b7e", "value": "61a760e7d283c156cc4104eecedb12bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880253, "uuid": "a5b5b459-78db-49d6-a3f4-e5317189d25b", "value": "6144:NwW5Jw5Z5XBRdJ1K1EdDTiiPBA3jeTTDoOsmEPXEb8AAE5g/n:KkEZpK1qiiPBATCDopo3AEK/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633880253, "uuid": "f5cb19ca-f55b-434c-a91c-59fd243fb048", "value": 265904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633880253, "uuid": "0f22650c-454d-49df-a38a-e838f8dafbc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880253, "uuid": "fe8abd53-d00e-4687-9f54-0b6bf8829ec8", "value": "60007c052e7372566d09c3402db31915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0fa741-299e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851929, "uuid": "9e7b4b75-7c49-4535-8b31-ddcbdb0db3b6", "comment": "Malware payload (Mirai)", "value": "f5eb5ef263607d083b3ec13b51ca9a09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851929, "uuid": "7afe2313-f9a3-452f-b07c-ac93045dfb55", "comment": "Malware payload (Mirai)", "value": "b44ee054239c35e3f359395098c229bbaffc5365367719c2c4c75f56149d9ef3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851929, "uuid": "be37b866-9399-43b2-bcf0-d6e014db7542", "comment": "Malware payload (Mirai)", "value": "6d90dfca935f6a6791a1ab4096bafd4c3a434882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851929, "uuid": "0db60715-af27-440b-a2ee-4e527527be0e", "comment": "Malware payload (Mirai)", "value": "2eb099f8bbd3400e0f95d4e252c6bc3bc668f6f88665878c46c22c83da0f161551e4efacd54a421e313d873e477309be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851929, "uuid": "2b280cb3-d74c-48fa-9e86-0590c5f73c7d", "value": "T197D2E1016640FEE1C5B00231EC66CA9B72253D79D0D230FB863D0DF8A6EA61D47F8942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851929, "uuid": "f33a12dc-7414-49d8-8563-6cf84555e4f0", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgbh9q3UEL7U:WRwynNIOQQ1KMw4LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851929, "uuid": "c474bc7b-d6e2-46eb-b709-429eb55dd670", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851929, "uuid": "a195b411-84a1-4711-ba01-c839bd54da91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851929, "uuid": "211046a0-bb3e-444d-bdf5-be96b04fcf29", "value": "f5eb5ef263607d083b3ec13b51ca9a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd78f5e-2989-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843157, "uuid": "3bfb4d73-c4ba-4726-8048-a81840675dae", "comment": "Malware payload", "value": "f197af9974f43b2222f1af7d0b1809f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843157, "uuid": "227b7d38-43a1-4c8f-b45f-4c009ae5a54f", "comment": "Malware payload", "value": "b57651435bc41558429a48f882390aa5c98379130347c6c721531da9deaa1fe4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843157, "uuid": "880d0bcb-60d1-47f4-9cd7-e77e8f0a83da", "comment": "Malware payload", "value": "d4df0e5fa3c4ab04e9504847081426c9fad62fba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843157, "uuid": "a8dc6154-8705-49dd-b337-089564c3001a", "comment": "Malware payload", "value": "a80d650481180a051828a266bac882a31ead4750365e14f4942ddff4b13b431918a7154452ca380e14f19535d7206926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843157, "uuid": "ac2806fd-9827-44af-aa7e-c80daa0a6df7", "value": "T187E34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843157, "uuid": "b47bc3a9-e327-4c47-8982-3356fa35935e", "value": "3072:Ib2NQviuoSKTe1a83P0iBCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a65BCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843157, "uuid": "8118f7cf-a84b-4f17-9882-e8f754c8a2c1", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843157, "uuid": "bcf1e319-ea27-4d19-97db-7ff8a0d27581", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843157, "uuid": "35e13042-b7db-4b5c-a35d-8bef5de9d4f9", "value": "f197af9974f43b2222f1af7d0b1809f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0871a1-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851105, "uuid": "e80eda17-af35-4b62-8a03-2c99b5efc223", "comment": "Malware payload (Gafgyt)", "value": "4da7b3a97904c4bbdf886128b3de2741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851105, "uuid": "5c0ab2d5-be96-46ce-aac9-0af379f4ee35", "comment": "Malware payload (Gafgyt)", "value": "b6963b80d2e906e67eb39b0ab28a5156ae306462396d20fe596cb21e38c40365", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851105, "uuid": "a1aaadbd-e55d-41e7-9b9d-c95c11900956", "comment": "Malware payload (Gafgyt)", "value": "9c8cf50ae3cc26c0a777229f07718a4873e95c83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851105, "uuid": "f2ffe448-0026-4253-87f7-91a09bb7e21d", "comment": "Malware payload (Gafgyt)", "value": "f3102cae03e0b73b5ed3faa6a89de04d030827e51a10aad2ff52ffdc8b99faa18a46978cb7f3f7a40d084dbbacfd674c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851105, "uuid": "1dcde571-7cff-4553-990c-aa2fcb70bda1", "value": "T123E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851105, "uuid": "13ce3958-992f-4a38-b587-6469873924ed", "value": "3072:JW6dm9tS1aRGQdK76t/zCcI5mrThPaLEnvPrNb:c6IG+LChmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851105, "uuid": "c0cefabe-140e-4398-a3d2-d75df62e658d", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851105, "uuid": "37da1745-5dcf-473f-876d-fed4ec886d75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851105, "uuid": "45085599-a48e-42af-9084-a90474677a9f", "value": "4da7b3a97904c4bbdf886128b3de2741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b3b50d-29ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884556, "uuid": "53e6fc53-6104-41c6-8162-4601ef52d713", "comment": "Malware payload", "value": "ef909c3755d74bce5b5f0f60ad6eda8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884556, "uuid": "0a465f90-2897-49ca-8907-4ddf4adeb568", "comment": "Malware payload", "value": "b8f499057a999308f029c1d0577b28a6adff4b8b0b827caf51fff07f29527afb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884556, "uuid": "34477c45-2cfb-4f59-91f8-4af40e8f9d7e", "comment": "Malware payload", "value": "2b05942d8ba691dbf43603298757301045f374b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884556, "uuid": "ee32b8d7-c762-4a81-9875-c1feadb2929e", "comment": "Malware payload", "value": "061b7c7f80e76d1980aa51572988c6e3035d324c1c85441a409de72c8d0e2a69af43b5e00b7f8ef8ec456c7f5994c31a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884556, "uuid": "659b2367-8327-4ee1-a577-2bf123ac9ba7", "value": "T11F1302275CD23280CCDD6F37CED516E419A9315BA60A87C7C325A405DE76A0ECAAFC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884556, "uuid": "2aedd939-1cac-48db-8ea6-f1af32e2cb69", "value": "768:58S4QjbO6fSrbvkCx2OoLEi7tl+50cGXnmmxy2MPlWRf95CP73M:51b36nsCyLEsnHmm/2E95+73M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884556, "uuid": "05330996-d900-4390-9cf5-6c8281dc7d30", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884556, "uuid": "aab8da6d-3340-45db-a839-da7de1ba12d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884556, "uuid": "521bed33-eb5d-4577-b48c-699add07b57a", "value": "ef909c3755d74bce5b5f0f60ad6eda8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260c980f-29a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633853264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853264, "uuid": "8d04ed27-a257-414d-a0b3-7fd0240a8292", "comment": "Malware payload (Gafgyt)", "value": "26bf96d8a95dcbc0f5f8317adbac3b4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853264, "uuid": "b61ef12a-83bd-462b-88c8-727afbcfacfd", "comment": "Malware payload (Gafgyt)", "value": "b8fd5494786a392565ffe16d76be6ba6b8c6abbb2a7eae219e7fa67fb2b058e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853264, "uuid": "7cdea4fa-7a79-4c65-b6a3-9272fe99ec55", "comment": "Malware payload (Gafgyt)", "value": "853b7f12f6dd07834971c4f72ecb9ea9ca925bd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633853264, "uuid": "280400ac-48e5-4b95-aa7e-33c09a06d4a4", "comment": "Malware payload (Gafgyt)", "value": "8830f1d45c6698bab5830354de84a6ac7b1416a7d453722fe9ae5821c6163796bece6d4162dfd60c2c66c66290b1c1da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853264, "uuid": "a124fa96-5ca3-44af-816b-cd1baef07b0b", "value": "T10DC3F831E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853264, "uuid": "ed2e21ee-a2ef-4626-ab98-fbb82b270e80", "value": "3072:6jVlyaL5JCrIpv04sXbttiEiTmP46aQyfPlfKsNb:yoCJCN4sXbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633853264, "uuid": "adf99a5c-fb29-4988-924d-04aaea733222", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633853264, "uuid": "9e2ae70d-ec0b-40be-820b-25ea249b134b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633853264, "uuid": "8796f930-657e-4e82-a82a-15a74ec7067b", "value": "26bf96d8a95dcbc0f5f8317adbac3b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef393ec-2a18-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633904711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633904711, "uuid": "6a66ff59-6a95-417e-b927-d4a019414002", "comment": "Malware payload", "value": "3e1225c2e75443f3a636d149e3074f1b", "object_relation": "md5", "Tag": [ { "name": "EpicManchego", "colour": "#41FC34", "exportable": true, "hide_tag": false }, { "name": "Grind3lwald", "colour": "#49B38F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633904711, "uuid": "1a47d924-4be3-4867-87a4-eee30b7fe708", "comment": "Malware payload", "value": "bd4af83b1454acb3d9d3d14367f26bc0491e4687f8590b982dd9eafc9ab783e7", "object_relation": "sha256", "Tag": [ { "name": "EpicManchego", "colour": "#41FC34", "exportable": true, "hide_tag": false }, { "name": "Grind3lwald", "colour": "#49B38F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633904711, "uuid": "a28b0125-a155-491a-859c-e117917adcf5", "comment": "Malware payload", "value": "92e5fd31696058f1f5f00136f3e7a0981f5f9466", "object_relation": "sha1", "Tag": [ { "name": "EpicManchego", "colour": "#41FC34", "exportable": true, "hide_tag": false }, { "name": "Grind3lwald", "colour": "#49B38F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633904711, "uuid": "6ca9c435-f33d-4593-9132-ffde692bf89e", "comment": "Malware payload", "value": "12effac011cbe45633d9a87770350c7aea4374d00e5b54ef3651b5b34f37668c6779806a4cba064290732aef44d3bc29", "object_relation": "sha3-384", "Tag": [ { "name": "EpicManchego", "colour": "#41FC34", "exportable": true, "hide_tag": false }, { "name": "Grind3lwald", "colour": "#49B38F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633904711, "uuid": "ed38b821-a612-4eae-880c-184750d796df", "value": "T15F8412A8CFF90A52C207E535521DACB98506A84193C9EF2A3D54560FA9868D013BFFDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633904711, "uuid": "3e793519-dff7-41e6-a3a5-17c164c72d9e", "value": "12288:JrohforrIKx6CRiiiijFWaAl7AhskNNfxNY3+Qt+FXK9:Jro6rrI+6CFFjAl7Es4fNY+F69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633904711, "uuid": "38fefd57-2d6e-4858-b3ff-c80e683d9b5a", "value": 397767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633904711, "uuid": "bd3c1751-f44e-43f5-be50-a7c49e020440", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633904711, "uuid": "11d501f3-891f-4e90-868c-75b91829aaf4", "value": "ORDER 211011A.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fc1517-29b4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633861604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861604, "uuid": "bd3054d9-d123-478f-b673-47cbef22c97d", "comment": "Malware payload (AgentTesla)", "value": "c0f0ad839576a174072d3fdb657159a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861604, "uuid": "770042ed-5ca1-43d0-9409-78552dba214a", "comment": "Malware payload (AgentTesla)", "value": "c02e6e6559c85349d2be3c931b387092ef50b3a33197614e441135e3284059ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861604, "uuid": "04b97581-8089-44f3-8bca-0c6e55d94a68", "comment": "Malware payload (AgentTesla)", "value": "c06460aa2a5470e615e632bc2df62f54a969c53f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633861604, "uuid": "232fe962-fbcf-4056-b302-aa6b8614a902", "comment": "Malware payload (AgentTesla)", "value": "30e6f258aab9cde00448859cccb6bf79fc03cb3d9518a6ff75591c13f3f58e88af56b5738a9e76a1a9898a8a831da6a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861604, "uuid": "65024204-52d5-4a12-bac3-5aee2c9938ff", "value": "T144E4CF242AFA116AFD32EF755EE0B596BB6EF77236025439E01303970613D80CDE2979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861604, "uuid": "abc5d30f-c7ea-4514-9ce3-3681da85d124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861604, "uuid": "708570bc-3d76-4aa5-89ef-6393134a0d42", "value": "12288:Lhv05rdERQin/L/yrxnuOb/wICNnsEp2CYW6B4lHk0:Vkr+uBQICNn/4BUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633861604, "uuid": "c17d823b-d302-4326-bc54-bcbaa7685c9e", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633861604, "uuid": "b64c5f6e-4fe9-4839-a7c2-013e94accdc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633861604, "uuid": "10a92271-8aa0-4255-a7fe-964fcd79b714", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12720dc-2992-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633847109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847109, "uuid": "f26f4d5d-bd87-48f7-90b1-6dacb60c48e4", "comment": "Malware payload (Gafgyt)", "value": "563097794402d117f9fee790a13fcb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847109, "uuid": "19f422c8-3fb7-42ed-818e-326a72271aec", "comment": "Malware payload (Gafgyt)", "value": "c08016c0986689b4cd3dd898d2797d40f108cc8c66539e0c2049b9287ca78dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847109, "uuid": "55119ec3-5d0b-410c-aba5-75c3b706f55c", "comment": "Malware payload (Gafgyt)", "value": "aadc72a6797d3cc3a6d43dfc1ea2ba7ead5b25aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847109, "uuid": "ac8c2cdd-7976-4fab-b09b-35f214fd0a50", "comment": "Malware payload (Gafgyt)", "value": "c4009dfe689a616cf088475224e6330831b14fefc5dc1494ba4c740b1a850d6b31e309f4e206121d6eb90c5b25a0ad28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847109, "uuid": "47a75422-9be9-43c4-b0ee-f9a197a2e05f", "value": "T191A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847109, "uuid": "d1c0e122-2bce-4533-9fb7-3574a906705e", "value": "3072:VSx+i6mqaObhN7nPNKV+qKmZuqQ4DPwXXtse:y6mRObn7nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847109, "uuid": "8c2bc1cd-22ba-4914-9433-4274d0c88032", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847109, "uuid": "6c4bf892-fc89-4322-be42-c18f33e4e069", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847109, "uuid": "4fba12b4-0f4a-464a-a3bb-54a667da57fd", "value": "563097794402d117f9fee790a13fcb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2db17d-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633900009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900009, "uuid": "11a6a466-ab71-4036-9193-9b49f46eb989", "comment": "Malware payload", "value": "59f603e1f775f990dd481eb54e6ca277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900009, "uuid": "84f4131b-6a03-4ab2-9c86-c9ec7d9792b5", "comment": "Malware payload", "value": "c155b30c801d33511107086ba9c39353ed8628d9b8f35c2ae22115ea9c3fda84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900009, "uuid": "e4e76f91-1e48-4887-b0f3-23c91f05101b", "comment": "Malware payload", "value": "e4bf67722f093f53d37f3acaf74a9702345fcde6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900009, "uuid": "205f12d8-a125-4a9d-9b14-953303574552", "comment": "Malware payload", "value": "a0993c3a9894205dea8d9a28163b783df30681aa6118713d467615c40e49a14091cf3efebebe94b5c24ec3f65bb43ae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900009, "uuid": "277edabd-98b0-463c-8e51-87e9acf9ef2a", "value": "T186C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900009, "uuid": "a6d33156-e579-4d0f-b4f5-7b0acc08c829", "value": "3072:ekYPUfsgnsb0J2ag/VfxkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0xkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633900009, "uuid": "a5716055-f754-4ca2-acee-e4f6c00130d9", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633900009, "uuid": "025b28bb-974d-4dd5-b85d-b6219cd42d2c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900009, "uuid": "b724136c-0bb5-4a77-80a6-9040fb4349b8", "value": "59f603e1f775f990dd481eb54e6ca277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f8b365-2992-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846843, "uuid": "09a6d534-a572-4c1c-be6b-f9e506dd2171", "comment": "Malware payload (Gafgyt)", "value": "9f9a38106b387f15399b60e4212de060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846843, "uuid": "48344347-54f4-4706-b860-ed8765447570", "comment": "Malware payload (Gafgyt)", "value": "c21375dd133ead6eb91233e46b6f4d435c95d78aa939396a52677c5006c22fda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846843, "uuid": "2b6e0538-cf6e-4a12-922f-ccab37b70233", "comment": "Malware payload (Gafgyt)", "value": "5cdb37640f9050f41b711c47e02b0a087d4aa924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846843, "uuid": "72a78921-d610-4d60-885b-b683ee3f7e26", "comment": "Malware payload (Gafgyt)", "value": "24b36067784140a04af60acf7b125475fd3b007fd63bb9192cc704d671114eefb6e1ccc21b649eb499bd1408490990f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846843, "uuid": "41a334c8-fc0c-40c3-9efb-f690a858be3c", "value": "T1E4833C02E743C6B3CC830BB2029BAA665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846843, "uuid": "9fe18100-231f-4bfe-b4d5-48964452f554", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LsWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YQ2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846843, "uuid": "d2a48335-3601-4672-807c-a96b868923c7", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846843, "uuid": "46b17a5b-2b29-46b5-bb19-72b8beb220b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846843, "uuid": "e6cf0d9c-0822-4363-8617-46acfc3c5ae0", "value": "9f9a38106b387f15399b60e4212de060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1387aedd-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899189, "uuid": "24ea09ac-2826-4022-941c-20c5e2f8b19e", "comment": "Malware payload", "value": "7cb95080411c300ba9c379359fd5d394", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899189, "uuid": "7ac26395-865c-43db-9abe-3ad05eb1e56e", "comment": "Malware payload", "value": "c2a9adebfffe0ace0f935dbee2f82a95047a52b35849ac00cdccf6fbb685eb09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899189, "uuid": "f3be5dc8-39e9-4551-9646-f22cc85542df", "comment": "Malware payload", "value": "7aa1b7a6a0bc44e3a81963cef66306820bc77455", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899189, "uuid": "e8812df3-8485-4bdb-9b8a-cb70b0c190f9", "comment": "Malware payload", "value": "ce7456ab1cca133528ce1f4c20231f0a69fef78b06d8bcc5fdf82d473cf849fe946f6ebdf41c86cf5c6e2c4e3ae4204e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899189, "uuid": "35559362-3cee-4504-8a2c-b9b14bf3c274", "value": "T10F833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899189, "uuid": "9e2485fe-b4e5-4bc7-abaf-2a3352464921", "value": "1536:W35b9Du4N3J6lreu5r4hWj8LjWDloRmF+wVOz+sXcfW7k:Ab9Du4JJ6liuq0Yn2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899189, "uuid": "f415beba-95c9-473f-b596-3ad1f949e1c6", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899189, "uuid": "fabb19d6-e86d-41a8-a9d7-45352e14bf45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899189, "uuid": "604baa1f-dff4-4e1a-880e-f31bac0ef26f", "value": "7cb95080411c300ba9c379359fd5d394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f266216-29d3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633874808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874808, "uuid": "475fd7e7-b664-4992-9267-d0f392c2d72d", "comment": "Malware payload (Mirai)", "value": "286befc95d3b3cda4604d39c7b5b7930", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874808, "uuid": "9b3b285f-1ea9-418c-9eb0-4d03b2ca1a83", "comment": "Malware payload (Mirai)", "value": "c2c737710156c1294f7c5e0adc3cbcf280b43b35b58e7c6ebe3cde6b44c43b6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874808, "uuid": "9367dfeb-8319-4c79-9131-4b033ff6d633", "comment": "Malware payload (Mirai)", "value": "902602bdad6a566e2249b98364a9865396dcaedc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874808, "uuid": "0e7d27be-d06d-4164-a43a-797809050eec", "comment": "Malware payload (Mirai)", "value": "b1c5be77ee18a3c2b1c52c5071b17066399b2e67a2a014da9a7c0c72b7761f39fa40641cb5bcda9732bddabc6d6ff2fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874808, "uuid": "5466ded4-495c-4d01-bec9-0edf56aa0f35", "value": "T14FB2D0B17015F8B2C7E100B76DEDCB93FA811EF8D0E873295469099DE6D9843AAF0107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874808, "uuid": "c5a431b7-b8b3-41ba-80f0-19b7f126f750", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pF+s3UozJ:5tn+o9wjfBAZFjzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633874808, "uuid": "2cebc19b-68ff-4c50-bde7-a5b6501565f9", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633874808, "uuid": "b0446f27-7ca7-4c0e-9f97-395eb1c076c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874808, "uuid": "236d745c-9cb3-41f9-8d01-a82d66002a79", "value": "286befc95d3b3cda4604d39c7b5b7930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e7fc32-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842501, "uuid": "2a4345c6-9cb1-44db-b600-44f33e29852b", "comment": "Malware payload (Gafgyt)", "value": "3c7cd2e4693a0b4c3bb8cc6ea7974c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842501, "uuid": "0eee2883-508d-4499-80ac-7ce3a37bb183", "comment": "Malware payload (Gafgyt)", "value": "c4e1ecf0ed37b0aaa176f7fd65138cc84c1f3f2ee112af3129ee9070e1aa03d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842501, "uuid": "24580ab8-0c08-4ea4-ba6f-1ed8d1a5c5dd", "comment": "Malware payload (Gafgyt)", "value": "ec19cff63c383c183715c9779cdee7f3ea673db4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842501, "uuid": "4f587561-74bd-474b-a159-a89d9d5acccc", "comment": "Malware payload (Gafgyt)", "value": "e56c219ea8a159772ffc39fc84a176ad3044c0896f3264c9d2571b1635bb9e606983f72fea6e803aad80e4a366753081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842501, "uuid": "53b5b4db-027e-41ed-8374-79fb2297be37", "value": "T146E3A62E7E22ABBEE169823107F7AF70C79521D227919342F16CE6185E7124D1C5FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842501, "uuid": "92803166-6c2e-45fc-9848-f7b678470da1", "value": "3072:1Atu6SxI/5ZIUj6QP/5NOX6sILJ+DAlwgqVIiFhq1TB3OotUmkmZF01TpM2ke:omclhiFhqfUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842501, "uuid": "801f02f7-de8c-46b6-b7b9-128dc6473f45", "value": 146926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842501, "uuid": "f5704d4e-5235-45bc-ab50-5fc328260dcc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842501, "uuid": "1fb10f46-4931-46ab-89df-ce2d21d3bdfc", "value": "3c7cd2e4693a0b4c3bb8cc6ea7974c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b1e134-2a0b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899005, "uuid": "765ac490-7788-484f-a25a-d043b354bdbc", "comment": "Malware payload (Mirai)", "value": "e887410ac480ff217c146decbb109194", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899005, "uuid": "537337c5-66a8-49c8-b45d-a5ad7937e72c", "comment": "Malware payload (Mirai)", "value": "c56c3c29851dae704afc10e738a3669f365e645a5e67b3ec50c58e37135dceb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899005, "uuid": "d82fd5fa-b766-456e-b12a-9877a18fb196", "comment": "Malware payload (Mirai)", "value": "4bb5ef42294a1262bacd665bd382f14f59a546be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899005, "uuid": "cd06fdc1-3390-4e5d-abce-1a996be952ec", "comment": "Malware payload (Mirai)", "value": "236a2b92492f05a48c24a4ce5bbacfe1f108888690b63e3ebeef6ba5ad2621f0370264399ca77806296b85faac6483ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899005, "uuid": "28dcc521-77ec-4db6-ba7a-a00a16f96197", "value": "T12EC33B46EB808F03C4D61776BAEF42493323D754A3DB73065918AFB43F86B9A4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899005, "uuid": "17893c08-e7ab-4738-8e7d-bc83c27456bf", "value": "3072:lo6KJfpeaiFmQctqxawz5d8bgmtHx3zM/9NuTi:lo6KJfZ1bqxawz38pHxjM/9cTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899005, "uuid": "efe5d4e3-1b52-4795-9499-2f1208901e48", "value": 120831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899005, "uuid": "487a3605-cc54-4ea9-b051-f3db56e24fb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899005, "uuid": "37ce0945-aaf7-47eb-88a8-c9acf2aa750d", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22da4c85-29c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870439, "uuid": "7eefcde4-f20c-46d4-88b3-c87a3fa7bc47", "comment": "Malware payload (Mirai)", "value": "8e8182fc93a7f3c383493feec9393cc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870439, "uuid": "6d6ddc16-9689-44e7-98fc-9f99127fe12d", "comment": "Malware payload (Mirai)", "value": "c5bb78e76d5682ccff10bc13fe1abbe48ef0b30466c831db1f1e068cdc559810", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870439, "uuid": "edc1cd45-7f8c-472e-bd08-858593ee108d", "comment": "Malware payload (Mirai)", "value": "c0dfe195ad921b211c60055217b26e9dd2cc8013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870439, "uuid": "5f4618d0-086a-4ce6-96ec-7cb61a6b1484", "comment": "Malware payload (Mirai)", "value": "47d666e6501a1486e9e72b3271177a635b8710f1942e1023ebe3810bbda7803a7ce908f591624b79a309972cd424d1ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870439, "uuid": "7e083d64-168a-453f-960d-cb12a6bffe7f", "value": "T12423199ABC918A59C5C423B7FA2F449D3312A3DCC2EE3717CC141B1176CA51E4E76A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870439, "uuid": "c5a9f753-dffd-457b-aefa-7db68ded7ec2", "value": "768:4N8jMiHF1h2KWeRJlhoSudp9nQYIyRCBYqcHP56987OxJD2tBSCNtBNdO1:ljMilOe1hTQnoY2YqcvAEdB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870439, "uuid": "ef7f1a96-0ce2-4fc3-908b-e398efbffe42", "value": 46460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870439, "uuid": "49f115d1-8204-4003-b010-6d4e6190fe16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870439, "uuid": "a2647b26-11d3-4e3a-91a1-f759ffd71da4", "value": "8e8182fc93a7f3c383493feec9393cc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19a0efe-2986-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633841956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841956, "uuid": "645ff165-30f1-4c97-9b81-da7386e12ff4", "comment": "Malware payload", "value": "01f372c9092267e4cc66a0b0b8ab9eb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841956, "uuid": "e29e4e4e-790e-4ca2-aca0-4fa740831a58", "comment": "Malware payload", "value": "c6d765ba7f2c1469d87ca1a2e2848b48a39deeb6d0110f699d0f6d56b898133d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841956, "uuid": "5729c67e-3cb3-40ad-a6b1-2a0b86340be8", "comment": "Malware payload", "value": "82f28bbc365a1acae44a872355a52259400b1b0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633841956, "uuid": "6b39031e-3e70-4d5d-9ab4-2d5f3b336c80", "comment": "Malware payload", "value": "fc2330c8ca6dab6665043487bea43e46f81a50b46d15bc0dc3d10170d5e0b29637870ac67ad68eced503cca5a2c2669f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841956, "uuid": "24ad90a8-2073-4cb6-b194-857b5cff9b36", "value": "T189A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841956, "uuid": "6fd31806-d9a2-4e5c-b8f0-0dd9124c843b", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3neM2bS1jxlrimW+zWBSirHzai:VR/fymd2D3p2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633841956, "uuid": "59476787-6165-4b84-b7a0-35d783f2fe07", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633841956, "uuid": "7a0712f1-bbbb-456e-9e96-9b9c98bf43c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633841956, "uuid": "56aa77de-2764-43ea-9847-ac10d73e87e7", "value": "01f372c9092267e4cc66a0b0b8ab9eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8ef58b-29a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856659, "uuid": "08cab525-d54c-468f-ad3b-5bf1635e37d5", "comment": "Malware payload (Gafgyt)", "value": "876d03b85e05e8ed2b6a56d9471160c9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856659, "uuid": "ccfa444e-1ff4-4a25-96ae-f034e7f2dd4d", "comment": "Malware payload (Gafgyt)", "value": "c77e48bbdfa720521fea6913e9817184f2c981b06bedaf852c8c72651887833e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856659, "uuid": "e99b0419-14dd-4f3d-a240-13b85da08d66", "comment": "Malware payload (Gafgyt)", "value": "4ab7df182e7725339506ae2e05fca9405fe0993c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856659, "uuid": "5c2d86d0-497a-4896-9407-a09b073bbb0a", "comment": "Malware payload (Gafgyt)", "value": "926703ccc28720a861ea82998fcec9937b390cb7e8d82581988a77c0c2bc15b6f1abc539f38f4efff0ad5ecefaebcb8a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856659, "uuid": "d6e480c1-e04f-4703-9e36-55edb0fee886", "value": "T1B1B36C176692C5FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856659, "uuid": "8135e876-b451-47f8-bbb3-1fdc841c4d1c", "value": "3072:Zt2nlia9rRBFZm4z1EYfcbJRphawruJv03CKPCNVOXinYuM8R:MbVm4z6Yg/pha0qcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856659, "uuid": "32627919-5dbd-4ef9-8172-a384029b79f8", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856659, "uuid": "369332a2-3f18-4bb0-8498-7eb4d683332b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856659, "uuid": "9889461b-9598-4973-818b-5d28286f4eff", "value": "876d03b85e05e8ed2b6a56d9471160c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be3e12-298a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843462, "uuid": "85d31497-46e0-434d-a434-52898c4f0a1a", "comment": "Malware payload", "value": "47c56f7023cb9ff72243b14b25491604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843462, "uuid": "08473867-f116-4177-a866-e549fb63f4e9", "comment": "Malware payload", "value": "c9ae917fe7aa8718f693d6a9d5898e277168166e5cf1219656d6b5968e04f3ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843462, "uuid": "60ab909f-30a3-4531-babc-c75565bb1c2a", "comment": "Malware payload", "value": "6dd6d3e478c43a9ea2f3aa4c0bad2df639301ded", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843462, "uuid": "8515828e-6414-4a77-817c-bd88ee42dee8", "comment": "Malware payload", "value": "8bd75c397b8ebe007d9e16ef2d1364ba4dff3c791c33ba727d537bc074435d25d07762903c43ea50b3aaf650fbabea4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843462, "uuid": "583363e6-e8ef-4cbc-92e7-47798187cb04", "value": "T192A3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843462, "uuid": "5eaf8090-53f8-48bd-8a5e-4304f714d51c", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggpx2ymOimW+zWBSirHzai:0oc/pOZM1p7Nggn2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843462, "uuid": "39c2d018-66aa-47b8-8c9c-6eea3c109579", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843462, "uuid": "a4c63482-7d4f-4b37-ae05-f5a8baae7a6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843462, "uuid": "e2e05fa1-491a-4b26-8010-88fb3a48e38d", "value": "47c56f7023cb9ff72243b14b25491604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67576493-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851656, "uuid": "de976d61-7036-4f19-8ec6-74d7c8f4897b", "comment": "Malware payload (Gafgyt)", "value": "bc275b6e2ae9a7672ede5bd61a9ce902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851656, "uuid": "ec717207-67d4-41a3-8cda-568520c01c77", "comment": "Malware payload (Gafgyt)", "value": "cafb460c74b625d2aa98f0f92c3a4032f36e1c860e141924e140f2cb4749c0cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851656, "uuid": "e797ae2c-97d4-4bf3-9aef-558434d118e9", "comment": "Malware payload (Gafgyt)", "value": "a78af0ce2954260d97b3c08cc599c8b6edf1778b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851656, "uuid": "da66ee28-b526-4c24-a3b4-0ccb23f4d29b", "comment": "Malware payload (Gafgyt)", "value": "a5ed494116ca591c1d21a195e2c5ff90ff2715c27b1d0374178beb87e0c0b4137be9ce7430842088ee985933ecaa30ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851656, "uuid": "3bec493d-e277-40e5-a4e3-952c37e4db20", "value": "T1AA833B4398629FB7C1536AB925B759341723EC520B2B2B89B13D99F4438F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851656, "uuid": "ad9b3513-d832-45fd-a542-88759045076e", "value": "1536:NGLm9WhMB5KKUHhG+QDdZNr6TECRRPSmj9VqYLe8fN6e:E2WGAKSxQDd2ESgmj9VqYq8fN6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851656, "uuid": "fc77ae3d-248b-430a-ade1-bc0fefeba456", "value": 84553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851656, "uuid": "2bf40d3d-f0a6-471f-9009-980ec823c8c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851656, "uuid": "cc9d113a-9a39-4915-abb2-c48826f0398b", "value": "bc275b6e2ae9a7672ede5bd61a9ce902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8d35b2-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633877409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "ba35b2ef-df73-41c7-bf8c-d144fa7dee6e", "comment": "Malware payload", "value": "ab77f229184e6eca399fab94101f2174", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "f9df29a1-2ca0-4a5c-8c30-e610f6b11ea2", "comment": "Malware payload", "value": "cb435184cc79661b4b9908930207b5815ceb862ca0696bf13cbb2eef4eafe0a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "2dc61ea8-4032-4e2e-bc34-d798c5597e16", "comment": "Malware payload", "value": "70e119021f3250dd92d3ac85087ebbd3213b840d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877409, "uuid": "073677d4-dac4-4270-9d48-a2358f59906e", "comment": "Malware payload", "value": "bfbedb1e019abd4e5bb5a356b0afc03f2c325933145fd5ce1dc13231d7556b647f0728011d7851794020150892beaca1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "aadf0820-9566-496b-a8cc-723e6801089a", "value": "T13D922BC5BD45C906CAC4463AFA4D868C3B266398D1CE33035B1B7F926786C2F0E3B954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "e455f2d1-5730-48d2-9ca4-b50bf458498c", "value": "384:tR+1YQyude97DLjPU63h/qeEiuLa3Q2nAl016envuXFx4e:tR+1fyuwLj863lqeEiHQ2nozOvu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877409, "uuid": "b0a7db41-d1fe-4729-b13f-2b7b6c2433f1", "value": 21040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877409, "uuid": "aec88cdd-2b51-4332-bd4e-5968724fc2c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877409, "uuid": "261e5b74-164f-4e7e-af78-139e6530ffa3", "value": "scorp.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e187b662-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899964, "uuid": "8e639959-1b51-4d4f-baa9-e90f0014fbdd", "comment": "Malware payload (Mirai)", "value": "1655b59f4c9228f329f62081211b6f48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899964, "uuid": "3f560511-6260-4df9-a244-f2ebaa7a455e", "comment": "Malware payload (Mirai)", "value": "cce62716f88d6d30f40a5ef8ea3268d65d935366d8de52445a0c189f9e24cdb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899964, "uuid": "81aa001e-432e-425f-bd07-a4c5e3c78152", "comment": "Malware payload (Mirai)", "value": "f2852cb29797e7baf858d70ae845b53c87d1bc83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899964, "uuid": "24184d8c-8095-4f7b-94a6-f86af6c7a701", "comment": "Malware payload (Mirai)", "value": "40684b53f629bea62d2fdffebeb5762a9adc2169ea8d5d565b5410a5ce246b983b053dde5c33ee9a1109f4f02858fbe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899964, "uuid": "6e512514-0794-4cfc-a52e-37feb62556de", "value": "T1852307927CC18A06CAD0537BFA6E41CD372563A8E1DF33079D162F51778A82F0EA7646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899964, "uuid": "ad00951b-6056-4cbc-8f86-349431490eb2", "value": "768:AtR8T06qfgBFGjX2E/lDqLrKNds6Xi9LShHKK65tQ9/Dne0FsuDb4O4VlNOQd55q:C8I6YQFGjmE/lD5nzi9WhKtSrEAidj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899964, "uuid": "59423c13-3fd7-42a7-a5ca-afc6ff146a20", "value": 47712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899964, "uuid": "0c63c9fa-d2b7-4171-8c92-d255037b6c08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899964, "uuid": "28adf7f7-c56b-44f6-aabe-05396334cad7", "value": "1655b59f4c9228f329f62081211b6f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59eab11-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873691, "uuid": "543d7986-46d6-4534-a5d0-383b49022a71", "comment": "Malware payload (Mirai)", "value": "0b98bf9e8fc494937539bf9a8f18613d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873691, "uuid": "da673685-21f8-4170-b748-ba28bb3b0e6e", "comment": "Malware payload (Mirai)", "value": "cd45a3e1643e66ae2c315d0e34205ce38282adbe530df05644f44b1de47f33f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873691, "uuid": "e110397b-6473-4210-a286-624d7844f59e", "comment": "Malware payload (Mirai)", "value": "258954e8a780c7512c1d63869c0c24fb34c6cd44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873691, "uuid": "efaaf62d-43d7-4d66-b42a-94b5ebb25b57", "comment": "Malware payload (Mirai)", "value": "a485344cd8bdf3341e53019d8301f00d0938d123249415bb8c5f434fb5728a68072a01e03c3726f563fca54486c60241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873691, "uuid": "a9835700-a7c0-4011-9967-0b0b33e9fc7d", "value": "T1D1B2D01AC09E2E74FEDB7D356941E2817BA15F9F7B61CDC016C15B110222D681F9CAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873691, "uuid": "fcd25f93-fcb8-4053-9fdc-050aa395ac82", "value": "384:2A0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo+t2cM4uVcqgw05Vu:oApCdvwJr69VJoA8FZtxCo8e4uVcqgwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873691, "uuid": "9597b5fc-6b1a-4923-88d0-6c8007784213", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873691, "uuid": "820332b6-bcbe-4330-ae3b-5b8428505ee0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873691, "uuid": "ba7dd657-50d2-4f62-9022-ad8c236f3e66", "value": "0b98bf9e8fc494937539bf9a8f18613d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60eee47-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633862579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862579, "uuid": "028804ad-4442-426a-9e3f-909dbfccdacc", "comment": "Malware payload (NetWire)", "value": "73ec5a625dbd6f09135a7fc68d34442a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862579, "uuid": "f6a03722-6e78-406a-bece-28d1b3ab3a0a", "comment": "Malware payload (NetWire)", "value": "cdebdba6521f1365d2205bd9c9762ea861c3f0a3d966069fc5e22abf64e55a4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862579, "uuid": "aed19787-28fc-4196-956e-9e9ee20b2527", "comment": "Malware payload (NetWire)", "value": "25102fbbc6ab0c52e6fb504524c94e00f871929b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862579, "uuid": "cfb77cad-7989-481e-a4a9-6b511123d245", "comment": "Malware payload (NetWire)", "value": "95c69bd874c1343c5a9b4efe2267f21cb8834325256d548a3b5a68a90dd607aada9ed3ca60b8044c1e3ecb9fa2acbdea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862579, "uuid": "7fc9917c-00f3-4125-be6c-893e973af097", "value": "T141F0AC664C3CD1DB0586A3DBE479DF29D4D608293111F46E96C9CCC6AE121644D3978B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862579, "uuid": "c6e8b421-06e9-4e8e-8bab-e2815c17d8bb", "value": "12:RsNhQH+8WV0uDzQTa1akQERhVwJ3P5SJ4edTASUEoE6UNYGAsURs:RchQH+8WV0D+1tQSVwVP5Ry3wE60YGAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862579, "uuid": "72ccead2-8995-4ca9-84b7-11ebf238aa3d", "value": 644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862579, "uuid": "03e95aaf-c367-4337-9268-7516c05bf977", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862579, "uuid": "a8d14ccc-bf0b-4348-bddd-561ee72112ab", "value": "PO 2006-020 MAQQO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690fa350-2a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906205, "uuid": "0b91ba6a-f560-458b-9859-1050aed13650", "comment": "Malware payload (Mirai)", "value": "4a3d863c65f5e2144dd99aa17712c74c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906205, "uuid": "f6dedf90-bacc-45df-97a5-1a108f2d629c", "comment": "Malware payload (Mirai)", "value": "cea7f04d10fdf06ea807dd9ca4bcc15ddc11fae8e1e59c0119d662f0b627d4eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906205, "uuid": "0d65ccb9-714f-44be-ac2b-d4bf36c37a27", "comment": "Malware payload (Mirai)", "value": "babaec9688b2b7268c732cbc5662fab7ca396e4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906205, "uuid": "43cf5656-7928-4f02-abaf-aa46bdf6655f", "comment": "Malware payload (Mirai)", "value": "b26cb994e6e6a643464cfbc2380f4d3e614e600325a90f5363cd7e87969e6b2cfab40d0cd687764d4bb4602d46af053e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906205, "uuid": "4633c1f8-da49-4aa0-b83c-b835477abb0c", "value": "T1D2D2C0AA88A68B0AE15F40355D9D3C568508E689CF2897F3DCD861E7EB51B301A0C7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906205, "uuid": "f1571a20-9579-428d-9423-95b40e6ccf5a", "value": "768:+CGI5I0VzgdYD/ZGTU7tAFeNwRe7nbcuyD7UJccpz:9Gb0Vz4YDPZbNwsnouy8Jccpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906205, "uuid": "11990305-fee4-4202-8d63-0e413bb31c9b", "value": 29380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906205, "uuid": "ae635092-dd21-4a40-8149-94480218860f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906205, "uuid": "25eb3a7b-5f40-4d58-b917-977f633e376b", "value": "bz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592aff3c-2a0a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633898447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898447, "uuid": "2abf2d33-03ea-4d09-b35e-12f902ccfa03", "comment": "Malware payload (RedLineStealer)", "value": "4a67cb6ed0cf60ddcf3e45917898dec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898447, "uuid": "5eeae4ff-dc39-4436-9501-09eb7e66059d", "comment": "Malware payload (RedLineStealer)", "value": "cebf4c9af84506f3b683d5d4867b739244b6ba595772d583b3455781c4d91b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898447, "uuid": "d0b93bed-6963-48e6-993d-56577bfd5b14", "comment": "Malware payload (RedLineStealer)", "value": "b219ad475097853384d95a0924727389e8610ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633898447, "uuid": "74bc6a92-abd9-480b-bcb4-ecf9dc9a94fd", "comment": "Malware payload (RedLineStealer)", "value": "0a6b248a1b95e7d677638ccab7fab5d970d6a8ea21d1084a926670f1e59a7cf79b97834d1a9e64f3536fc9f2115d1da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898447, "uuid": "d2b3702a-d4ba-4095-9e43-523572c9c1b4", "value": "T1D746DE4C0AF3C6D4E7D2DF2D4276BA2795523F53192A7EDF02D45A8A0943182B14FA3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898447, "uuid": "f4cd01db-65e4-46bc-9877-99a9c3725253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898447, "uuid": "2799beb5-9554-4d22-acfb-ba152e1cf6ac", "value": "98304:h3OOqyTG+H9QG7l1rvQjPleoGI9Wek2WiCU+gw6pTslbqXD09r/:9pRl1L0P4or9ytiG6WlmD09r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633898447, "uuid": "0af6dfcd-932a-427a-b268-52d6113d474b", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633898447, "uuid": "17df5f94-5724-4cd1-9148-3300b97bbf61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633898447, "uuid": "375419e1-1a8d-4059-8f4d-430ce41a7108", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.27267.23658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db11bff-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633866618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866618, "uuid": "e6d4dfc5-bde4-4f22-a348-d3777cf6158b", "comment": "Malware payload (Smoke Loader)", "value": "2b18c0755ae564abafc36b02742014f9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866618, "uuid": "2975312b-a645-4337-97d4-54ed99286868", "comment": "Malware payload (Smoke Loader)", "value": "d32f57ddf4d662f0e217ea3c15f254aa70e052626e96b3da6c6017f7b3807fc4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866618, "uuid": "ab6c19ba-abb5-4a8e-a81a-957091d8896a", "comment": "Malware payload (Smoke Loader)", "value": "36fbb007183250cc9ace71d8e2469310ca1416e7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866618, "uuid": "6e1c73ab-cc3b-4a36-b113-f972d87e4255", "comment": "Malware payload (Smoke Loader)", "value": "543761c4a59b3cc98598092e315447432290f1cf4f0434e1392ec9d4869d993a29722735f69f4784f1b30897d108fd15", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866618, "uuid": "6ae1f263-744c-4254-9e63-acc99e06bb72", "value": "T197747D10A7A0C035F5F316F949B992A8B93E7DA26B6494CF53D42AEE5634AD0FC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866618, "uuid": "be7f6812-76e8-4ab0-a76a-8d502b8bee55", "value": "c184523c937a38bcd56e6e1e309f387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866618, "uuid": "68085490-2af0-4be7-a185-3ed17a585531", "value": "6144:ygW3mN9IWTLJeLqd2cXu87tAN6f9EDFqYqwsK6agxYc:w2UWTLJMqd1+87tAUfGqYqwsJacYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866618, "uuid": "037c572c-a00a-4ee5-826b-13657c2f1bab", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866618, "uuid": "ac8a5340-d182-486d-a1b2-a457ffc04c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866618, "uuid": "74d14bdb-bbca-4f00-8e89-4710f506bb61", "value": "2b18c0755ae564abafc36b02742014f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae47d374-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873679, "uuid": "13ef11cc-978f-4284-855c-15a43400011e", "comment": "Malware payload (Mirai)", "value": "ee1976e284678219019a16cd47bfd2d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873679, "uuid": "a07cbbda-3574-4e7e-967a-0d0bd0144574", "comment": "Malware payload (Mirai)", "value": "d394569aa51be9d5c1a8efdfffa822554bb0f30ab6f5dc071b6ab375af5a8418", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873679, "uuid": "452a1792-e356-47e3-bbab-7dc748d4887b", "comment": "Malware payload (Mirai)", "value": "aa792c5f11e7d83dd342f9bc18bde1cf6ce50e72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873679, "uuid": "e3922eaf-9c64-46a3-8a1e-ee2b3acf7b0c", "comment": "Malware payload (Mirai)", "value": "4ffb864d802349bc7af7f994b837ebc980852889bc7f8feda43078bb91e3915c52a3486b0b48c56d774708c4957c294a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873679, "uuid": "b7da543b-84c3-40ae-a476-1a7930349515", "value": "T18CC2E1DFF48B7985CD1C5CBC259C56D116A9A2C3234A9F0837203DCDA67644FB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873679, "uuid": "4e037f00-9bac-4d03-802d-81e2db489eec", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBacWE:oCrJgHiOJrfwmQrctX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873679, "uuid": "9f00dce1-a696-4258-9b98-4a121a7ce0ff", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873679, "uuid": "da268af9-eab4-4d22-ab06-6652b1597dd1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873679, "uuid": "77479627-9923-4d46-b65a-363055497fb3", "value": "ee1976e284678219019a16cd47bfd2d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d79bb3-29e2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633881131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881131, "uuid": "9ab1a18f-366d-402f-9980-562ee153a65e", "comment": "Malware payload (Mirai)", "value": "94e8b7ef9cc75ce341879300fe91916a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881131, "uuid": "94d597be-b912-4df5-b4ef-e7196a426f73", "comment": "Malware payload (Mirai)", "value": "d4177a46a68e16ee1dadd50d95c68f3381f4976e210ab804d19c6c24ce6af459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881131, "uuid": "593f398a-3bff-4d23-ad9f-a65f10631ab3", "comment": "Malware payload (Mirai)", "value": "9c9d9ae6a92f175a4c6079a20670478ebc5d8605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633881131, "uuid": "182508d9-e8ac-4805-a6dd-ba16b2c475e7", "comment": "Malware payload (Mirai)", "value": "51c1ddf6c7444013e06da5958d95c942b732155fffa6529c02a1be71452c8c934af3d2d0b61660243e2a61996df140d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881131, "uuid": "38c659d3-0d61-4074-a388-eaa90257b8af", "value": "T115D2E045B632EC72DBB00879EEB565851314EBE4F0E97647407E8B8C1D86882F6FF444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881131, "uuid": "ef162189-d75b-4d63-95d7-8d85c690b28d", "value": "768:hR/O316oNynhY+7hKsfErPlq5N59IR1tyq9q3UELCq:iF6okhY0fE7o55IRqfLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633881131, "uuid": "a8be06ad-a16c-4f52-a5ac-3b2ad80b2fbe", "value": 28844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633881131, "uuid": "9837778f-1ced-4669-bb1e-134e22dd3b7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633881131, "uuid": "59fb08b9-8f73-4f42-9bdf-97e81e32b4af", "value": "94e8b7ef9cc75ce341879300fe91916a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc90d798-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633851396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851396, "uuid": "8c9789f0-0537-40cc-8013-19936bcbfdd7", "comment": "Malware payload (Gafgyt)", "value": "a3deda360996f84fd21250df2312f1c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851396, "uuid": "20f6e523-dfa1-4e47-8d45-cc01f9fe9e9b", "comment": "Malware payload (Gafgyt)", "value": "d49bad10b25acfafaa69cce6d696ba886489da9839def6c56c7bff184951e7b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851396, "uuid": "45fd2f42-8ba7-4c15-aa34-713ea0366748", "comment": "Malware payload (Gafgyt)", "value": "7880167ce1b04b523aced0292779afd6428ea2b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851396, "uuid": "06842069-12cd-4f2a-af33-27aea986acf6", "comment": "Malware payload (Gafgyt)", "value": "b7774ddfc8d3eadb8c9896bcfd6d81a48453bd64bf06d316ebd905e47804d9e16f46a0da3f5a318d1adcff02a015677c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851396, "uuid": "daaeadea-ff6c-4b93-8c6f-59652fde622c", "value": "T1CBB32805E5508757C1D2177EB79F825D33222BB893DB33215A24BFB82BC2B9D1E3A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851396, "uuid": "7bad2940-92de-4b1d-b0cf-450fbf7634f6", "value": "3072:NqdZ3at1WSZtAWSjgglV8lJ2D3rgLaUbmTQOWsXPOn:N6Nat1WSZclV5D7gHbmTQOWCPOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851396, "uuid": "41c5a2c1-3554-4028-95ec-4c45abf0bf6e", "value": 116136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851396, "uuid": "ee840741-524c-4010-bc25-37185c990249", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851396, "uuid": "332158a6-4ab1-4ea5-bfcd-bee72d93677a", "value": "a3deda360996f84fd21250df2312f1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b7e58b-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851391, "uuid": "8ff5d0ea-649a-4ad1-814a-3d5792cb14c8", "comment": "Malware payload (Mirai)", "value": "ade4221fc5c6fd49fdbba802ca7c5bfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851391, "uuid": "3b82c03f-5c2f-4d4a-bcd4-f260fcd6138e", "comment": "Malware payload (Mirai)", "value": "d589892df76a7cb1cdc416059f46376fc7eb451cbb2f25bfceb181696f278d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851391, "uuid": "21770435-e102-44f9-a406-dc0160dfaf32", "comment": "Malware payload (Mirai)", "value": "db92d2996bf7fc0bdb8bc5df51fef7f635ac1709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851391, "uuid": "20efc1d7-253c-404a-b85c-d4096c1f30d3", "comment": "Malware payload (Mirai)", "value": "6c9ff245cb74e31a7e000bcc799848e48a2dd0364065ede8b570f013d99ee56faf0616f6edbc06fd5d81ef821520df49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851391, "uuid": "d8c6f0ab-fc39-4b1e-8ce5-7aa4365ce3cd", "value": "T1AA332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851391, "uuid": "1aac3f9d-7825-46d2-96ec-ac85058462ee", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gx:mL/4f8F1ef0YgFvimzpZi2UJJnHY8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851391, "uuid": "df6bcd6c-1643-44ed-902c-e7a62e046878", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851391, "uuid": "dc574c3b-3d4f-4274-bfa1-1d7b514a7b3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851391, "uuid": "fc2ffbbf-7697-4134-93a5-e4e72bc64c91", "value": "ade4221fc5c6fd49fdbba802ca7c5bfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf23166-2a21-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633908468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908468, "uuid": "46d2cb33-723a-4d04-88f1-d8eb0837d8ef", "comment": "Malware payload (Mirai)", "value": "4f543803de7decb0d4c40f2c08378557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908468, "uuid": "5bcc1381-a710-4f21-aa69-b681f41e2392", "comment": "Malware payload (Mirai)", "value": "d5eacab2d2efe9fe920985a2e4abf928780c9d69df2eb1951585e7b56dfa0c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908468, "uuid": "8de97fd5-c476-4516-a22d-f5153afd014e", "comment": "Malware payload (Mirai)", "value": "2f27de7f00b65e406b4aab73a9b5e06e92f1c590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908468, "uuid": "53267c36-b62d-4bc3-bb4b-a423d22bcd46", "comment": "Malware payload (Mirai)", "value": "71599c9412919c281aac7b2374f1a6f183511732bb04d83aef2bb35792de4b68cd564d58798e6c56a88de00c99e3ca7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908468, "uuid": "2df3886b-5dfa-4118-8eb6-a87acac9934c", "value": "T12173A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908468, "uuid": "f22615a4-257e-4338-87ab-8c3910535a35", "value": "1536:zoVvPLWTs7ys6XcniEyNMin3sDmTRdVSabdza3TTLbwXmP5y:zo5WTm6XouMk3sDmTvVSabQ3TTLbwXm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633908468, "uuid": "b1628735-26ed-4b97-a4ce-c4b3bda2b95d", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633908468, "uuid": "30f87411-5bfc-43f6-a2ed-92e6ea37c1b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908468, "uuid": "66e632ab-a8f2-49d8-a62f-3a2fdbf14cbb", "value": "4f543803de7decb0d4c40f2c08378557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffd7130-29c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633870434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870434, "uuid": "c7275a08-e902-49e7-9cce-4cea1f10e4a3", "comment": "Malware payload (Mirai)", "value": "4b81346d0c3dcb6113e94fcf51f00a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870434, "uuid": "b7e2319f-65d2-4a31-8706-18f281c2fcd4", "comment": "Malware payload (Mirai)", "value": "d6ed20a1a1e1f1d05038098cac33987978fb0c063416a63845da062e18a717be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870434, "uuid": "4ad7ed80-6dd9-463b-af1b-308c0e5f29c9", "comment": "Malware payload (Mirai)", "value": "8594a0c01f3466e80e9742f64cf32d9c9c46d294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633870434, "uuid": "0792f831-0062-49a6-81ac-f3651f86ba4a", "comment": "Malware payload (Mirai)", "value": "f9976d2cc7fd17d84d077b16a6ef04fb55ec8a765894cabff17e17bf50355f16801aa10ded7161616b28ce7a21b1dca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870434, "uuid": "5b9901a0-f7e3-45f7-8044-9cca463a634d", "value": "T1F8737219AFA05FF7E8AFDC3349E91B4525CC551A22A83B76B930D418F34B64B14E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870434, "uuid": "ff8e313c-aab6-4d8a-9225-a057948663ad", "value": "1536:aXq1YgcQFIKLSwWP28sCLezQcfaZx3Cyo:Sq1YFQFIk7WPvCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633870434, "uuid": "7001a3ac-75fc-4edb-92d0-9bc77f35fab3", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633870434, "uuid": "0aefc441-1741-4971-874e-00e7e18ef1fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633870434, "uuid": "385ad401-fff2-4f26-ae02-18c2692208ef", "value": "4b81346d0c3dcb6113e94fcf51f00a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f9ba42-29e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633880515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880515, "uuid": "16f41c63-1ba5-45fa-b7ac-ddbf95d38ef4", "comment": "Malware payload (AsyncRAT)", "value": "4adb3a47d33b76506499d2be6b60351a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880515, "uuid": "4d8de0e7-6e61-470a-84dd-c9120e672a71", "comment": "Malware payload (AsyncRAT)", "value": "d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880515, "uuid": "5e6943cf-f806-42d3-b87a-a1e772a04e4a", "comment": "Malware payload (AsyncRAT)", "value": "5305fdc90c3ba06867d3765e826c1fa1312d7e0f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880515, "uuid": "c7b9ee32-f14b-4880-a3ba-254bfc832313", "comment": "Malware payload (AsyncRAT)", "value": "634e63a6e1021493cdadb0e4d30acfcd0e400fcf94e09b53312a9c9d15251046b788f3edacffe82e47a064abe9f9d5bb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880515, "uuid": "8fa72895-6d01-4456-bb4e-018a9fa1e86f", "value": "T13E2512A6B4612109F6F0313C8FA1E1380725DD95EC1B9736A5E23E0B71FC663461BBE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880515, "uuid": "d42f82e8-e630-4fe0-a001-c74979c652ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880515, "uuid": "d1f0c561-1133-4417-8f16-d621966acdf6", "value": "24576:dE6IHTdtrccZ+53qqdPbgLWRQ2KchYbs+hkAQ:dE66TAW+53Pb6ibY/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633880515, "uuid": "68071108-767a-4e85-a6ec-c37b2624c9ba", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633880515, "uuid": "ed324ae7-c21e-47af-9501-36d6e086b3c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880515, "uuid": "edb5a8b4-e876-4797-b762-2c73417ddf9e", "value": "SecuriteInfo.com.Variant.MSIL.Cassiopeia.4.13640.9335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbef3180-299d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851905, "uuid": "dbf365f9-d3c4-4154-9e72-0c049b805b15", "comment": "Malware payload (Mirai)", "value": "f80c03180be311e7e81d57be7e124ff9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851905, "uuid": "3133cc98-2786-48bb-9812-82f088d25c22", "comment": "Malware payload (Mirai)", "value": "d789ebace33132f9ef57ffe310ebebd569620c4a4cb24e5bf8ba839b618da398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851905, "uuid": "ec3238e6-f280-4c54-af7c-a4ea20739429", "comment": "Malware payload (Mirai)", "value": "da8314e049072ba720d567ee2153fe0957ec2b1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851905, "uuid": "4a25b774-20e3-4940-86de-436c1d5cca16", "comment": "Malware payload (Mirai)", "value": "3142f154032ff703a007643d916b44bf3a97733dfd96ce220fb0681c67bc19351a7fabc5a066b28ac48e07c390e0a8c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851905, "uuid": "cd9a0fd4-289e-4a56-abc3-ed207915e1c6", "value": "T135337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851905, "uuid": "9b5a7353-40b0-44c9-94fd-1eab8f19d5aa", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv8:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851905, "uuid": "1cdd7b3c-d7ec-451c-92ee-7c495666948e", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851905, "uuid": "aebab121-576f-4d41-8d63-32f0b952cc80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851905, "uuid": "bf77878a-8b34-44e1-abc7-92b8127b0972", "value": "f80c03180be311e7e81d57be7e124ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce4ce2e-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "38d6e9da-4e47-43c5-8bf7-6e3959ec403d", "comment": "Malware payload (Mirai)", "value": "6404dbe1336d2daf31bdfd033ded500c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "1b1e44cd-0c0a-4ac1-84aa-7ddd45a05b03", "comment": "Malware payload (Mirai)", "value": "d847528278f5d850d9ff2049cfd57cecf7aef1bef3ae11e99f5150bbeb5451ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "8bf49dc3-0705-4786-8169-f7160370dca5", "comment": "Malware payload (Mirai)", "value": "128ff9d8791e97136af34d81735d0e1b5794426d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877408, "uuid": "ce105983-e22a-49e5-b236-deabf4be3bb2", "comment": "Malware payload (Mirai)", "value": "b1c869d7e8053cb8978b347bd0428cb6a916a03701df7ec0375dccb7ac3e678526dd95faa0ca77c00da22a6b5c14ccbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "8392692b-5c74-4bf9-87c8-55822a500706", "value": "T17C230221543A20B2C879BF3DCC386141BDEE5BF7C26DE58A253D0B94C5C76564A2AC72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "a4de7178-fcfb-4b4c-9075-506c122db843", "value": "768:ndG7anq6010ib43xQIDoVWQyTg6wtU3x9q3UELuF2cFfDr7JlulHAWYsGnLcvEFk:oh0i4xBc4kDtU3kLuHlDWYsGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877408, "uuid": "b819c58a-cb96-47c2-b17c-7d401b6359bd", "value": 48088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877408, "uuid": "bd766041-5040-4f42-9b92-55d7b574762a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877408, "uuid": "71cb7bf8-94ec-4eef-9633-f1b824634b3e", "value": "sora.arm7-20211010-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891d9891-29ee-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633886502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633886502, "uuid": "616ef337-f41f-48f2-840b-9c103d8e7efc", "comment": "Malware payload (CobaltStrike)", "value": "8832cf17393bf54fc9496351a6d95542", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633886502, "uuid": "0bd51876-7723-409a-8d36-f0710a450fef", "comment": "Malware payload (CobaltStrike)", "value": "d90514c5b26e568a6d51eec779bd3bea328b890efc00aa179f8edd617754a802", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633886502, "uuid": "5e8b00cf-304d-40f9-baa4-e069dd0c1a90", "comment": "Malware payload (CobaltStrike)", "value": "6db1566026ff022c5bdf1fbfcb7f26c3c21a4aab", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633886502, "uuid": "621b8732-1af4-45df-be0c-24f161847b77", "comment": "Malware payload (CobaltStrike)", "value": "e891c8d9767dfc2c9f97b79f2b594e94e91253536018b1ee7b87428e507a7b1915b3ba9024773ba8c3dcace6919ddaf1", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633886502, "uuid": "3d1c97a3-de56-4a82-8cd1-97fa534f9652", "value": "T17544BE033B703CA9FE47E4348DDB2855AE652EE71B85DB2612E1041A9C8F789E9CDD13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633886502, "uuid": "b628f198-9970-4ad2-8ffc-34f1641f4ffa", "value": "1b06e3207356683d680e2b2d25888649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633886502, "uuid": "86750408-5f88-45e1-95d5-43c79c8f511b", "value": "6144:N+e8DWV/h9HWIp+KW4Oz2w1ASkH1ENDiOiNep:Q/WFh9HP0KW1z2w1ApH1ENliNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633886502, "uuid": "ae2d9be2-52f6-4aac-860e-1e42326e804e", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633886502, "uuid": "23eb16f4-6cba-4a9f-b9b5-4f5ea9e3dab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633886502, "uuid": "e173b560-286e-4e13-945d-de82b7cc3e13", "value": "ExtractedMZ.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5768a1f0-298a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633843469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843469, "uuid": "d13bdabf-7e6b-4a3f-97d1-1d144c613381", "comment": "Malware payload", "value": "1002c39715e3b5c56cf97a5829e98fbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843469, "uuid": "110ef4b2-9f72-49ee-9c93-dcd0225be79f", "comment": "Malware payload", "value": "d97f5e88697ab1dca9f2eba4e9bf49d16bd5c556246a00f8e40183298b093fed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843469, "uuid": "f33e0fda-622c-4e7d-8abc-0c60ab7f231b", "comment": "Malware payload", "value": "23143823f8e5ab1ada2f51c6325dcf758045e279", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633843469, "uuid": "49b7a81f-d98d-4793-b871-f0358df4d7f3", "comment": "Malware payload", "value": "17ba76e238c2315474ca9248bca6f7ae7adf9bab352c8b2218b9fb772f0601e3cccfee0f945dfff29735cf818b743f39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843469, "uuid": "2386fbb1-c71b-4f40-9831-267833d9ec91", "value": "T129933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843469, "uuid": "2f5c2c0e-d1bd-4f8a-aeaa-88adc815b5a8", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvDUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBDUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633843469, "uuid": "b8583c27-2e52-4287-8c8d-d79a4f3e15e2", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633843469, "uuid": "fa056ed1-1c70-478f-ad50-08cf04b060cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633843469, "uuid": "397bf5da-96f0-4575-914b-d5ffe4d91d58", "value": "1002c39715e3b5c56cf97a5829e98fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d077b918-2a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633906808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906808, "uuid": "3e5ec3f2-17ec-4b16-b77a-2a9e1b392b8e", "comment": "Malware payload (Mirai)", "value": "9e4486b3e772eb7752e9192478777ec3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906808, "uuid": "e4995cb3-393b-45ad-9937-49ad26a31a54", "comment": "Malware payload (Mirai)", "value": "d9cf573dcd15ae6df4f5e41fc53457b7ab858cfcd46cd3d2f570b201718aaff3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906808, "uuid": "ac927eae-97f9-4eb9-8d46-6f435047c5ca", "comment": "Malware payload (Mirai)", "value": "5b43d0e940ea91f0b5c5718abf52c78d759ffbbc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633906808, "uuid": "191609a3-c4bd-4c35-a48b-5a7c126be603", "comment": "Malware payload (Mirai)", "value": "b6d4f37b62f25856eb98c12ced935fee48854386454db91c4e4abcc5e0bdb046049430e5e5a8e2ac328ac14339ef2cc4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906808, "uuid": "35fc6db1-1ab7-4099-bf4e-cd7a3398608b", "value": "T10333D79578D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906808, "uuid": "badb5b6a-e1ff-4443-ac34-8b90321b9fd4", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633906808, "uuid": "ed60552a-ec10-48c0-b485-0f4760c00b6a", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633906808, "uuid": "f1f30af1-99b6-4416-a375-b23f2cf712aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633906808, "uuid": "f9e61ab2-77d9-4112-b9ed-0f27d70b83a2", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e983ba1-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884256, "uuid": "e40f7ea3-134e-4765-a544-36da91ca67d8", "comment": "Malware payload", "value": "68c3edeeea8769af5334f3e3ba9120c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884256, "uuid": "50b16077-f56c-483c-8944-3dc6b9f5aedc", "comment": "Malware payload", "value": "da0ded58b189e359310cbdea0db32b37b72c3efb55689e070ecc81af0351fc31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884256, "uuid": "f4e876a2-ce29-4268-962d-e76af00699ee", "comment": "Malware payload", "value": "e70f2800499a78a16918594bdb008561f3e60e97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884256, "uuid": "3efcc2ed-f247-4f14-a205-c61b22c84209", "comment": "Malware payload", "value": "f7a49c93cbf42ef787b9c95a2abcf63d7f3a428049e95e91b5241cf8e940de2c1ab728728f3d9336ec817a13499807ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884256, "uuid": "5f4bc0ef-bbce-4ee4-a51a-1fc0782d213f", "value": "T1A1931943A8A19FB7C146AEB566774E640753BC512F4B1B89712CBAF4033B5CDB80EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884256, "uuid": "24ca2d35-749b-46dc-b762-06539c75ff32", "value": "1536:UTvqUqYpUSYXcKdQX6iAJmvQU2v0CvoqEEmK4Npbsizfn61NH:UTCxYpUFXDdeAJmU0nq5mHNpbscfn61h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884256, "uuid": "3b1142f0-a30b-4d62-96ec-1e2e2c6b47dd", "value": 91601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884256, "uuid": "aa0ab15a-721e-46c4-b695-a8ce2f1c299a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884256, "uuid": "249dc94e-8b49-4533-a84a-4723abc71993", "value": "68c3edeeea8769af5334f3e3ba9120c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff2a0d8-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866729, "uuid": "13be631c-a5a0-459b-957b-adcaadb7671a", "comment": "Malware payload (RedLineStealer)", "value": "08e646009c46bae2b2db1d44f929eb89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866729, "uuid": "17a93ef1-7bfe-40b0-b903-1a6208c5f15d", "comment": "Malware payload (RedLineStealer)", "value": "da184b3620bfaede69d888624cc3971efd9a72c58941a358d58f63e8d7eeffef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866729, "uuid": "1d80a007-9466-441a-8817-6c570c731cf7", "comment": "Malware payload (RedLineStealer)", "value": "538604937b6fd0fff178ebdbb7fe4faef80840d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866729, "uuid": "d8b03bbe-820f-447e-96c1-1b6ed7752158", "comment": "Malware payload (RedLineStealer)", "value": "4b4afb040098a4160361af13083bf1ac5f175dde926bff733ddabb446f8bc0a9fb31529b50bf3aaecbc09587755c62f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866729, "uuid": "d6fb7568-44ed-4f67-b239-ee7af5daa824", "value": "T172056B28A3CCE51BC82D0E3E4D3F5B4B53E1E5CE7335EA9621DC6B933701A956E8A144", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866729, "uuid": "ce2f73a8-26ea-4585-a63d-4a987335f3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866729, "uuid": "6f52f00e-5378-40b3-a215-c0ae3c109ed6", "value": "12288:cbARIu5yv4EZvH2T6ZVCFerceeOkI9TkFyRj7V1RVGawu:cbAiu5yg8H86ZAIrtFR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866729, "uuid": "3cd96d18-69cd-4c59-b5b7-0caa8334f2a0", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866729, "uuid": "4eb73434-f09f-4622-8c70-4e0bfefc687c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866729, "uuid": "61b146e2-c0f3-4c3c-92b8-e8ac8cf14c25", "value": "08e646009c46bae2b2db1d44f929eb89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65604dc-2a21-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633908455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908455, "uuid": "9cf32dc1-0366-4528-8ef8-943c8f6deaed", "comment": "Malware payload (Mirai)", "value": "0b8f281ef806d1cf292184dc67ec51c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908455, "uuid": "ab35e9fa-9b42-4c34-a99f-b641ca7132ba", "comment": "Malware payload (Mirai)", "value": "dab61661cf692c5759044d453a396aca7e547c73f601d10c1cb309057882f508", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908455, "uuid": "b4ef2117-88c6-4147-94e7-0d3d133ef98b", "comment": "Malware payload (Mirai)", "value": "14c850443d76bf4a9e97d0be38b873289557b29a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908455, "uuid": "dcb958e0-7508-4fe2-a148-ee787f173619", "comment": "Malware payload (Mirai)", "value": "1695e08db669b3c41db85d32b24c7ef9467efedb2280cbdcb3d7ddf1d1e20e3d38d397e2e65c50905d5da90d4459de63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908455, "uuid": "20c48aaa-ce74-4340-9542-80222a51e235", "value": "T13573B309BFA50FB7EC9BCC374AA92712248D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908455, "uuid": "f21afa27-7535-4a28-b010-32e3f018eb3c", "value": "1536:aHJtIFGq1QDT+uDEQhKvt191Yi8ZNFDGo:aHJtIMZT+UEQPi85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633908455, "uuid": "b3531c7f-12e8-4380-afdd-7c61cf66f098", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633908455, "uuid": "f46ad363-8448-473a-9f50-1bfa2903ee4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908455, "uuid": "24019f5e-ffbf-422c-9687-1cb82c9644df", "value": "0b8f281ef806d1cf292184dc67ec51c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c783469-29cd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633872200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633872200, "uuid": "b65ad11a-2351-4eac-a9f7-ae3d5d956bff", "comment": "Malware payload (AgentTesla)", "value": "73cc38021a050e98753b80eb5cea401c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633872200, "uuid": "1fc68aa3-118d-4143-adf3-365b55a781d7", "comment": "Malware payload (AgentTesla)", "value": "db330bed53a47d03acb1c92a30ba531d47fc45216ddc6325e4e5460f78fcfd61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633872200, "uuid": "b5a6e16e-31c2-4eea-8217-1e99209c7c0d", "comment": "Malware payload (AgentTesla)", "value": "e04e19378989b99b3595b24d5b19b72abe07f494", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633872200, "uuid": "831da55a-5529-46f5-9d84-6b1b3f3ef60e", "comment": "Malware payload (AgentTesla)", "value": "1f90afa9d160189518677508ecd3487708552ce98bef35d38b93f0989b1781406bddb37a77cad18e3e02e230eaa77f0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633872200, "uuid": "2c0bc1dc-3ef1-4f1d-9361-2fe3a3fe5966", "value": "T1FBE4CF202AEA506AFD73EF781EE0B495BF6EF77226025479D05303970613E81CDE2979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633872200, "uuid": "16b62ed5-6fc7-4e1d-a93b-269f66e6013b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633872200, "uuid": "ef2ccc47-5d71-487b-a88b-b9d7a95b2865", "value": "12288:a5hv5vBHvCYyRGw3Bq31CJVm+ApBXwis6sfQHuNv0:aPzvChRGw3A1jaLfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633872200, "uuid": "0f629b88-c9cb-43b6-8171-5b1c542eda20", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633872200, "uuid": "6ce2ac4d-1c8f-49d8-986c-c5eeb9042849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633872200, "uuid": "0669e459-a4c4-41fd-b17d-425da6e4bb6d", "value": "CONFIRM PROFORMA INVOICE NO 21091042 21091044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd633e8-29f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633891023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633891023, "uuid": "bc23e95f-2cb1-419c-ae60-d483f4cb410e", "comment": "Malware payload (Mirai)", "value": "c695f9d34e7ff969100812e109150729", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633891023, "uuid": "26e87f3e-0057-438b-a8a0-aa5b4a6b30c3", "comment": "Malware payload (Mirai)", "value": "db9f7b1e89de98f6174d6a5b80c9200148e72689247f883e66c6f0613418d9b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633891023, "uuid": "b2c0faf1-d541-4b91-bd44-c3e7527d2fe8", "comment": "Malware payload (Mirai)", "value": "a765c91e2c416f3082468b3d06b21fe640ccffd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633891023, "uuid": "2b813094-e5d0-4782-8ef0-78fc62a78494", "comment": "Malware payload (Mirai)", "value": "a188515fd2a534b901b2f4b87fd94ead99e5faeb0e356ead8319da84da8023f680c6b0a743fbd7b9d4d92c53c60adaa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633891023, "uuid": "dc06f3d3-ff98-47be-8768-9363a071e9af", "value": "T1992396593E228FFCFBAD863583774E216648339A37E1D584D29CD6012EB030E645F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633891023, "uuid": "f66e9eb5-029c-458c-a83b-2aedc147b0bf", "value": "768:K9b5P63rwAs6sbFP6BbFP6x1dyYN4iwlCX6qpVEdw4J0/6OMITN9AzkNifA/10Hj:Ux1dsqpVEdwx6qU6ifA8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633891023, "uuid": "a03b65f4-6271-404d-9d25-e8baf56a09de", "value": 47136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633891023, "uuid": "bb035b4a-c8ed-4506-931b-53613eb85481", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633891023, "uuid": "73b988b6-fff2-41a2-9ca4-242a26d0ce4a", "value": "c695f9d34e7ff969100812e109150729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50179a1a-29d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873951, "uuid": "79e9bb40-ca0a-47ef-a340-775b6e32af6f", "comment": "Malware payload (Mirai)", "value": "8b7e36d61258454c5adcdf98958d704e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873951, "uuid": "0dff7484-2396-47ff-bbcf-c3e1e3fe92e6", "comment": "Malware payload (Mirai)", "value": "dc33f5a0bfed8efb5f912fd0427afd548ef93ffb4b8c5ae56c70b584d361df10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873951, "uuid": "88910228-579b-4e98-955d-28d69fd337d0", "comment": "Malware payload (Mirai)", "value": "6c28b11ce6fa8a0893934530bef30f4a609ed4ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873951, "uuid": "48eacc37-07bb-41f5-bce1-00dd4816668f", "comment": "Malware payload (Mirai)", "value": "b326b653ccdff235c709bc2554a84c7fc973df1a653b8dd5b31a37881a83c081e3476c72dd635a2c83f8ef420b5d8f85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873951, "uuid": "c7a76e28-cfaf-4a17-8ab4-5035d19a47ec", "value": "T1A3B2E195D6EB2BC3D2D1D336D0BC9A8DE2721AC00746440A1009B28F93AA60E57FB7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873951, "uuid": "bcf1d945-1006-4ae6-8877-74c9f9a3dbfd", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUFt1diSAlCo3AnupsFNYrk4d1NEZgO8UXWozPLH:R/QOC0Yhn6ROHWFjicwNqFOXnNBxcFc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873951, "uuid": "2c4f1af2-939f-4966-b10e-1c9487185106", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873951, "uuid": "53327c36-95de-4d8f-8ceb-849f51643ea7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873951, "uuid": "cce2bbac-4b17-4fdf-bd14-ac1e43b19fad", "value": "8b7e36d61258454c5adcdf98958d704e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a182e08-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842507, "uuid": "3596318a-24bc-4535-b8a0-4601190e7e1c", "comment": "Malware payload (Gafgyt)", "value": "057044cac500de07b81836412d898a90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842507, "uuid": "c5e8585d-c5e9-4fe4-96cd-a5593bf2033b", "comment": "Malware payload (Gafgyt)", "value": "dc84d9dc650b8b66354090ce77bf20b15afae1fbbf4e8ef5fddb576d4bf77435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842507, "uuid": "e2b40acc-80d1-4c84-a05e-423004132c83", "comment": "Malware payload (Gafgyt)", "value": "5300b574ac12cd83857d18edbab1599c6b91bc12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842507, "uuid": "89c38d48-13a3-428d-8382-9a567dd8899c", "comment": "Malware payload (Gafgyt)", "value": "e859a2d4c23df715d41f2f3174f7bff4812be0d51400ff0226cb84cf2fabcf62e96f5440637c7a58436137d2af6fe74f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842507, "uuid": "02588a87-9bee-40be-93e3-bc67a88442bf", "value": "T1BBB31907B70D0B93C4CB56B03DAB2FF15B68BAE013937181692AEBD017739B52512F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842507, "uuid": "7d6b4e31-d34b-4755-b41b-7eefc527cf84", "value": "3072:xrH0jQEEA4cn73xSgFhqpxEmKYVVDkEMNfR+e:xrH0jkA4cn7hFFhqpxEmKYVVDTMNfR+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842507, "uuid": "23456aa3-e569-42e4-a5b0-4a43a59184cf", "value": 114079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842507, "uuid": "af2f1612-5acd-43bc-a036-f44c0ded0338", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842507, "uuid": "ab217c74-233c-4347-8a6c-76f6b48042cf", "value": "057044cac500de07b81836412d898a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a969197c-29e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633880543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880543, "uuid": "2d90bc8a-479c-4017-ba94-fba629aade87", "comment": "Malware payload (Mirai)", "value": "3f0eb5df330b3a0daadaf1e9ea346051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880543, "uuid": "99fed40e-9146-479b-8496-c5c02cdf3b9d", "comment": "Malware payload (Mirai)", "value": "dcef502e29de30f9f68ffc68a8173457cac545b1e8b92ede8b0b0a97e8202030", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880543, "uuid": "7e02b4bd-1306-46e9-8401-e55a36ceb6bc", "comment": "Malware payload (Mirai)", "value": "c003fe400f35d3ac372401b308ca1a0cd25c6da2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880543, "uuid": "fdefc44c-35f1-476e-acf3-4598db32fb71", "comment": "Malware payload (Mirai)", "value": "6244963988c2ff615fab882bb9ad4e38443954941469ba565ad687f3b2c018d9c297e080ed42d9c892ff94d7777a2902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880543, "uuid": "9bd7a7b4-c055-4cfd-8f7a-df91a1d83b98", "value": "T1A1B2D0E8364402DEE807D27C47B84394AE244BC3E1875E93DE51D49FDDA69E638823F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880543, "uuid": "680bbe74-b41a-4e35-a02a-5def30bf85c5", "value": "768:kj79TtbzAvgCyCQfsvQIq1p8ldcJgGlzDpbuR1J+:knBtbzoVDQfsvQrp8YVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633880543, "uuid": "6dde7d36-7786-4293-aa83-24c63ca5aa99", "value": 25672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633880543, "uuid": "f94d63e1-40dc-48d5-bbc9-257c48f22fb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880543, "uuid": "a1c2827c-a06e-435a-be20-f056d3a5fb8c", "value": "3f0eb5df330b3a0daadaf1e9ea346051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68801f3f-2993-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633847363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847363, "uuid": "90e81f28-d8ec-4edc-baae-5b2c7be97451", "comment": "Malware payload", "value": "3103f2dbe10a94fee8681f72cbe4cf04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847363, "uuid": "b37ce806-6c30-4343-8895-01b46d3d7d8d", "comment": "Malware payload", "value": "dd53279a6046b4e105690eb81768b225590aae794ce9896346a0c1e63fef4d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847363, "uuid": "235d4a39-8f9c-47f8-8f18-c1a88c568bb4", "comment": "Malware payload", "value": "e942b81a194a1587ac2d502189c83bb9a13e03c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847363, "uuid": "2455e249-3437-4cd3-962b-fba97c5656ad", "comment": "Malware payload", "value": "076cd450ead3694bab0fb6b51268e45825283c7f402543ebfef1e0f80f27cb150a7750d47d97759750dac1be95302c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847363, "uuid": "121ad194-e4da-42c6-b8ec-c4b804f2bc13", "value": "T19103F14FE8683CC8D75C0D79DA9C6469FD59B583C24E8298ABF508CAD94FD037A0E80C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847363, "uuid": "4edb1bb6-5ddd-43aa-93ca-bf29ecaba68c", "value": "768:Fdi2CrRvrGAH5rvSePYhWxmQ8q+ZiJhJEdt4nXilCi96YXzquuEruC0WRh3:Di2QxGAH57TuM1FiUe6GzqXErlJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847363, "uuid": "ce8fc72d-a9b0-4e24-a1d6-463dc0a88b97", "value": 38028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847363, "uuid": "a9636aa6-0a4e-461b-b28e-b13dba310410", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847363, "uuid": "e350eaa0-0d66-47c9-bd29-0a87da033e85", "value": "3103f2dbe10a94fee8681f72cbe4cf04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c6d4db-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633899971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899971, "uuid": "2c19720a-0918-411b-b432-a8023b6ccea6", "comment": "Malware payload (Mirai)", "value": "fe00dcf66a60a03c5daf7ee9ecc6f960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899971, "uuid": "4f2debb0-8dc9-427f-9c15-509982b85f30", "comment": "Malware payload (Mirai)", "value": "ddab6324113262dee3f8ee1343a3e728fa6ac48339de332089f47e7386e3dc44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899971, "uuid": "94f7f134-2d64-43f8-9fc4-b90fee5973dd", "comment": "Malware payload (Mirai)", "value": "168609f1ef765b084f0aaab32154f519fc436190", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899971, "uuid": "089f16ca-8e7c-4201-8cfa-1adf2c221469", "comment": "Malware payload (Mirai)", "value": "9e3411eabc33546f47f4e184f8c6b4362ddd904b5a68b6d020f30cf37b4bdd99780142a8e46564661068e99cc0eb984f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899971, "uuid": "58df4b77-aa0f-4829-a439-fd2dff0c64c9", "value": "T1B753C91A2E218FFCFB9C863487B78E219659339527E1C684E15CEA015F7034E345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899971, "uuid": "518c62aa-ec1c-457a-bc53-a7e2a804c2cb", "value": "1536:33XyAGENG4OGpuQUaBbkqG/ZZ62U1lCP+gw4:33CA6bQUaBknZZ62U1lCP+n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899971, "uuid": "941cc9b0-0e13-4e61-8b95-b30af370ba28", "value": 61120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899971, "uuid": "5f252e53-561f-40fa-b33b-1c8657f897e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899971, "uuid": "daab52fd-7dda-4454-990a-61d33db389d8", "value": "fe00dcf66a60a03c5daf7ee9ecc6f960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdf33c7-29d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633877540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877540, "uuid": "b9aa53f2-ae01-4c3c-b51a-7fa28207c09a", "comment": "Malware payload (Mirai)", "value": "1f5f25eddfe91c749d4c8952982d186f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877540, "uuid": "a512146f-c067-4cfe-9205-6ccdb46e3708", "comment": "Malware payload (Mirai)", "value": "ddc13173aeaadbea2c2a9b11e884d3261418fb70d40692c279c920e9f22d232d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877540, "uuid": "86e10b67-1da1-46d3-9e9f-d844afc9304e", "comment": "Malware payload (Mirai)", "value": "cdd5749855251d1f9a53c9440521b5684ef09cd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633877540, "uuid": "b906ed18-3105-4358-b456-917dac48670c", "comment": "Malware payload (Mirai)", "value": "692e418950655b68c7afbc35aadc2d6ec71e67f741a87579704724c1d6f8eb352843380d5460757a5ab63a6d9fe3069b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877540, "uuid": "4834c5ed-beb0-426a-9a08-f6d91a9dbc77", "value": "T144E2E1FFF0915886C87DEC7D38EF1A76C650718136AD4F69A3108C8CC576986B64C8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877540, "uuid": "b1eb6330-1f55-4e02-9691-f7a0d5ba8ef7", "value": "384:5UGR30Vmew+CqxlInkr6RqT8+uEO50KMHAcisD/cYSlHgqo0iXrK5gxHug4Ycctc:5UO0mfJqTGCueVvHAciS/7qA3Xr6c7WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633877540, "uuid": "06ec2e07-feab-435d-9411-494bf699ad34", "value": 32120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633877540, "uuid": "f1e6e89f-9991-4b0e-a5bb-10345a75c0af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633877540, "uuid": "3938ec2c-a984-435b-be95-ab21ca52df55", "value": "1f5f25eddfe91c749d4c8952982d186f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f547c1-2a16-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633903789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903789, "uuid": "54dd8a6a-500a-4172-9eb5-2c9eec751908", "comment": "Malware payload (Mirai)", "value": "5308b7551d680cbb66bf8b5c6f594a2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903789, "uuid": "58b8e524-d004-46ff-95d3-7d77fdb2f866", "comment": "Malware payload (Mirai)", "value": "dde767185095e5a6f17d0f0460d137324b6144f26587a35f606e065571f21fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903789, "uuid": "3d467392-c8a3-40ff-b14c-5d7dafcebe6a", "comment": "Malware payload (Mirai)", "value": "eed4bdcd29b140fd95fc7c57d68cb07479649869", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633903789, "uuid": "67a78a8f-4211-4a7f-834c-79ac7432451d", "comment": "Malware payload (Mirai)", "value": "675771ef099b458b8b8de56aca629f5af0950a9d4f94190e7182d4e3d3883c7cdfe50ffc176d2b562ddc78491123a7f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903789, "uuid": "8d303e16-6973-4f70-a6b3-c21d95127c30", "value": "T1E2D2D170A68A38B1C1B10134EAD857E6068B2DB490FFB273762014B57AF71CD3AA01D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903789, "uuid": "57bac70a-0d4b-49ec-b8a8-d71ed6957633", "value": "768:zA4uBc0T/nVvqV072G+IFYoXHZCx3GYAQs3UozB:zPuB7/nVMYn+Kf52AFzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633903789, "uuid": "f95bab51-7b8b-485a-80e6-95b305afd98d", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633903789, "uuid": "214e425d-7a1d-4753-ba06-ed4f3b04b199", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633903789, "uuid": "dc31332e-83d9-462b-aaf5-ac6ed26d03e9", "value": "5308b7551d680cbb66bf8b5c6f594a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c878a4-2a20-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633907914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907914, "uuid": "29e0ceba-ed9e-4303-923a-e134ed74f97d", "comment": "Malware payload (Mirai)", "value": "8ac0fc86ee93f1d7dd579664566205e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907914, "uuid": "3845f787-89cb-4843-9f58-fed88f6fad9f", "comment": "Malware payload (Mirai)", "value": "de3ce60c3232ec662b9fb7baca6153e1461b81d88dbb74f7854f8bc13a368566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907914, "uuid": "5eb0e214-8cb4-4128-afe0-c05c7f43c8a3", "comment": "Malware payload (Mirai)", "value": "3dae20572255009311b728076872c7adb290d3ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633907914, "uuid": "23d4344d-30eb-44b9-b6aa-7b880a5fa5e1", "comment": "Malware payload (Mirai)", "value": "32b89d98990f0798fe60bcf2b8fb4da3071d31d243445f4ab239a444df2e682bfde6b9d371fe8de0274073da1bfb8571", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907914, "uuid": "d44d0c81-16b0-4526-8280-bda23f2bfe73", "value": "T172630852B8818E15C5D813BBFA2E018D33126778E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907914, "uuid": "91505ce0-7745-4ec0-9c60-6df094b1ee05", "value": "1536:StnwsWjjS5+8hEWZc+mQM4fJL4Okw/RqO1do3YpPz9I5iY5UJ/k:MWjA+QEWZbbZx4OjcO3o3H5UJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633907914, "uuid": "2849f520-017a-42f7-a7b1-a2eb2266183f", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633907914, "uuid": "9fe3ee32-5745-425e-bebd-4cc7d49bd247", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633907914, "uuid": "eb901c5b-e0dd-40ad-9844-3594a0a1e073", "value": "8ac0fc86ee93f1d7dd579664566205e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c70fda7-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866723, "uuid": "c34fbf34-9c5c-4f7f-83b3-d401354e5c9f", "comment": "Malware payload (RedLineStealer)", "value": "8c359832b392745d2f087d77a73490f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866723, "uuid": "b575b371-5a52-4f1f-b02f-5c507edf2ea6", "comment": "Malware payload (RedLineStealer)", "value": "debf4134681271c0ec5e8b38dc741223fb47b0f541b00f2e607552ee01a1a882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866723, "uuid": "9f8bda75-a276-404b-96b1-dd84b579707d", "comment": "Malware payload (RedLineStealer)", "value": "069f70f5415f19fa0428b291665ca8436e1c11b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866723, "uuid": "a5d03af1-a7cc-4192-892a-6a5dac29668d", "comment": "Malware payload (RedLineStealer)", "value": "39ed82df43c7af8816e06422e9d8f464959e0f31bccdd4d20882f102caeb9443190703b4bcede645600d1013f3a98c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866723, "uuid": "b5117853-309d-4831-8876-676ae22dffc5", "value": "T1B594BF10A7A0C035F6F316F849BA9378A93E79A16B6490CF53D41AEE5B346E5EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866723, "uuid": "3fa2fd71-f62b-42f0-ae94-1e791d92f6ca", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866723, "uuid": "8e106f15-6da3-47fa-ac49-96ea6a4f70bd", "value": "6144:bseFvqeJR27eKNUJwxwEGREtCjOshrb4AmIaIuijvgLZbH:GeaeKqwKEAWCjOsdbFaIuij4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866723, "uuid": "cc419fa2-9d4d-4dde-8eb7-10d4b009f210", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866723, "uuid": "9b2ef5bf-7436-43a2-a046-7c6f3c67b584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866723, "uuid": "7dfb7c47-4ec4-46d7-a7fd-9376ab8be097", "value": "8c359832b392745d2f087d77a73490f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571d8eda-29d7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633876539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876539, "uuid": "f9a54835-21a5-46dc-99ee-3db5a7d0205a", "comment": "Malware payload (Mirai)", "value": "329596831188964fe73e41992687762e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876539, "uuid": "5824801a-ce24-4c91-b74f-bc1b6e7dab55", "comment": "Malware payload (Mirai)", "value": "dfa5e61003ce3c566077856d50875db5084a1ed7380d011e2a4e59bbb587bba2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876539, "uuid": "cc1a185b-1862-4e98-be98-ea94ba71adca", "comment": "Malware payload (Mirai)", "value": "f15d485ca7cb2d79f22feb6f38d9c741b8e795f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633876539, "uuid": "acb0128b-3296-4bd8-8b74-f1d6a0c67ce4", "comment": "Malware payload (Mirai)", "value": "d6f62f3358af8538b18cdcfb84b64d1cd7ee40efc9bf74301af0e32a7abff3dfa95007cef26bf2f604db49eba60623a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876539, "uuid": "128d4faf-6472-4c79-a53f-9565311e518c", "value": "T13433F116C7DF5811CA701C77D6FE5145952F9B7CC492F38242E8E8A4AEAB4DB72B8103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876539, "uuid": "0071cd27-976d-4317-89ba-b65d0cfe7df2", "value": "1536:8APtoKBLM7wUJSZsdnu2LBr1/t4iBkvuOPis:8APtcI2LXV4iBkpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633876539, "uuid": "2f884bc4-be9a-4f35-bb6c-a3c9ef6009d4", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633876539, "uuid": "7a076f4f-532a-4115-b36b-5d3cd815a324", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633876539, "uuid": "58481cba-7169-4067-a763-4207c579fbc9", "value": "329596831188964fe73e41992687762e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ac515f-2991-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846573, "uuid": "54b75b3e-26c7-40cb-aeb2-b7fb8a541562", "comment": "Malware payload (Gafgyt)", "value": "1ffc268b1b537f7316b256d8596ba35d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846573, "uuid": "ed600585-916b-4940-8fb9-d30626da0d93", "comment": "Malware payload (Gafgyt)", "value": "e050ce2554f657e9781a9da94a8da9f083bd84767a2c495279bafcb5807e61a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846573, "uuid": "b63d2299-3369-4afb-b8c3-bedacf12c966", "comment": "Malware payload (Gafgyt)", "value": "c9f3772db48b2728972956b91553987e5ca73b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846573, "uuid": "5e5c2688-9ea2-4cdc-9df0-712ac0f0b03d", "comment": "Malware payload (Gafgyt)", "value": "178c2b4298317cea17b3eee91d80137f2bb651c80ccd15f96a2ae6958832b478c7301ec9bc0f4518d7e606fd2456ff55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846573, "uuid": "1e8928b3-f66f-482c-995e-084a9cef4b48", "value": "T1C0C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846573, "uuid": "c0fd972b-4df3-4e47-b2e3-df3c78957056", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epv+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EB+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846573, "uuid": "dcd75461-5463-4b02-b68d-da901a195ed6", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846573, "uuid": "9d3b078a-5dfd-4088-a1bd-ef5279b93eeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846573, "uuid": "42b34b34-fc8a-4912-a90a-0b9ed3b71e99", "value": "1ffc268b1b537f7316b256d8596ba35d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2aa2cd-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633862460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862460, "uuid": "4c4ed646-b2fb-474d-8c02-b869c53ec9e6", "comment": "Malware payload (AgentTesla)", "value": "3707242f769e33f3e7f8c2b1e1652264", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862460, "uuid": "2ca0e95a-3716-4ff9-9fda-1da160925301", "comment": "Malware payload (AgentTesla)", "value": "e171ce5be2a6e71879cbb28bc17a8e126a24c337cf12df618d9758be4c639a20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862460, "uuid": "0c74cd0e-2d06-4a52-8858-e215810320c3", "comment": "Malware payload (AgentTesla)", "value": "54343df95d5535f5f5b43639d160d1d9c01847b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862460, "uuid": "8911c4de-7283-4c5f-b7d3-7acde1a27350", "comment": "Malware payload (AgentTesla)", "value": "e5c06624e0bf20cbcd1bd12ab18a7830b55478ed065fffd345c2b9dab3af2f222704e6c8a47d953048c1228ed4be37ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862460, "uuid": "8e2752f2-6ffb-4ebf-8502-7db6f046b6d5", "value": "T1EE757F5363AC8EC4C06792B4DFC0C4B96D19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862460, "uuid": "e40b2cdc-270f-429a-92eb-1cb72bf874c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862460, "uuid": "afab08b6-5763-4c30-87b0-61bb38fd98da", "value": "24576:BTRUglhhRkHF2roxCcmocwHx9iIOHixnVMtwYNSZGL:vUgZCkroJ3cMuRCxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862460, "uuid": "328966f3-f956-4e2b-b310-2d0fd7924c0c", "value": 1684992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862460, "uuid": "b7b3080f-4961-41b1-8620-56705d20876e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862460, "uuid": "04c37911-35fa-4157-ad40-e4353986f5bf", "value": "FedEx Tracking _pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d01161-2a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633902921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902921, "uuid": "944c17d1-d353-4926-aeb4-f14ae53d7676", "comment": "Malware payload (Mirai)", "value": "cb5a9564e35df8880008346122c040bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902921, "uuid": "61816feb-5485-485d-84b4-cee8ec202778", "comment": "Malware payload (Mirai)", "value": "e355a29d119a9bcddd9bea75fb21d1fe336c898e6d4fa32b4abb75dc63d5c20f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902921, "uuid": "b5cc2e3e-d515-4644-814a-63dac8de7fa4", "comment": "Malware payload (Mirai)", "value": "c02fdb684c57daad97ca838fec12207b098a73b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633902921, "uuid": "fd130182-d234-47a8-add9-ce02ea123849", "comment": "Malware payload (Mirai)", "value": "a2f0bc46497eff5f1d867c6d13cbbc02f57f8f4ba9166ea36cf854c1a6a717b44f06d27f2104183793db9862be5d4c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902921, "uuid": "1f49f994-7940-4f33-9767-6bbbf73cf2f0", "value": "T1F5E2E1AFA5E42EBADFCD483E128C1579BFC7689B13295B85232144C4B61D4A8F4DC03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902921, "uuid": "25d2f6d0-906c-419b-bf2c-5d961824c14b", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfZAa39RWGVCz0Nv2M:nfpWcehzJFYKgULAssKfZAa3LWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633902921, "uuid": "ebd0f303-9a91-4b01-8e4c-5377e9089a5e", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633902921, "uuid": "075bd8ac-f615-45ed-9f49-ae25652d2629", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633902921, "uuid": "e7ea205f-c59f-4686-b34b-06e0e2c9c65e", "value": "cb5a9564e35df8880008346122c040bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d1df53-29c0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633866733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866733, "uuid": "4d526ba0-1465-44c2-9f05-cf200c3cb93e", "comment": "Malware payload", "value": "115278e2559bea954db6accda9c87a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866733, "uuid": "30d24935-be9b-48c0-a275-d0c330f465d8", "comment": "Malware payload", "value": "e3c34bcbadcfaef7e77795f35050d8153e1b58be062d5d19e3401fe9516d474c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866733, "uuid": "3c48fc11-74fa-48ba-b159-e2b96ab83072", "comment": "Malware payload", "value": "0d11d149ff9c93fbeb446120fb0dfae3dbfccecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866733, "uuid": "552efb21-ae5d-45eb-a3f0-eb90e19a5bee", "comment": "Malware payload", "value": "1e9b1ae3416124d9a148e0d24797774417c512a23ce9c104249d04bae5829456809d461e3b34c2cf657c532c61b64299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866733, "uuid": "fa672a6a-4e6f-41d4-a9e1-fafb6d0c8874", "value": "T12D53C5639EFF1A80D0D25F710C778B642F377C3468268A6B50102A9DCD62B85ADD673E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866733, "uuid": "52116662-84d0-42e3-b517-a6dab096fd10", "value": "1536:Cq5ntWg3x4GGjvBgLvZ0NGfQpi7MFdWvg5+qdpM5J:CwAM4NjvB4vMdq5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866733, "uuid": "346f571c-3594-4618-acf7-3b0ff5c8c7a6", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866733, "uuid": "6f47e81f-4eb1-4787-9319-e591f0faa7e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866733, "uuid": "914fcef3-dd5b-4920-92fd-33704c09dcac", "value": "115278e2559bea954db6accda9c87a3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d68548-2993-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633847357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847357, "uuid": "47cb74b2-1f71-4046-a10a-396dd6d51327", "comment": "Malware payload (Gafgyt)", "value": "8aedf2cd364f3507e91bd06a08c9eb7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847357, "uuid": "60fef0c5-ec20-4a50-aa49-4e3a36d71122", "comment": "Malware payload (Gafgyt)", "value": "e416e7034d0953ccc58845fe11d7e248de2a79afeac4999e887aa29e1a7815c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847357, "uuid": "ba6bafdb-6121-4973-87b1-fa7ec847160c", "comment": "Malware payload (Gafgyt)", "value": "ba4b436f571482fc18bc1171574df39638dda744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847357, "uuid": "6c30f67c-e8e7-474a-a0c3-aab0788c1e55", "comment": "Malware payload (Gafgyt)", "value": "a186b8a3d6d7fd0913538f009001d12c5a4e9cbc61574f7fcc8c27a723f3dc6176c4f8bb0efe48e501333a4e5484fed7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847357, "uuid": "bf9fc11a-5b96-4cf0-8c35-b5ce313101b9", "value": "T14CC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847357, "uuid": "05c2810f-f35a-470c-93a5-594ef10945e6", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBemEdWfRZrmW+IFj:Ted0W0MZQHgd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847357, "uuid": "c5ce6ac2-f7c7-4ae5-ac34-5b86d8a429df", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847357, "uuid": "4ca89bb1-11a4-4443-ba22-374e630a787b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847357, "uuid": "65fb4eac-a223-46be-9941-cf82a09bc569", "value": "8aedf2cd364f3507e91bd06a08c9eb7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d0984c-29a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633856369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856369, "uuid": "ba39146f-6f4c-4a88-b8c2-e178447b09fa", "comment": "Malware payload (Gafgyt)", "value": "45b941691db46050008e113b49e41e80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856369, "uuid": "bf58e689-3d89-4c73-b478-79124bca069d", "comment": "Malware payload (Gafgyt)", "value": "e42823a24f89b0fe6ffef2a94e6ec865c30e18b1e93d85e70d8a9b1e4cb83168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856369, "uuid": "81a57007-f9f4-424c-ae4d-a5f0897db0ba", "comment": "Malware payload (Gafgyt)", "value": "89c90732160c7a4bd72368b18766fefba6150683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633856369, "uuid": "45186511-2041-4252-9bd3-643fc09abb5a", "comment": "Malware payload (Gafgyt)", "value": "1dfa2af0045c8ff8fdfc9f3573bcfa83b3e9f5a119dd67874d1d9ad6ca4b6ca06fcaf103fa05e3bbe9e23d1620dcf8f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856369, "uuid": "8102e359-1a6c-4606-b826-b6b36ea7f106", "value": "T1A2B32A0798615F77C045ADB129A75530072BBA120F8F1F9AB57DAAB4074F8CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856369, "uuid": "037aa337-dc74-4cdd-9e72-1bf1f71931b5", "value": "3072:bMTwsiL+Y94kYgSsR5hLW0rXiILkY0Px9gQNfR:bMMLK8PSsR5hLW0XzLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633856369, "uuid": "3a3f7639-39e6-4bcd-90b2-db4e59a52203", "value": 108423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633856369, "uuid": "07e870e2-90a3-442f-ba4f-398ff5fec8f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633856369, "uuid": "cdf96b6c-ea4f-473f-834f-c700fcd6d7a2", "value": "45b941691db46050008e113b49e41e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc831a1-2991-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846566, "uuid": "e7f6aabd-94ba-49a1-8a6b-c1dff661b772", "comment": "Malware payload (Gafgyt)", "value": "55fd5550bf0595f1bf485588f5e38a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846566, "uuid": "a84c6ac2-d057-4ed9-a8f2-06ccbff5366f", "comment": "Malware payload (Gafgyt)", "value": "e465cac29c750d17af16ad9b6660bd0d7109cef43ea0e0173961bcf5ce536603", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846566, "uuid": "4f603578-622b-4cb5-82f6-7f6d84081add", "comment": "Malware payload (Gafgyt)", "value": "914ebb5be236539581a89ee4bcaa27f0f0369d4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846566, "uuid": "efebf31e-e65b-4be0-9096-66912264b407", "comment": "Malware payload (Gafgyt)", "value": "055104cc3324feb3f3e4e05db42a7e6264f1f62569d6c569767d282849ae4168029b47700e5094a9638de2123f139c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846566, "uuid": "175a224b-7d56-44a0-ae8e-c4e662187ef0", "value": "T152A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846566, "uuid": "a80f21f7-741c-4aee-8ee4-21a507aa7422", "value": "3072:Vgdr2vIBAxMyAOLRcftMhOemuxVqDr78fz1e:Vgdr2vIRyAYcChOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846566, "uuid": "5805dc68-eff0-4b9b-93ec-a7b3800d3435", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846566, "uuid": "1f017d4e-a278-475c-8c2b-e49da0e4327e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846566, "uuid": "667d7829-9748-43e8-907b-bd1c15a2bb25", "value": "55fd5550bf0595f1bf485588f5e38a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e20152-2991-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633846578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846578, "uuid": "ba31c9eb-c774-4f58-ae96-cab0fb79b628", "comment": "Malware payload (Gafgyt)", "value": "0ee9aaba49dd01a22b8e4b3efd082119", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846578, "uuid": "af0899a2-2821-43b5-ba82-8c6bbeb9cdeb", "comment": "Malware payload (Gafgyt)", "value": "e4b52be6164012b419eeac20109d3d9df604b2dcb44756f2e37e3c59a492be07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846578, "uuid": "2b65c21f-d2a5-4f67-a5ad-7b92028ccaca", "comment": "Malware payload (Gafgyt)", "value": "97d2b83ea36d204a7973689cb9e72d290177aaf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633846578, "uuid": "bdcb85d0-ba9e-4d38-94fd-9c45eb412351", "comment": "Malware payload (Gafgyt)", "value": "eec3b963e6d4a6fd62706606e49ad3c05d6787c294aa4b054222e4ea87a4b82855fba27730bbe8f25600cd3b0964ba4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846578, "uuid": "add797aa-f247-4ba2-8193-ac3249aa77a6", "value": "T13C833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846578, "uuid": "46410b71-96d9-480b-9795-2beec9970e3c", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCBdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J6BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633846578, "uuid": "beb90121-9804-4f95-9e88-6f4f68ad2460", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633846578, "uuid": "c958d16e-cdf0-4845-82e1-bca20c35ec90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633846578, "uuid": "fdf1a89f-3230-460f-980b-aca0043741a6", "value": "0ee9aaba49dd01a22b8e4b3efd082119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfac740-29bf-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633866481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866481, "uuid": "5e6e3762-1d5c-44be-a77e-72c9bc3b5311", "comment": "Malware payload (RedLineStealer)", "value": "f09b24621497e9bfc28581f9c145f5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866481, "uuid": "9093032c-082f-4192-9e2e-6db8656c9e1d", "comment": "Malware payload (RedLineStealer)", "value": "e6bb834ea37837d095580e6dd86152e5d200a5810018f26a3ecb4b58de6a7b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866481, "uuid": "d633f3a5-cd45-48de-b48d-3df9d609a0f9", "comment": "Malware payload (RedLineStealer)", "value": "240e3d091b61ed3772c89530897157d90ad897be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633866481, "uuid": "8223d74e-7afb-467d-8c0a-cd15cefaffb3", "comment": "Malware payload (RedLineStealer)", "value": "9c51f8554db8d4077519fcd3e0b68e8e51403a8221ef6eac3e0b0ae07ec74586213649fc1b9a815e66a2781146973675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866481, "uuid": "0e2b3092-e1bd-4e96-ba6e-4b87a62851df", "value": "T18D94BF10A7A0C035F1F756F849BA92B9B53E79A1AB6490CF13C41AEE5B346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866481, "uuid": "f9e6e63d-a1eb-4796-9609-0779141e375d", "value": "44bdf7acf59eb6dc6851df2a6e018dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866481, "uuid": "58aa3500-2c7d-408e-a5b9-b50104cf8127", "value": "6144:ha0Ry8KoWxtlvGyTfO5f4LdnWatBIEjaDAhcbLSKp2TWVjvxa9Su:k9tbfO5f4JBTPjaDAWbT2TWVzxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633866481, "uuid": "b17a5ff8-fadf-4d52-ab7c-0d9df8cbf74f", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633866481, "uuid": "6a130fff-d70c-4c4d-9682-b38c548305d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633866481, "uuid": "e6deb42d-3f1d-419e-b6cf-abfad86e0529", "value": "f09b24621497e9bfc28581f9c145f5f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28b8c4f-29c3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633868210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633868210, "uuid": "fb6131d8-3cff-4591-ab06-d1f521cd2e0c", "comment": "Malware payload (NanoCore)", "value": "4bae18ac4a73ff38f7ed718365e6c2b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633868210, "uuid": "452453e7-5cb5-4f89-881c-a5e0f334c4d2", "comment": "Malware payload (NanoCore)", "value": "e73b03a58aaa3e066512e451603c4ffc2404ad373d83f70b12ddb1c5bbef620a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633868210, "uuid": "8c97661f-8722-4230-9470-06fa90646312", "comment": "Malware payload (NanoCore)", "value": "65eccf15907bb466369dd90f09f6a433e2cea96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633868210, "uuid": "9d79f271-d331-4e7b-ab90-d0d906ff8586", "comment": "Malware payload (NanoCore)", "value": "f8a13d680c3b0992fc72ec53690340cb31d358a18e2d0744973fe4d1901ba7fa163342d1ba933a9a9d5e6378c1243395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633868210, "uuid": "3f5a3906-dc57-452a-84f0-1f9a076bdb24", "value": "T1B5E4CF202AFA116AFD32AF740EE4B596BF6EF6723612503DD05303970613E81DDE2979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633868210, "uuid": "3b5c97bf-9c21-4936-88c6-9a6b2c8d1a63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633868210, "uuid": "a5f0990a-2a12-422d-8833-99e95088e6ca", "value": "12288:2mqhvnjpWkmaq9Ja2rS2IT0XLNsgcY+ZOftprM9+TATqAMYp7TybXDExFc0:2mitmPR8TwLN7c5kD/M+KUXDEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633868210, "uuid": "91269c0b-21c0-43f9-b645-579839a253f6", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633868210, "uuid": "9065538a-21ea-4d0c-ab39-84686647b287", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633868210, "uuid": "d970aa99-5e42-4df6-ace1-8d6e526805e7", "value": "CUSTOMER ADVISORY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b5b3ab-2a21-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633908461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908461, "uuid": "5fb6b6c1-a5ba-439c-9c02-ce5a048d6418", "comment": "Malware payload (Mirai)", "value": "611bc0f5c2871ff331ecaff13e0b7c05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908461, "uuid": "46ae36a1-4742-4221-a222-b463fece783a", "comment": "Malware payload (Mirai)", "value": "e81653e13b2b4fbf64643e9e10f6ef61d4b93ff678211b7613e0ed1d86e8f32a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908461, "uuid": "aed5ab32-3760-4572-a759-a2ece0af206a", "comment": "Malware payload (Mirai)", "value": "4e954382dcd654ed41046d3dc030155ea7a043ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633908461, "uuid": "a0cc6839-c151-49f4-8983-2c61a9bad098", "comment": "Malware payload (Mirai)", "value": "111b79411ff2c9dc6d808227f290d65b978e5b15c2bf77e03b54ef12807514b0b6a5a148abe0d2cb1eaae3d185d632c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908461, "uuid": "ddf9af3d-7b19-4d72-8d00-cc8c3e07019c", "value": "T139432BD6B802AD7CF94FE6BE8423090DF661335051930B2B67A7FDD36D321A86E52D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908461, "uuid": "0d2628bd-cae6-49ff-bbce-0680e3394cec", "value": "768:uMHejQFpI44XZAJ0xwv6qOl35a7SP0ypuo8Wh2QCfBqntyzruCB:uc4QFpUZAJIwv6qwHsyIo8Wh6fBqozrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633908461, "uuid": "b1b690d2-4589-470e-98b9-868c83735989", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633908461, "uuid": "8a3c005c-ed7d-4951-81bd-f443061d7ad4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633908461, "uuid": "882aaa22-b5ac-4d8e-9982-5c04f36294f3", "value": "611bc0f5c2871ff331ecaff13e0b7c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22a4e25-29d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633873686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873686, "uuid": "a69e1a0f-c7ae-4d7e-b736-c4b92013c24c", "comment": "Malware payload (Mirai)", "value": "cf3259b173fd0804dbececc26b60beff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873686, "uuid": "d62c5a66-29d7-4695-a004-9e10184c7b3b", "comment": "Malware payload (Mirai)", "value": "e9879cd52ec9bf990b8a5b2627b1034b24af2c9365792957198841ee1e1f340a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873686, "uuid": "d95c8709-1642-4611-af35-a72ef06de8c7", "comment": "Malware payload (Mirai)", "value": "147525cc169459535842e188d3d0fe85ec40be4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633873686, "uuid": "d0e8d7eb-7b22-4686-99c5-e5cfa49159e3", "comment": "Malware payload (Mirai)", "value": "d27f033fbd7930ddd08a9245f074651199b0a719448171dda7a0d52db2e5305656dd630605a5d5536d06cc407a32654f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873686, "uuid": "92fa3c53-0198-4eab-a9ef-72123a6bf8ae", "value": "T1D523F24320D3BA03E0345CFA45628CCDB64AA6BDB1BFB7AB25440E154C75D92ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873686, "uuid": "bf6ced9e-5ffd-4906-9cff-bf52d7a4f1bf", "value": "768:lK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFtzz9q3UELWt/iw+kvBGg6+fYtrBHE:N12O1LCNguovDPH7TcruLWhiw+kvBGgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633873686, "uuid": "0deb9965-bccc-486c-8543-7e24c4659e6b", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633873686, "uuid": "76dac43a-505e-4e8e-8233-c0f703fd15ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633873686, "uuid": "7e4253fe-e5e7-4432-a4b0-20b6966aa8b5", "value": "cf3259b173fd0804dbececc26b60beff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63714675-29e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633884291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884291, "uuid": "86d2a153-c670-4b1c-9eac-8899a4f1926e", "comment": "Malware payload", "value": "0295b7f89fae9e461949d02301136143", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884291, "uuid": "f5ba00a0-2651-4cb1-8d12-33622be03cba", "comment": "Malware payload", "value": "ea1c32b8b41a64ffe9d03c21324bb3377b7eee8c6d32a413af4b9bb8904efe3e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884291, "uuid": "5ffbf049-2c5d-41fa-9038-f9946350b47f", "comment": "Malware payload", "value": "a0526eb97b5a78ba4ef72aaceb085227f74a1f8d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633884291, "uuid": "ae55fa1a-5efd-412a-a489-55869334e2be", "comment": "Malware payload", "value": "ef491ed979c83eae93066dd0a70ec21b67089c8c60b86010c6e4011347e1d97dec4f9254b7870bb77a471dce55b58610", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884291, "uuid": "f5f1519d-08b2-4d33-8b29-946259879875", "value": "T13213D0361B3BA8F8CB733F3070BF5A40F9256E9EA05527660E8D71EA1DA7920D934513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884291, "uuid": "9dafbd6c-e622-4a3b-b7f2-e293957ad809", "value": "768:vTXHm1e/Uj581NgPQEexiFbH1QySXsGpMyyibcg8A81I2sv9sPtPnta1R02BLH:vTXTDgPQEs+BQLXPWi4g836FudnAt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633884291, "uuid": "2ad54648-2ea7-476e-b159-c1fefc9a0298", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633884291, "uuid": "681f1b7a-03aa-4d55-956d-2c4b67f7dd97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633884291, "uuid": "27ff73d6-d4a8-460d-9411-2b644e77a447", "value": "0295b7f89fae9e461949d02301136143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07971296-2967-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1633828302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828302, "uuid": "cf546358-907c-4358-ae50-bc6d59b52e8b", "comment": "Malware payload (Hydra)", "value": "bbdfddc05f32e4d7421e7b29dc2c2d48", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828302, "uuid": "60913127-b674-4b7b-851e-dd5e128c2615", "comment": "Malware payload (Hydra)", "value": "ea391f65ae367799ab1bc162a4b8dcedb76f1da1e5595548497d943298f18682", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828302, "uuid": "8b9b76eb-70c9-4740-890e-1b7e397d0914", "comment": "Malware payload (Hydra)", "value": "c10f45072242b16735dce7bc08b15bce72b6522a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633828302, "uuid": "7f706c3e-ea56-45f0-8abc-c621db04c481", "comment": "Malware payload (Hydra)", "value": "4f34bfee3e8744a76c5ca3a4ab1fe222f66a65e59026109d86034c641f5e03cfcf34366e824f987f26425c345d285f07", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828302, "uuid": "69c640d0-0ce1-46e2-9e96-4bb0536fda81", "value": "T1B58633CBD2C5D181FB159D73C5AA212433045B2A5A83882FD7845E28CFB5FCF2B5A94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828302, "uuid": "2aa995ed-00af-4e7e-9e84-f977ceee96a4", "value": "196608:gzZeTXTF6lHf3kn1pyNUxMDWx0RiQdyjynFAL9D:g9CJp2UxYWabyj40D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633828302, "uuid": "a43873a5-a7cb-41c5-abd7-cd5dd61a2e3a", "value": 7834917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633828302, "uuid": "7ff2fddf-1a76-45b7-9e8d-266015d7506d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633828302, "uuid": "4731523f-4660-4202-b373-29edfa4847ed", "value": "02513_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0350dd-299c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851078, "uuid": "a7895e45-6dc5-4666-8afc-5f0693f53749", "comment": "Malware payload (Mirai)", "value": "3b8d8c1b2b231a659268b6afb0175250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851078, "uuid": "b9a3ecef-02de-4642-bfa0-216fa9374c97", "comment": "Malware payload (Mirai)", "value": "eab11ee4b8d1f1bb87d4db40a4ffc0aa8a52ec3a84110d5cd07cf9b10a1b7a9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851078, "uuid": "fdaaca3d-19a9-48f4-bdee-92384e94bd3e", "comment": "Malware payload (Mirai)", "value": "5d6a00b1a4c7be3dba26aabf09f8d7b5f7d0d1d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851078, "uuid": "0340a932-8fed-4f85-9bab-a1fcf69da673", "comment": "Malware payload (Mirai)", "value": "461105f15de550f9e490420f6dad118dcde315725a1a04a1eaecc7b87e5b850f27dd79bc4352224a401097f735d1a662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851078, "uuid": "e1cf3492-c8e6-455d-9812-9ab6a4cfaf8b", "value": "T1F9A2DF1821CDE972D1B0803BE13CC307EEDB87B652FE31791E180798E49591AD3BA945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851078, "uuid": "5899c4fd-7723-4f82-bf49-4a39c8e2d3a6", "value": "384:Yamog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbFMhymdGUop5hX4:YToh/DxCvhdR4IjWVFbSqs3UozJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851078, "uuid": "16167da1-ecf3-4fa2-b757-b3af387a77a0", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851078, "uuid": "1b747582-e58d-4da4-a432-1ee6b1dcb642", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851078, "uuid": "afcd6277-d471-47cb-a52d-1ddc4f6c1773", "value": "3b8d8c1b2b231a659268b6afb0175250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1c5bc0-2a0c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899178, "uuid": "67195ec6-e980-4557-adfb-2d61a65073b7", "comment": "Malware payload", "value": "036dfed685dc8f6698cbf114cb09bc25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899178, "uuid": "b2c71e0e-3796-406c-91f2-bc6eb697fadc", "comment": "Malware payload", "value": "eb76af40275100383ef1cce4465aa555e5484280ceb2234e361378eb410da530", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899178, "uuid": "0552d7d2-a378-4dd0-8043-f48d465d625d", "comment": "Malware payload", "value": "371d900caef4a7bd120a012bdad6c3da054cca98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899178, "uuid": "aa4c4c78-43de-4e06-ba14-b2d4db1859e8", "comment": "Malware payload", "value": "fcff19f29dac922c082a4f522228897ec07362c18fc74b0aa0f626b51695fedaf5d0c979a5c3347ee67d7d46c2a57d86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899178, "uuid": "72941303-d078-46e7-a1e3-dde92858c7e4", "value": "T15BA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899178, "uuid": "c5359349-8484-4b7f-8dd6-00d4f10fc0ab", "value": "3072:VSx+i6mqaObhNInPNKV+qKmZuqQ4DPwXXtse:y6mRObnInP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899178, "uuid": "a20d1dc9-a296-4612-8c11-cf5866a4b5d9", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899178, "uuid": "fe162864-8c7f-44dc-bcf9-1704a0fa9837", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899178, "uuid": "7a3f8c65-fc67-48ff-a82d-3205c1d72958", "value": "036dfed685dc8f6698cbf114cb09bc25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004ee2f5-2a0e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633900016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900016, "uuid": "b4dad3ce-ab6e-4ea0-b278-9933ae53b3df", "comment": "Malware payload (Mirai)", "value": "e684ee959ffcbb285e4ef07528fbbe8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900016, "uuid": "0dc4764f-afaf-4a65-8985-deea301b87ef", "comment": "Malware payload (Mirai)", "value": "ed32bf7af52735f483c6064be7742d6446afddf82c8361b163df1c9e3d36eae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900016, "uuid": "97c443fa-108f-455f-831d-c08174d5c315", "comment": "Malware payload (Mirai)", "value": "1941f2977ef96f8dca5865e5b8bba329bc9b5591", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900016, "uuid": "7018f772-ede3-4e31-8350-8ad37f2efa0f", "comment": "Malware payload (Mirai)", "value": "a6cc826774a4a9848caf0730882186d98fec8b14217809d5935c0f7d68363516a6da80d6431e6eeabb15f654b46c308b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900016, "uuid": "c2dc6fe5-b7da-4dfc-b5f8-5a13e8218f0c", "value": "T1E2138C62C86E9DE8C31D4634F4248E705733E109E2A32EF6590686A69017FFCF6493F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900016, "uuid": "fc766bac-a9be-451e-baff-17c1c6e5e30a", "value": "768:AasFeOe9e3qaqYwBudMllg6cRrA/v3SCqPoIhvs0ZKCC5I:AasFLMpaQlg6cRQ3SpgIC0ZKCC5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633900016, "uuid": "be3988e0-44ae-4bc4-abb1-583e5f298578", "value": 42656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633900016, "uuid": "2d305e28-d4d0-4063-b0f6-952aadc38fca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900016, "uuid": "86ea6593-735a-430b-ac79-780157c6a03f", "value": "e684ee959ffcbb285e4ef07528fbbe8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479562ef-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1633867064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867064, "uuid": "ba617ef7-8a76-4404-bcc9-7efaa53ca188", "comment": "Malware payload (ServHelper)", "value": "cb3cc551561883ab8fc4fb6fc837a469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867064, "uuid": "6d86cc47-8709-4deb-85fa-eea022abb59b", "comment": "Malware payload (ServHelper)", "value": "ee5d82cd5e61b518572b4415797ee407cff1d28a2e0b43a2baec7236c37695eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867064, "uuid": "118112ce-352d-4831-91ef-842e8cd0fd57", "comment": "Malware payload (ServHelper)", "value": "f74ae6d243342099d3fa500cbc630f4a244a8d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867064, "uuid": "b17b18c6-b6c7-42db-be24-69ae403e9099", "comment": "Malware payload (ServHelper)", "value": "727b862bb9aa0547364ab01cb459684e198e299d161889ecfb3d16f2ce642fc119847c9b8396815c8f9e39240570bad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867064, "uuid": "ae6bb3d7-7736-4dc9-a7aa-cfe349a97313", "value": "T13E1633201FF86EFDCA6CD234707BED0D29A14E84C864E6DF91E1F5830646BC4566BA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867064, "uuid": "3e2418d5-edc7-4449-9238-c5b7416c2ec2", "value": "0bbcd6443f036d63710b3c873df1ad89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867064, "uuid": "954e0589-42cb-4315-8a11-aa724c8d8470", "value": "49152:MgG+0nnFa5xF1Azk6GehC1Vm6ctA6Ty0pQJb4Qate1YdM1TGHgzBut:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867064, "uuid": "dbb4450c-11be-4442-b434-aea1d1079efe", "value": 4224512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867064, "uuid": "c0b328c2-c6bf-4c8c-868c-dac28e68962d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867064, "uuid": "008d27fc-bd52-478c-9404-cc4dc6a0d1c6", "value": "cb3cc551561883ab8fc4fb6fc837a469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0797bbf3-299e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633851925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851925, "uuid": "033040bf-f56b-455a-a027-2a2784f57faf", "comment": "Malware payload (Mirai)", "value": "890b10b7bf03316c891faf2034a4dbd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851925, "uuid": "da02a465-6ee1-4e85-aad6-620734fbf114", "comment": "Malware payload (Mirai)", "value": "eec337b8506401a378133474b94e8ef1d62a62ed28e1e08e0cc5326520052e28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851925, "uuid": "b5046512-1156-4fc6-8419-279f5108637d", "comment": "Malware payload (Mirai)", "value": "a7ab6603a88a7aaac1aa8d09daaed6025e348a71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633851925, "uuid": "3d95d23d-0fba-4187-9125-d959f10c35d2", "comment": "Malware payload (Mirai)", "value": "27e04acdc653b8125441670687e67c73095225043ea8bb8169925576d6b5a70113384b241e6d29a0be296407faa28978", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851925, "uuid": "38eb58f1-edb6-415e-b554-210b2f9bd668", "value": "T176B2D01AC0AE2EB4FEEB7D755D41E2C17B615BDF3A618DC016C16B110722D681F886D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851925, "uuid": "a3833f1e-510a-4ba0-b222-c82fa6f09ed0", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIotWwaM4uVcqgw05c:2AApCdvwJr69VJoA8FZtxCo8Bm4uVcqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633851925, "uuid": "94e97a40-467b-4c9d-bdfa-3d65001a63cc", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633851925, "uuid": "c983209c-5493-4e31-86d3-ab733886eead", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633851925, "uuid": "cfa66292-3f07-4dc1-ac94-d32788f90cb8", "value": "890b10b7bf03316c891faf2034a4dbd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bf0352-29b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633862496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862496, "uuid": "48c77d36-b926-44dc-85f2-da3cd473101c", "comment": "Malware payload", "value": "cea8ceb0f76803c931257b69f1f01d20", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862496, "uuid": "082d2dd8-061b-462a-ac20-9624e70f7247", "comment": "Malware payload", "value": "f080d69edc6929ba1d67f218d3ff9bcc8301c568233886cc1e976f0bcd4b5db6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862496, "uuid": "78b4cfd2-484b-4aed-acbf-fa26b257e69a", "comment": "Malware payload", "value": "33be811c2600b4db12b454cfd5b743ddd0311c85", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633862496, "uuid": "26f8e7c9-6d60-42bf-9a79-dca48ce7e89b", "comment": "Malware payload", "value": "d2551c7b779a042efd202cc3e5326de7c1e9ea24a566d9a11c10d04f999d58a3343168ba782f3e4e1473c5d7b7af24e7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862496, "uuid": "cfc078f8-3e16-4e70-92cd-688291d2231e", "value": "T15D23C0B78377CEA15E892928445E39543A780DF2F178B893D00352DF86D5BF830A6D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862496, "uuid": "b577b1f5-4a86-4bad-adfb-9f0f0be6ed5b", "value": "768:V51JTIQ70bMj8RsGvXJEEh7FAk89ERG2gO0bBRL+q+pBGogllUsRU+L:5Js5Yj8nJJjAk8+u5zX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633862496, "uuid": "3fdbff4d-e8bd-45d3-8b89-d0c6f627e725", "value": 48655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633862496, "uuid": "eeac0951-9b79-4a08-ac29-372e83b05ded", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633862496, "uuid": "7a3c65e2-464e-45c1-ba9d-7794f21fd3e8", "value": "HpUzrDt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e036064-299e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633852096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852096, "uuid": "11ebeeef-cc68-4473-afdd-0d1af1e674b2", "comment": "Malware payload", "value": "194bf3dd9c58e678bfd190f94fac9006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852096, "uuid": "7a332fd8-830e-4124-bc7b-cd768c796184", "comment": "Malware payload", "value": "f1c367a9e61a79e35b25ced3249166e442845a3d63a06524fb908477140c9f10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852096, "uuid": "e222906b-d3ea-448e-820d-3c4e70dda082", "comment": "Malware payload", "value": "1c396254c17eb10844ad08fb3a807987c3a2d6ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633852096, "uuid": "a2e4a93e-8bc3-4390-b876-d761861d4a8d", "comment": "Malware payload", "value": "b8faab33870381ecd9034feb8bd6cc71d0367a2a98015ec7ec926c497f5379f59b2c8e5020f7328504edc8aad859b8b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852096, "uuid": "b2aabc3b-e07d-47e2-a410-7f20dd89ab35", "value": "T1F4E4D01063A0C03DF5B666F449BAD268A52F7DB1AF2480CF22DC16EA57346E1ED30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852096, "uuid": "4f0eb381-da4e-4916-9105-9e9f42a57ebe", "value": "8999899787bd60b1911e458f2d25de40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852096, "uuid": "4741ce3c-1e4c-45d6-9629-d8462555af15", "value": "12288:4o7cIssTPOG6MAv0VUMumPem16BYjEg5nFkKMsZzqCjp/:4MdPOGK8VfNP16aN5nFkssC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633852096, "uuid": "55cc15cd-367d-436a-8458-38ae82c1f2f1", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633852096, "uuid": "9d11a753-ca3f-49fc-bf1e-a48a85e60a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633852096, "uuid": "9f520047-dbb1-46e7-8660-933998b53707", "value": "194bf3dd9c58e678bfd190f94fac9006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fac010-29d5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633875866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875866, "uuid": "a206b979-7481-4e30-87b2-f456111fe699", "comment": "Malware payload (Mirai)", "value": "e613c5b7b6789d9f1f77cdec94ac85fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875866, "uuid": "820e59b8-9def-42c5-a933-ec3a826d0560", "comment": "Malware payload (Mirai)", "value": "f1e9734c6eda59514c61a7acb7b4c523a3024fe20024a1b56a732403033af9b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875866, "uuid": "289c8399-de4b-4c69-b3c3-28209f1d1650", "comment": "Malware payload (Mirai)", "value": "747b2fda8aec42f1a01a476321aca8a15ad6d76f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633875866, "uuid": "764e122b-a902-4559-aee0-a60350584256", "comment": "Malware payload (Mirai)", "value": "38167a69bc04cfda1cffa361eed8355f1c73f995366b0d448dd80e785de86d67a8f34ed5e1b9721f3b090007c1d339df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875866, "uuid": "480ab506-800e-420e-979b-a50ca53c6c9b", "value": "T13AE2E138570144E7DCAA89F202771B4A5F2347E7BC177816D611F19FF60A8AC3856BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875866, "uuid": "ed4a93b5-a77f-45ea-af10-63b3771c6eeb", "value": "768:Rp4cMyZv4n/Fj3bRm82O2CAwZEsd8mq0RTgKJgGlzDpbuR1Jm:vRctmNO2n6eyTVJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633875866, "uuid": "4ef91ca4-2c0d-48ec-b0f3-20cca76f5b49", "value": 31124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633875866, "uuid": "bc4a4e3f-6522-43f1-8448-54ef90635e70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633875866, "uuid": "8c569b80-e2df-4fbc-b48c-d2228edf6f72", "value": "e613c5b7b6789d9f1f77cdec94ac85fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c16da0-29e7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883458, "uuid": "41336456-bdad-4185-b90b-44adbd811d53", "comment": "Malware payload", "value": "ce3fbf40295954621ba33912edbf1fa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883458, "uuid": "613cd4ff-ca67-4bba-8d4f-8d1f2757da7d", "comment": "Malware payload", "value": "f372b036d0fd6407fa2d58b8e9e1d48f0eb6dfb4cdc5aef723dc472139fd650c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883458, "uuid": "ead97fa8-cfde-4a5c-828c-9878af41c3fe", "comment": "Malware payload", "value": "45a5519e0bfcf74d26572113d2d244d9c408a574", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883458, "uuid": "422f47a7-0a0d-47ee-be69-ab94831c0b10", "comment": "Malware payload", "value": "e9702af496b745057ba355fb64c554e1b127e6576b38ade68bc4ead71a0b139907151bcf1ee42699d46287cc8c2dfbdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883458, "uuid": "fe939b3d-7d6f-44e8-afd2-d57a0ac6d236", "value": "T18653F166E2DB86A0FBEF3EF0398C97D7B7C1A6DF07524B3064674A10619B29204C58D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883458, "uuid": "ab5b6088-c284-4aad-9e67-1f37ca32e231", "value": "1536:oKvYi92Z6zIijwcYeMMKzLlTOSRZUHpdqF2/5Uf1YGvY/p4u+qgw06WXm8S:H19Kij+Nf8I/fKGvGp4u+qgwXWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883458, "uuid": "aab8bd4a-c64c-4dcc-9d2b-21e4618baf5a", "value": 61044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883458, "uuid": "8ea69b11-7e58-4cf3-9b1f-02fbbe298632", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883458, "uuid": "03f167dc-1cd5-46ca-a88d-563515131069", "value": "ce3fbf40295954621ba33912edbf1fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2fafbf-296f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633832014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633832014, "uuid": "cfde7b70-60db-4f03-abd3-c423ddee1cce", "comment": "Malware payload (Mirai)", "value": "29e27ff3c424e4e4aa2886da37d9bef2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633832014, "uuid": "c27cb22b-d9a9-4a2d-954d-ff0b6e002a84", "comment": "Malware payload (Mirai)", "value": "f3886edbc3bb5b706daf6f1b3c5db367e0da4e2a52f36e3e3163acab49cd11b5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633832014, "uuid": "152aaa3e-623e-42e6-b79c-1a9c592649ae", "comment": "Malware payload (Mirai)", "value": "62bc600f0b0b6ab738c1a11f7a1518c881c46309", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633832014, "uuid": "f0213982-934a-4311-a00a-27cc005e1d30", "comment": "Malware payload (Mirai)", "value": "4b7e283b2bbf33f22c6fbf766c1c2801c3d5594f4ad774a2d2dd75348817ef1d1d310c287e844aa6512ac1d49ab49dcd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633832014, "uuid": "ac068cef-dbe9-4505-a2e0-950e066288eb", "value": "T128630195C37ED677D933A8B37F5C6282BA13FC4741225C6482F201AF8EA67063999370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633832014, "uuid": "81da47a2-49a0-4b65-b385-08550b32e24b", "value": "1536:P/P4xuHGHmp8C6fG4oBxe2gf9mGTdFo5KFuqp9PZhe:P/wumGp6fAre2IUGTdFicug9Bhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633832014, "uuid": "ed31dd1c-c694-4850-8743-22ef7484b9f6", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633832014, "uuid": "646a636c-6f70-4d7c-bf01-2c0281d1a060", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633832014, "uuid": "aa6fbe08-54e0-4b87-9380-e0e70457926b", "value": "29e27ff3c424e4e4aa2886da37d9bef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d7cc54-2a0e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633900024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900024, "uuid": "b4073c72-7055-4d5a-87bc-a286fbd12d8a", "comment": "Malware payload", "value": "3de5c8646ca40fe7337662abc72d9f72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900024, "uuid": "cd9f9c5b-e288-4ff5-9075-0a1b66461a27", "comment": "Malware payload", "value": "f415cd5bcd6de599e52fd3e914ec02c46c9b9e1e10a92bb68af5e4fe07e40af0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900024, "uuid": "761c5f69-2f15-4fbe-bdce-2632dd57d0e9", "comment": "Malware payload", "value": "52b46b834965a2a6cc364d0388f7ac4bd1dfff2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633900024, "uuid": "72f6980f-016e-444f-ac93-69a63e494811", "comment": "Malware payload", "value": "3a29716aac0db2c8ffb4fcb159317eaa0b09d22d8c03ad8330cd64664cf46a3b8eba751d858ff7790cfa722510b092ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900024, "uuid": "a6fc92cf-0c0a-4fe3-b1a7-4cdb796439cf", "value": "T1D6F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900024, "uuid": "8684994f-85ae-44be-ad8a-e0e104458443", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBOYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/oYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633900024, "uuid": "ce715fb3-e4a8-48a7-bead-2db1f97ca89f", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633900024, "uuid": "e6c6b6a7-6534-4f5a-98d6-644276ba56ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633900024, "uuid": "f8d94ee5-92e2-4452-8059-46c0a421be7d", "value": "3de5c8646ca40fe7337662abc72d9f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b25f352-2993-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633847367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847367, "uuid": "6391055d-eb33-443e-840c-cabf849fe548", "comment": "Malware payload (Gafgyt)", "value": "c4b1b2d62bb354e56f49840458672ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847367, "uuid": "b0736153-2f1b-4a0b-82cd-70022f987dcb", "comment": "Malware payload (Gafgyt)", "value": "f42723551adf1cf8ebb5ba318f8437ba1618150ce57447e748dec7263341da76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847367, "uuid": "802ae0a9-4e4c-452e-878f-ea195bc42b8a", "comment": "Malware payload (Gafgyt)", "value": "4c92b9e37014bdbb29ef77afcda595db40dcbb9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633847367, "uuid": "ada1f777-5de1-4592-8ccd-045f892889db", "comment": "Malware payload (Gafgyt)", "value": "52aad664d3084fbc25930e26bd75cb8a9a5994671241668ca33af0cea5d2572e39ed4e02037ce66a45363a3034d701ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847367, "uuid": "ef680a31-2a0f-4fd7-a004-7443b9bf81a6", "value": "T1C3933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847367, "uuid": "601a6192-1cfc-455f-9339-5b275b844b4c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Rl4umXxVqDrstKfz9e:Q97vk51RcG7Arl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633847367, "uuid": "00b8b734-a3bf-4866-b26e-eab5b4657504", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633847367, "uuid": "8dfdc9b1-3060-4acf-9a68-17ecf2cf4010", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633847367, "uuid": "93229f2e-a990-4f81-a1d7-22bafad2961e", "value": "c4b1b2d62bb354e56f49840458672ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2852d6b-2a0d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633899993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899993, "uuid": "16fc78c4-fc6e-419c-a37b-acd7494ce798", "comment": "Malware payload", "value": "dc57f085d99110105f6ba9aa4c6358da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899993, "uuid": "07734e78-dcf9-4212-9cf2-349d874a79a1", "comment": "Malware payload", "value": "f4f26282d4774143e9181ed4443ab9f073fd3e838f9749eb3ceb72b84b80ce09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899993, "uuid": "d000d054-1d66-47c7-b381-77def5b5436a", "comment": "Malware payload", "value": "da8fd63f0756087b1fc4919a1f0a9b02ddb6d5f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633899993, "uuid": "8d595d94-f1d8-420e-9dfe-8a24ed38c428", "comment": "Malware payload", "value": "4e532bb3c407323ed6b6bd0d422ff6062ebb910ba7f799996803292f5acc18eee5c1390aac8c4d0a2e02f0c47978d0e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899993, "uuid": "7a33da76-58bc-4642-988d-75485f05cc3f", "value": "T1D0A30896F800EF77F40AE67604D34B25B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899993, "uuid": "80c6d432-d291-4b2a-819e-d8d15e986135", "value": "3072:VgJrWBIvC/IymEdH8ffXPOKmuxVqDr78fz1e:VgJrWBIrym+8nPOKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633899993, "uuid": "f5c629a2-6126-4aad-9aaf-07f8412b1088", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633899993, "uuid": "12190375-2aa7-4103-9d2f-d4266d2aae6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633899993, "uuid": "6c625cc0-01fc-45fc-8618-4e0ffdec00b8", "value": "dc57f085d99110105f6ba9aa4c6358da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad984ada-2997-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633849197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849197, "uuid": "f554146a-3ecb-4689-94d8-6c35b77e1c98", "comment": "Malware payload (Formbook)", "value": "c214a546c7f97576eca5b39592eb16e4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849197, "uuid": "b04a76a7-f535-4064-820b-0b1c746a8e04", "comment": "Malware payload (Formbook)", "value": "f5cc3d5c8248a1e70443b7b227d4fd14a8bfc63424816c56769108c2cf1037a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849197, "uuid": "a1d6d22a-1068-4ed6-929d-16c8b7b66a0b", "comment": "Malware payload (Formbook)", "value": "f50a28c03de5b62b83a257b4f9a990fb33095325", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633849197, "uuid": "8291f4a5-d1e8-4677-a0d8-8c074822010f", "comment": "Malware payload (Formbook)", "value": "ef5871cb2854c5c38f8bb037d5f991ae954ed93cbb34bcde8c445a5f47c8286bc59b556a33e919616b16215aa6692d9f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849197, "uuid": "fbfd6d95-9017-41fa-ac02-05fb4a5c7f4e", "value": "T107741208A490E3EBEBFF7139B7A206C2ED65CEF76F0BB091516435FF81706184660A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849197, "uuid": "9dc43d31-1a12-40a3-9a83-b69ebb23bace", "value": "6144:HQJBQEnngcTIS0aYYmIWZufODzpfYRgjdeMqQ+7aMMbpDSYpA41wWkAzfll9:HFEnqWWZu2pcgjdeMqQlkCjk4f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633849197, "uuid": "0c67fe81-44e3-43ec-b098-b5f597edb358", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633849197, "uuid": "e914038b-4e2a-4d0a-a660-3ca02e5bb8f0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633849197, "uuid": "dad58ca7-cd0a-4947-9ed9-c6d1705514de", "value": "SAVED 10-09-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704d0c23-29df-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633880018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880018, "uuid": "a058a4bb-5ce5-48df-a9e8-739cc817156f", "comment": "Malware payload", "value": "937e1b0aa2d99a8199c78d04601781fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880018, "uuid": "bc14305b-cc7d-478c-8118-eacd1e7ad4d0", "comment": "Malware payload", "value": "f63ebd6d6e67793c1f3cb27d146d16b4894149f2ec282bdbff387a5730692b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880018, "uuid": "e4fc956f-76ee-4781-97e5-4ab56503c437", "comment": "Malware payload", "value": "57f5a4f4f2d37d3c1aafb1a402e8051af1936364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633880018, "uuid": "f73a3f9d-13bb-4ea3-b187-88ff1751e017", "comment": "Malware payload", "value": "795eddb618fe1690791d3722cd0a16ce4e9e4ea354738eff424d616ebfa889ddc8462266c91af3582ec5820739e56daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880018, "uuid": "3f0ce81a-8897-4c64-9e6f-951bff90fc19", "value": "T153A5E441724821A7C21FABF0079E77F47CB69F6DE8530D02296B190771AE19253FEE68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880018, "uuid": "9ebe84f6-f2f5-47ff-a7ea-b987b87407d9", "value": "b3530b01317d03162297d078106b945d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880018, "uuid": "40f62ff0-619c-4e9e-8786-e6025372c3f2", "value": "24576:++/m1DV0XPXSSqsXjTU1+Cn8zgqDXpkmz0zRteph5O6firo8v:K0PXFfjTUk/gq7pvz0zOph5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633880018, "uuid": "5240ac4a-a7e7-4ef3-b200-c387b09f9c26", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633880018, "uuid": "caf82e9b-4dfe-41cb-8beb-1ff24ab254a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633880018, "uuid": "13a91a3d-5a71-40c9-ba15-86c6c2690661", "value": "2021.10.09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a563d4-29e6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633883028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883028, "uuid": "e81e4297-2724-4d0f-9ca4-f9e1a6e55836", "comment": "Malware payload", "value": "d815003f0ebacffc62bd36083d88797c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883028, "uuid": "0cad010e-3a18-4c84-8764-25743debe69e", "comment": "Malware payload", "value": "f803db9a68c07b9e1798adb397879357dd62db5bb8b91ec9097b7ac340b05278", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883028, "uuid": "e5779b91-17ac-41e3-a77a-82ab95828970", "comment": "Malware payload", "value": "30035943716d4e1793d254e06a95a2db63650dc4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633883028, "uuid": "0a022044-46d5-4b43-88a1-95b2504b119b", "comment": "Malware payload", "value": "f207ca8b84a0a6decfee71434af85f561a57e1d4d7bfba9cad6ccf39ecaac00400cbc01d85f77d4851f5cac793110eed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883028, "uuid": "dfa05b74-6908-473d-9700-160f0e6d8a06", "value": "T103E37EF1B15CAA95CE8BF372976CE950036BFCA0869656377490FE4C1D73220EA191CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883028, "uuid": "4f3a83ec-2896-4e9d-97c0-4b5110cecc58", "value": "1536:4Ej/mdT9ssgq1jjTndY+cGINvA2Lv+YpBPxlwNmBM9IG3d8GO7wR4Qz6vusL/El+:4EKQI3LdRpINbvDPrwNRIGGGOjTEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633883028, "uuid": "751742c8-aa06-4999-830a-900a6d1cc5c7", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633883028, "uuid": "39d0735e-1f58-421a-8d95-70504edeb113", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633883028, "uuid": "caccc082-0886-4fa5-bccf-3fed6ddfea82", "value": "d815003f0ebacffc62bd36083d88797c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2f5ad4-29c1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633867211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867211, "uuid": "9ebee508-1f38-4e0c-8490-e4614b16de90", "comment": "Malware payload (Mirai)", "value": "7eca9b30c1164b52a21c20c9f66b322c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867211, "uuid": "226481e4-3a5b-4a4b-b6d0-bd5be84b0366", "comment": "Malware payload (Mirai)", "value": "f8235f22eb4c985decec3a0024ae3b73bcc99c9726117b6b62025f8feab6e3a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867211, "uuid": "3e8aba0f-3a78-4ced-8c4b-adfb1504d3f3", "comment": "Malware payload (Mirai)", "value": "040059477890620aac1dc22fa5f032db0be7904b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633867211, "uuid": "0d70334e-8311-465d-8d88-b642756e52ca", "comment": "Malware payload (Mirai)", "value": "7db576348134db54a0a12b024df4ec5327823dc949e365042d444cff373826b009e2a139b70450d574266abede3a2436", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867211, "uuid": "96a05427-ce93-495b-ab60-ea066da4a932", "value": "T1EE431996BC918A06C5C86377FB2E419C332563DCD1EF33039D252F6076CA92E4E6B246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867211, "uuid": "abea8d3d-edc1-4136-9956-559df87ddd4d", "value": "768:KRqF3ypPCGJl8+Dw/ervY/gR0Li7xI/cHPkmRDUONSv2tn5ZbcJBNOS5I9TdJfO1:4qF3yQGQ+DNTYIAWxI/cvdS+nn4Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633867211, "uuid": "f5a56f02-5a13-4d50-b868-9a66023098ab", "value": 55716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633867211, "uuid": "0da7f860-d564-443a-befa-f527ba6ed4f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633867211, "uuid": "fd98d809-717d-47ae-8d5b-89d3c290044a", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161d7aae-29d3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633874712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874712, "uuid": "3a87d0a3-ecec-443d-8943-ae0f2382de2d", "comment": "Malware payload", "value": "cfed0dbbbe917ce74778c301dd59fbf5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "OOO LEVELAP", "colour": "#87646E", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874712, "uuid": "35d342a6-6b0e-46cc-9fb6-ccde15335ff1", "comment": "Malware payload", "value": "f94162fa02c3217376a4bd939ab3822c0040d5ba73fec279fd0b4b3415d02e98", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "OOO LEVELAP", "colour": "#87646E", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874712, "uuid": "bba43b28-3d4b-4581-8a95-2d95574f6592", "comment": "Malware payload", "value": "910dcceab42f617a8df06aa39ef9839e09d0b6c4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "OOO LEVELAP", "colour": "#87646E", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633874712, "uuid": "6f6a6db0-a4c2-485a-8b9f-b300a27adb77", "comment": "Malware payload", "value": "757311cb750ccd44d4019c1a8e84b30be0f0fde192d58aa10db7492338fd15e9c77875e40ac955f5f4cc9afd48b7d999", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "OOO LEVELAP", "colour": "#87646E", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874712, "uuid": "5426b66c-6b6e-49c6-ac7e-2c1d1fcbe6eb", "value": "T16A85335FBDA625B2C4FDA079411BA97C3C52600A7D0B3F3853C9B253E8D5240AE5DFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874712, "uuid": "b92b0a54-e9b4-4090-8002-778a3fbf1794", "value": "49152:ATm7lXZdvBzQ6v6H78wG+VXAxGG7II6nEgNYUgd+lZuj:Wm/dvpQT78p+AwQtxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633874712, "uuid": "3fa7ce40-09d2-4ff0-ac8b-0ddd601ae390", "value": 1725890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633874712, "uuid": "fce57b07-b557-439b-b36e-fb49f015fd16", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633874712, "uuid": "f275b86e-5af7-47a1-ab01-8326f1d76dd6", "value": "Free-Business-Partner-Contract-Template.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fb4ae6-2988-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633842773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842773, "uuid": "b9076043-608e-4bf2-8edb-d0cdbfcbbf83", "comment": "Malware payload (Gafgyt)", "value": "b1a66ede3dff40805c471daf53b12cf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842773, "uuid": "186c9572-f6ee-42c3-846f-4cfe72d01948", "comment": "Malware payload (Gafgyt)", "value": "fc9a19e1fe0ec4297389a659faee210b89ea3b3c67a0b0bcaf460dfed9006ac9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842773, "uuid": "aa9210f9-890d-4d25-a88b-1a01847560e3", "comment": "Malware payload (Gafgyt)", "value": "64b66e0d6577a303c8fb19ab7e162361eb9c7560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633842773, "uuid": "8e188041-e634-4b41-935f-3004b8d07517", "comment": "Malware payload (Gafgyt)", "value": "0eab0ceef2edfa949888979ace2fecc8dfe6f906247297c826ef50a4f383d039826c63d6f6f159ea74f25f44d8f341dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842773, "uuid": "45e8dc01-43a8-4922-a1bb-1c92440a0821", "value": "T152C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842773, "uuid": "9abdbbeb-85d6-45de-8c8e-0a1021477257", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EpkyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EyyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633842773, "uuid": "536cc46f-9be7-4fde-8371-ce69184525cf", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633842773, "uuid": "78dd395e-55ba-43da-9fbd-84bb278cb1b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633842773, "uuid": "fd4e8657-a2c1-4354-ad4f-da44b0b6a517", "value": "b1a66ede3dff40805c471daf53b12cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3d46c6-29f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890772, "uuid": "e8bfb466-06b2-4aa6-bc4f-ec2b01dc73c6", "comment": "Malware payload (Mirai)", "value": "b36ce56c06b0f8c4f7c3cb9d0ebae4c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890772, "uuid": "1d6d33d8-9ea2-4835-bb59-8e2249199ef7", "comment": "Malware payload (Mirai)", "value": "fce7aedac6e9228c8084f6dd4ffc99f0e99b3d6dcaacedb1ccd1ce5dc344c7ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890772, "uuid": "2c98dfc8-026b-4331-8ff5-11162b5d05bd", "comment": "Malware payload (Mirai)", "value": "e608b99af3b355ab0a2eb29c650221365081098a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890772, "uuid": "f56bf86f-044f-43e1-b960-716040522a0c", "comment": "Malware payload (Mirai)", "value": "023d283d2d279cfae289be758495b6d2f966417b7b0366d8cd7057d0f6926d78cc8e47a2d721e169d6338eaa00b65c88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890772, "uuid": "c3600525-36f4-49ce-a375-53d548a36a82", "value": "T12EF207DAB801AD7CF91BE7BE4913490DB560764650930F3723A7FDD3AC321AC4A26E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890772, "uuid": "8ea6fd29-95e1-4924-aa63-4efcccc82992", "value": "768:hcevDVgP9bH+SqOyuIChPQZ0RhyajJdDwWa88m5:e4mbH+SqOL1h9RhyatdDwZ8L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890772, "uuid": "100d4e4c-a4e5-47f1-a3b3-7763ff986b56", "value": 35592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890772, "uuid": "90e751d7-2f48-4d74-8f36-5c052537821c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890772, "uuid": "a4651194-37e6-4aa0-8ccf-6578f9bec8ac", "value": "b36ce56c06b0f8c4f7c3cb9d0ebae4c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74207eb6-29f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633890761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890761, "uuid": "d3d1b0b3-1ad4-40f4-a3d6-6c6fe8b35683", "comment": "Malware payload (Mirai)", "value": "2f1ba7c22c68549a10e598474df3de3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890761, "uuid": "0771f935-1325-460e-b833-bd8b4f802203", "comment": "Malware payload (Mirai)", "value": "fd3fe853ceb63723c652df099436494981cd26356165f2982d39162a4fe20b70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890761, "uuid": "e3adf150-bb6d-4885-8b76-c62da1e8bca5", "comment": "Malware payload (Mirai)", "value": "3a08caf9f3ac129c116de177de81747cb355a01c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633890761, "uuid": "bd032137-82a2-4d96-8c9a-f0ac3fe9c0a5", "comment": "Malware payload (Mirai)", "value": "071c5225ae72e00d2851d8dda170501aee9714b5e38a3d35278f332c7dfdb95e28aa32703fb9ec049895d3410394d0bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890761, "uuid": "9e2dddfd-150f-45f1-b213-b499f55fba53", "value": "T15AF20841F84B81F5C817097011A7F63FCB31DC6958B08A9EEF9AEF39DA639418223259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890761, "uuid": "104e9c18-5b12-4516-a110-6da0deb6f344", "value": "384:fJm9ocBseSwRSnTIExgVQT0I60ojXPoH+qfiBdQrbW2ELViuhhmILGjVvyavQ3QV:hgjRSTI6A/wvzO9L7mfjZy2Q3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633890761, "uuid": "58279d57-7bb3-4afa-bd2d-a686e71bed21", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633890761, "uuid": "433066ca-7569-4a28-b482-00572620e96e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633890761, "uuid": "7f834df3-ff47-4b5d-b634-be209f00fe03", "value": "2f1ba7c22c68549a10e598474df3de3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }