{ "Event": { "published": true, "date": "2026-03-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-30", "timestamp": 1774915381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "cdefd227-7e80-4262-be9d-9c57d70485ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9dacc5-2c87-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909504, "uuid": "adcd9796-59ef-49ba-994a-bcde3897b045", "comment": "Malware payload (Mirai)", "value": "e6579ac11f0a6c06f8509fac73157cde", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909504, "uuid": "8cc9b2a6-f345-4179-9427-45b4efd72557", "comment": "Malware payload (Mirai)", "value": "003e7ea6abbaf7022256926ccd49c985b97eebbfc14683b1e5c75bd6e903b3aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909504, "uuid": "066dd743-7670-4f93-a7a7-f4a120ea7eea", "comment": "Malware payload (Mirai)", "value": "27a6a273789704e256fe7434e26a7deb959be590", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909504, "uuid": "baf8cd1d-e56a-41bf-8560-29c7b5c89380", "comment": "Malware payload (Mirai)", "value": "6dc62abac13fe29494f365c1c7eb56c661297ac4676270d50d79f1cf2c4ee888877c7cb0f6f0470e201b5aae3d51f52b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909504, "uuid": "aeb2daa3-fd0b-42fa-a466-35aa910a6ae0", "value": "T184517ADB22A109355D627617FFB9CD3C76C8509F38EAAF00A4FC34B55A4CD88B848A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909504, "uuid": "f9b9cb2a-50ee-4e69-80b6-1678c9877f89", "value": "48:io7hmcoNnEcoQCXcoMePcoaZazvZcoafaFvjco9N39z4gecopjccoASvcojZjzq4:iKmc+EcEXcQPc1gzvZc1yFvjcWzz4ZcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909504, "uuid": "69bcec9a-6ad3-4c3c-88a6-a3e482b92dde", "value": 3034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909504, "uuid": "ca936d37-bc06-4f70-9f02-3164db577303", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909504, "uuid": "e8dc40b5-d6d9-4c35-810f-58f292c35978", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada0079c-2c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774879172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879172, "uuid": "8498370e-21f6-4d31-ae74-ea36fddf6293", "comment": "Malware payload", "value": "8c2ccdd0329a7a3045627b01177a7fb2", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879172, "uuid": "3b074b99-d543-4549-8131-ed4e530a25e2", "comment": "Malware payload", "value": "00e771bb7a3d1b1a4c937ed5d22d410fc5d02c583807087ece97e727e2e631c2", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879172, "uuid": "c0c812fe-e98d-49b6-a3a5-6f46e17d4828", "comment": "Malware payload", "value": "153d4828bb36fe5214d804ca0f8a8e7247a359a5", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879172, "uuid": "e24ed04a-5473-45b3-a96c-a52daf40534c", "comment": "Malware payload", "value": "218fd386b76b5893d1e46529eae03d62df238ae6e8c7ca56bc990dabe4d8a87495063d941c482d699c7a87ad87a04953", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879172, "uuid": "d62c86e8-ab61-478b-8e76-f0bd6fd9ae7d", "value": "T1CDF423F2A6C35C4A87ADC35E50A27566F0D80D6296D7D193823F870197DFAF0CC14BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879172, "uuid": "57a2d672-c117-4653-9380-94b4ae6feda8", "value": "12288:RoKQyqCtO3yUEPTj1fnFqFuqD1VYqrq6AypcJT9IbuNq12Eti5AQ9J:hQNM6iFq5VYqrq6FpcliiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879172, "uuid": "5b328776-d14a-4afc-a768-212ed8e01966", "value": 728249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879172, "uuid": "c99d7c6e-f023-43f6-bce0-d2e1af74ddbc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879172, "uuid": "336a043c-7609-407d-8598-5deb6b0ec9e9", "value": "miumiu.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c9d0e7-2c3e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774878243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878243, "uuid": "fbb7a97f-7499-4dd7-8fac-d8c0e105d4ac", "comment": "Malware payload (RemcosRAT)", "value": "7ddaa2cd3b1e3bb13dab969486f1c420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878243, "uuid": "b8809eaa-978e-45d4-89b3-6b3083373e84", "comment": "Malware payload (RemcosRAT)", "value": "017849e593fb62b78b65843da6af9ec5dbe85623a38b238c60a21ea5866ec600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878243, "uuid": "800dad73-4668-4024-bc9f-acbd7d1f3808", "comment": "Malware payload (RemcosRAT)", "value": "807e69b5a5dd83432c2be77ebe1334775513ac4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878243, "uuid": "8b4e0947-5f59-4fd7-9f21-923b81602e24", "comment": "Malware payload (RemcosRAT)", "value": "b70be5aec4423931b111d65a2732d8b4d7d2520e91924daf05a7d32d701fa4dee86fbebc1021c998346e230d3e4942c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878243, "uuid": "7eb46b76-b2f3-4ca1-88d9-09c8937d3477", "value": "T135551228668CDA42D4A787F50F66D07A17B80DDAE840E71B5FED3DE73A32B112908357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878243, "uuid": "377797ba-557b-49bc-abee-811ebadc6531", "value": "24576:CpTsMJIdvAiXKKq7t90WCrHf9U2UpUiaqakuft8/EKHwiBprzGxs96ip:CpTsMJISiXVqABf9XUpU2tuV8/5QMrzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774878243, "uuid": "9948b325-3414-41f8-8fe1-610f9b057018", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774878243, "uuid": "c76e8f1e-c043-4543-954e-d42913cfdd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878243, "uuid": "c4e581f8-6762-4080-b0c7-dafdc5648056", "value": "Rechnung 202993838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1abe8e-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909240, "uuid": "fcfb659b-6695-4fc1-adec-c4e7ca44f48f", "comment": "Malware payload (Mirai)", "value": "fc9cd30e3fac4b2458860626772231f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909240, "uuid": "7a8e4a78-4ac2-4a71-9eb0-a9179f6e2919", "comment": "Malware payload (Mirai)", "value": "01e63c589a87fc53b9eee7d8005a0df91108c985188f85781b5801d2d11d03bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909240, "uuid": "21b3b37b-1c2d-4a08-8495-83349a5a1d46", "comment": "Malware payload (Mirai)", "value": "ecc4de7c5d879040548310c3cffa05abe11dfdb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909240, "uuid": "5a80d501-477e-4e7b-ae03-0ea5b496fdb3", "comment": "Malware payload (Mirai)", "value": "8385ce8dae7380cfe32f35551ea6167eb73132cf75a166184d1ee1590df37e6fafef79814c2f6a7b7d3afc17995445af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909240, "uuid": "30598999-852c-4447-ad3a-7c17f7c51cca", "value": "T1C463019340A78915F49CD27987EE875BA2D215E18F8B994FCB2CCE3E19BD4031C395A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909240, "uuid": "51b26f98-f59e-4040-bfb0-7bf52b399834", "value": "1536:dcEVGUTLhR5Y6VPT2eJos20v02Q8+5uL4Osc+CUe/s/AQh:dVJHdnpFJos20vZQ8+56MCvsYQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909240, "uuid": "d3e1b24a-6c74-40fc-b64f-b44f03e84cae", "value": 68300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909240, "uuid": "b36e8017-6cce-4934-a582-1fd33b3573f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909240, "uuid": "6276246b-79fd-46f5-b286-6c96bdbebafe", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568338ba-2c59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774889764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889764, "uuid": "b686baab-ec3e-4e9c-89f7-4205414cc207", "comment": "Malware payload", "value": "5a7bb4c6c2be10d304beace4e5eff0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LotusBlossom", "colour": "#831A1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889764, "uuid": "178b7f5b-5552-41cf-a1aa-e13796a8735f", "comment": "Malware payload", "value": "02368c6b62cb392dddd35cfc6cb8c1154f7ebdceb9fb559cefc301982d6fbbf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LotusBlossom", "colour": "#831A1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889764, "uuid": "123a7292-cfdc-474e-b226-940983e1f968", "comment": "Malware payload", "value": "9e56facebc6218b945b5d1e5f8b95a854a33aeb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LotusBlossom", "colour": "#831A1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889764, "uuid": "d2bc10ce-2b55-48fc-bb61-a71252088bd5", "comment": "Malware payload", "value": "c2a4d604e218d6060bf77d662a8009e14518bd41fd25a0ebba4d9f303cd296828cf90d95b8cc80f5e7a543674f79c960", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LotusBlossom", "colour": "#831A1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889764, "uuid": "d47199df-49f9-44d7-a970-a38eb7a1f87e", "value": "T1EB457D1BA5A2556CC185C034556F8A321DF0F4E1B6327CBF3A81E5383EE5CA523AFE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889764, "uuid": "9448c077-bfb4-46cb-9a7d-028cb9327012", "value": "24576:o8KtcdrXoOGOLCzy+FgfS6Ru3sWYAKxK3a9:PKtcxXoOGOLU1Wu3sWR29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889764, "uuid": "1fc03f2a-b094-4bca-b2ad-e7db00e8113f", "value": 1225776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889764, "uuid": "1f071e9d-31f6-466b-85c4-260648dcf120", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889764, "uuid": "3953e36d-d098-4b9d-8efc-a230ac9936c7", "value": "proftpd_proftpd_lon7mtmutftp101.markit.partners", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b490aa44-2c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774904524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904524, "uuid": "5ef855a4-7473-4783-be8e-afd8daa8da88", "comment": "Malware payload", "value": "70020ee24723de319ac63f7e8cb0368a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904524, "uuid": "33f4bc55-84d9-4514-88c0-ea7fc8c66f6f", "comment": "Malware payload", "value": "029f739d4d8ce8447b6d59f4fa4ad4c3b1451e156fab5d46c3018a8710385255", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904524, "uuid": "c38af5aa-467e-42fd-a028-e29dcb77a79c", "comment": "Malware payload", "value": "5fbdfa4f11d08d15eb36b7b23e556c61f2013bfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904524, "uuid": "ce3c3055-b246-49a1-a563-8daa52c4f8c1", "comment": "Malware payload", "value": "94dcbfe4ba167603fc3a81565a1b566a5840c55fc099f7bdddd963678cbd9c26a821798771d477408aa36ccae384695e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904524, "uuid": "7f76c43d-40ca-4f19-9b94-9eeb4467c240", "value": "T1F773A663200C7ECD149D67F94EDECC4EDB41408D744B6CCAF6BAA9028B9B299DF1592C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904524, "uuid": "2fdac4ab-b036-420e-9395-d7ef25be6726", "value": "1536:MX/6OwVb1/yR44TGM7ud6paKCGoUAiVzUNFrsPZK8T1qEiX71X+pKh5:MXCOwV1/yRL7MlGXAiJUNds8EiX7x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774904524, "uuid": "81a164b7-fffa-41d0-93bd-abe20bda5581", "value": 77225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774904524, "uuid": "85f2a674-9134-4d8f-965f-096c7bb85a56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904524, "uuid": "d09a2b92-a878-4d41-bc01-ced3c6f412d4", "value": "6893914e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2c78c3-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853964, "uuid": "6bc1ef46-2cb6-425e-afff-bd572ec7c0ca", "comment": "Malware payload (Mirai)", "value": "a38279ed75e3dfa9ab4f0d49032507ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853964, "uuid": "b6a2b9b4-7489-47a5-92c3-d781519a5ffb", "comment": "Malware payload (Mirai)", "value": "03c4fc96fd0dadb16640dd40cc54526161963ba6b0f600c8d1d66b9b8417c106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853964, "uuid": "64ec72e4-1872-4aa4-bbf0-fe11948f9fdd", "comment": "Malware payload (Mirai)", "value": "9179f1a79397f5ee5d71f63dca815e14a6c43f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853964, "uuid": "f767126a-9ca3-4e4f-9c65-63960160f718", "comment": "Malware payload (Mirai)", "value": "4b5cc005fcf36429c3a03633ae313d2994a88a5ee26b6165de7d2d871ef3bd088d5a5cad0e0492e4ec8762f8bebcb03c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853964, "uuid": "99333aac-4228-4d51-9757-366e73573488", "value": "T1B6343B86EA814A13C4D627BEF69F424933339754D3EB720299296FB0378779E0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853964, "uuid": "ec872c9b-ac12-40f5-af77-2adb966b48a0", "value": "6144:eGRS39fG63T7t+d1NOaOUUJ8YaUfROh+16rsGM/RmReP:eGRS863Ty1NOaOUUJ8Y5Ztisf/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853964, "uuid": "f6c3c3dc-2b42-4358-b701-85b602acb13f", "value": 242076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853964, "uuid": "5d81cdab-2335-47b3-958d-3298c42bbccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853964, "uuid": "4537ac34-5445-44d3-9f4c-0a9ddcd25874", "value": "kurayami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3097d1ad-2c5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774891847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891847, "uuid": "c9ca2f06-9eb0-4aa0-bdb0-2ed5a7d5a8bc", "comment": "Malware payload", "value": "e71233a3d4fc579b95984cb6226d75bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891847, "uuid": "0e32bf46-9651-4897-8b64-ca0652c78943", "comment": "Malware payload", "value": "04a11791a61a8522af2817801860e6f93f487036d936f0287d28fa94b5837c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891847, "uuid": "51355d42-c4be-46d5-9898-705387caac02", "comment": "Malware payload", "value": "c9962e1b0d9b6833679a462739ea7239535383da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891847, "uuid": "4a9c770f-7d8e-4d70-bb1d-696641c179e4", "comment": "Malware payload", "value": "09903a7a7753cc0efdf18958fbcbe12524fe584fd47130f505706c4134aaab20874d2b433748f931b4785aeae9ed68d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891847, "uuid": "b87f6316-a8e4-42ad-831d-22da57b269e8", "value": "T1BD2623A94531F082D5A20C6B78489D20C283E6B954087F70554B63A73FFD7EA6FF960E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891847, "uuid": "a00bb8b0-3c12-47c5-a17d-b927f4a2b335", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891847, "uuid": "13728dc1-815c-4530-8a93-c611ada8a5f1", "value": "98304:59QqnCJ56XVYemdRtCjgXlUGn2OuWX7R/n99ew5:5oJ8FxmLrXT2Ousd/n7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891847, "uuid": "1937573e-7609-48ee-ba63-40698f8484ad", "value": 4473344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891847, "uuid": "08301873-ecc2-4885-bb18-2190488ec805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891847, "uuid": "61d2307c-48f4-4553-a027-6fe0de0ba05e", "value": "e71233a3d4fc579b95984cb6226d75bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84535205-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830570, "uuid": "cac05651-d7a6-4f54-8fd1-789fe63a6d57", "comment": "Malware payload (Mirai)", "value": "99124e7adcbf8e9907efeb1f25ac5330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830570, "uuid": "6c0adee0-ed95-41c3-ba46-cf03171ba79c", "comment": "Malware payload (Mirai)", "value": "05c050d044470561ecf9912754ede421994a56c9f18593b2f279fc93188f1917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830570, "uuid": "b24538a2-3d80-4453-8baa-9e9a28422e65", "comment": "Malware payload (Mirai)", "value": "4093e3fdcd63219527c6d63ba2f7433b2972e73a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830570, "uuid": "c793f5fa-d90c-42f8-8049-58562321d477", "comment": "Malware payload (Mirai)", "value": "6e4ed56142743cbf4b89b376af85a57bc262158fdcc0791dc73cb956921410bb9ba316d831ee88195e3d573f1099e478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830570, "uuid": "f58489fd-061e-4a68-bdb5-fc43cd67923d", "value": "T1F9044C46EB814A13C0D62779F69F524633239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830570, "uuid": "9d5e509d-d34f-4571-b208-5e2057cdeb78", "value": "3072:Hlco92mDLaepNPR9ZpO45+EPCC6uUVkHy3d0fM/9JDT8hM:HlCiLaepNPR9jOARCzuskHy3dEM/9GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830570, "uuid": "303bbfe2-28ba-48fc-949b-aa103f7b86cf", "value": 176515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830570, "uuid": "a1adfc74-5dcc-438d-888a-43e542240c7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830570, "uuid": "28777940-7fa0-42f1-b7aa-bcfce8cb842b", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0916f5-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774868028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868028, "uuid": "a2096f75-ef21-4171-ad92-6a3c2d49fb58", "comment": "Malware payload (AgentTesla)", "value": "a8b9ba1cd064547c578d439136683fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868028, "uuid": "32f1c393-ea53-4a86-ace4-8ca0b671187a", "comment": "Malware payload (AgentTesla)", "value": "062b9649bd4f018282a23a04defccc37afa202f19434be6f44f5651f962ee079", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868028, "uuid": "52a1ee19-fc02-4ffa-b7ba-8e998f834272", "comment": "Malware payload (AgentTesla)", "value": "8be8f70912a84c17334e18a6609a3e1e65808051", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868028, "uuid": "a8e79aa9-0fac-46b8-b495-c8c9dc66baac", "comment": "Malware payload (AgentTesla)", "value": "c9ea65723179875284b24a53c5037f896aaaede85213629e583f0691ad533493a5c3ba290a5dbf6430a0672d3908ee4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868028, "uuid": "67a4b106-f760-41f6-ae34-14f5ba4f41b5", "value": "T13C55F21189C43FE9CFEC5A1C90FE1A0E53E10A8E941A758AFB337E46BFA764412171D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868028, "uuid": "eceeef26-ce36-4ab0-9e36-34d9285c0bd0", "value": "24576:2hpCwuiuyMtLLP8qhpnK/14P8NgxQGqiF9cYxi/97DYM/Lt:Sk9pnroGq6ihlLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868028, "uuid": "5ca7c63f-add0-456f-914f-2b23117032a1", "value": 1380150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868028, "uuid": "4d4d374d-ac9a-40d4-bf72-d4e538a027a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868028, "uuid": "21e87ea3-9b08-42bb-a2c6-679a5ad9e9ee", "value": "Invoice No. 9296.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c39885-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853896, "uuid": "b8dd8ead-4047-43fa-b19e-65f19441ff87", "comment": "Malware payload (Mirai)", "value": "d49a1521655b899a89723d617578fcda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853896, "uuid": "8c73b2c9-f9e2-490c-9cc8-17678f3e6ce6", "comment": "Malware payload (Mirai)", "value": "06349156d85a3a8577ac8cfd03c84ae468b5b0be477fafdeb7ce7892a55ddd29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853896, "uuid": "74451059-cb27-4887-ae3e-5871907dd812", "comment": "Malware payload (Mirai)", "value": "74171c5df5bdeccf16f949796d983f13ccb74941", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853896, "uuid": "5148b3d8-b264-493b-87fa-0ec154304578", "comment": "Malware payload (Mirai)", "value": "2ca8ddcefea3bb6301015103397ba773352b9e0101be5298c17510f6471534055201bcfa84163128b392b14b3c99f4d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853896, "uuid": "36b0cc2b-b727-46f4-a140-d7469069b6bc", "value": "T199430273CCF48C09F26606B70536FAD5D1C2D4AE1AB804B63B5039E51AED9B46922BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853896, "uuid": "ef78cad5-bdc1-4b08-a493-23cd1a65d8fd", "value": "1536:6UaADD5K5ZZwFQesZBE+a3MrucFjZSPOvdoCQd4oZGclNU7D5nnouy8HyY:jtlK5Zi/sFCLQjZSPOvdoCQq6NU7D5n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853896, "uuid": "71519b1c-cfc6-4b18-9234-c0718377d813", "value": 59972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853896, "uuid": "2ccbb335-c553-4db4-a609-1ec3b4714bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853896, "uuid": "0bb9558c-da8b-4312-b900-0b8a55b10bd2", "value": "kurayami.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e7d734-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830578, "uuid": "a57bff40-cd39-4828-b305-f301395b6e15", "comment": "Malware payload (Mirai)", "value": "dfbd646fcbbefb02c85b5a34060c689d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830578, "uuid": "3f34156d-e122-4bc4-9918-db5dde942aa2", "comment": "Malware payload (Mirai)", "value": "0851e9b902d9fe7182e068be33e6136850bf0b77bbe4ebe25b756e8cd5e1b100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830578, "uuid": "b09fc383-b2bc-4747-b47a-28e31304c279", "comment": "Malware payload (Mirai)", "value": "03a5150641ead875b6871d4d043d00cb379fa082", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830578, "uuid": "9cd897e4-bdc9-4236-8d80-8760dd31b55c", "comment": "Malware payload (Mirai)", "value": "1abfdff19d08c3a9ba3ddaa538c567e25b862699a56569f85ff686c6055336d2efa0d9146de9b7c906191237f4646a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830578, "uuid": "dfe9f5b3-c1c5-4fb1-914b-4fb2b10e3677", "value": "T13AB3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830578, "uuid": "c9a3c1eb-34b4-483c-b0f0-0ec0fb6c7bad", "value": "1536:qEkWiTLiZECcpHOWWJDmjn5Pd1Oe4nfHLk1bgxur+E7OTeVutW/HeAB0901F6C:Yni50po8+/w1bggT7OTeEtW/c01F6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830578, "uuid": "fac453d5-81f5-4074-97d2-3d75199a893b", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830578, "uuid": "6f35b7d5-4fa1-4970-bc4c-b706532b68e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830578, "uuid": "0f8dd45e-869d-4a44-8c3b-2579897a8431", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3a4686-2bed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774843601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843601, "uuid": "bb05cde6-ecb9-471e-87a4-89513f1664a4", "comment": "Malware payload (Mirai)", "value": "72a5b4ee86ab80906271a538cad53b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843601, "uuid": "ac55acef-66e0-45fe-9b13-d0ecaef8604f", "comment": "Malware payload (Mirai)", "value": "09aa60962df24d5047317489edc680baf32469a3cafa528803391434f00b15f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843601, "uuid": "37a7c22f-4ca4-44ee-806e-05afb393c0c9", "comment": "Malware payload (Mirai)", "value": "c8280bade3e407c29be995370023283178582b6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843601, "uuid": "47ef0c9a-cb04-4a30-84ce-0ae9e1b22403", "comment": "Malware payload (Mirai)", "value": "ee88ed74cfd07119fbce8200c982ac02cd22af047e03e787a1b8fe9ce842214f58ee0be6d66ec4c7d84b4bde0b15c724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843601, "uuid": "3caa53b3-6ee3-4f1d-9894-f34920eed696", "value": "T137065A62BC90CA62CBC0A6BAF75E829C73135B75D2DF71068D14473437EB95A0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843601, "uuid": "f85680ab-e202-45b6-b651-cb2c501eadb3", "value": "49152:UPcr6YomgvtBnrUu3gTnoSVz4q2NvjJzQkbDZUtc++/jc3qSPn3:UUr6YlgvPrUu3yosUxJzQ8qtc7I3qo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774843601, "uuid": "a96e9b7b-21f2-43de-9079-dd2015ca848d", "value": 3994916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774843601, "uuid": "3309ef92-7fe7-4b2e-93ee-76880619eb9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843601, "uuid": "a1c5ccfe-b743-41e4-a5dd-f48429300610", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00d69f6-2be8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774841354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841354, "uuid": "6d8ca87c-37fb-467f-b38b-49b666fc93b7", "comment": "Malware payload (Mirai)", "value": "1833e5a4d0cf705b62ebaddb52275805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841354, "uuid": "c2e28c65-5a2a-41ad-b322-658cdad564f8", "comment": "Malware payload (Mirai)", "value": "0add5328d3c88ceeed171893e545f0bcf8ac7eb7ec4580eacaf57a29f59087e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841354, "uuid": "1fd3c19f-94f8-4123-9996-3e14988061f9", "comment": "Malware payload (Mirai)", "value": "864afe0a6f4b8c812a54821ecca1b02997df0fd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841354, "uuid": "cd0625c4-06bf-4624-84f0-9fdbcb275be5", "comment": "Malware payload (Mirai)", "value": "002552195db590017a76f10da4691e13252602a3dc71f0b01a77fd31de44a6bbffaa57fc57f973ff051f94739937588e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841354, "uuid": "e5d0ba71-6f5a-4ae4-a107-ef043db64a8c", "value": "T15D363B02AF449EF7D8EBCD315A3DC383049DAC97618C66267D7CCA5C7AA650B1E834D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841354, "uuid": "22b86498-6ed4-4c19-a525-2325ffeed7cf", "value": "98304:c/tCsG4KeZwtsTYtRL9nMxJ24EerhtbFZLF8Ed8o/tvai:c1MVyleerhvHJd8KBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774841354, "uuid": "372ab10e-ba60-4f42-a930-4258e72f24d1", "value": 5340792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774841354, "uuid": "cdbc26aa-63c9-42e6-a563-cb5d70a9076c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841354, "uuid": "ffebb34c-ade3-493b-91cc-fa0066618310", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da661982-2c08-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774855196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855196, "uuid": "f30c00b9-72bb-4c80-a759-6bac098e4be4", "comment": "Malware payload (Mirai)", "value": "c350e47feb7174a77331b51a41a35d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855196, "uuid": "3300deb5-0616-4b61-87d0-5d8345a4a173", "comment": "Malware payload (Mirai)", "value": "0eaeefe0fa7a28abcd93528f78b843cd2cf35812442c1d939d6405f09b2d35fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855196, "uuid": "d90cbb93-2d58-4d74-8d8d-28d92d22e5e3", "comment": "Malware payload (Mirai)", "value": "8c9f1934b088a57100328e17cbd4e9d79a611cc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855196, "uuid": "e890da8f-c115-4434-b63c-9a5cd384342d", "comment": "Malware payload (Mirai)", "value": "9e1ecbf2b07b82a88a77634c2bd0e3fc3632949730175214aff0e8e29962854b90f3d7a9ea02958f491ca213b9c8f5cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855196, "uuid": "abd5681f-7e2e-45c2-ba3a-d5b68b5d7195", "value": "T134534C51FC819A12C6D4127BFF5E428D772B1768E2EE3207DE266F21738781B0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855196, "uuid": "ba715b37-f60a-4096-b5b7-f090befb30d4", "value": "1536:oaOZ8+U55C03LyIPZi+5kVhu1HSwOdFnkMJJoN:XOZEvPQ+5kVhY5Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855196, "uuid": "f859c492-431e-427a-a497-1a114a6b5f22", "value": 63712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855196, "uuid": "782bc971-0687-4a89-8a75-c907301c06cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855196, "uuid": "b5a52cf1-867e-45c6-a08b-e8bd3abfd6a2", "value": "arm5k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7533bc32-2c3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774877789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877789, "uuid": "b792e6c2-f87d-4efc-9ecd-2dc511176fb2", "comment": "Malware payload", "value": "6b6da94ad95b375727cfc2e2f1583164", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877789, "uuid": "70071f72-024f-4e95-8858-c15e85793970", "comment": "Malware payload", "value": "0f00c411430e2bc93bd4949653c29efa305ea75f7071f43cae050672095f0dce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877789, "uuid": "08768ead-8b43-4b52-a0b0-460cbd4d7389", "comment": "Malware payload", "value": "f4c93e8f9191b80875f0bc66437a184f092ef3d3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877789, "uuid": "bab74391-820e-4d20-bcba-f79c2a299d49", "comment": "Malware payload", "value": "20cac821548233b2206820aa3a8acd85b0ce9ee27ff17b115c3d917625004889c043d78c8eff5af3ce508c47c24af598", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877789, "uuid": "494f8cc4-0e39-44d0-93e1-1fb3c519e724", "value": "T185212C8E2221E1B8E57935FC88F1CE11967A6CD4D08A28131FCD4CAEE171239DF0AAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877789, "uuid": "0eca1fab-c20b-4751-82a6-996a51e43d9b", "value": "24:GAsOMAs2ubmqywfex7P0SG5AI9O9lAsQF:l/ubvyZ/Glc9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774877789, "uuid": "1f3be12f-2001-43a7-812c-08770ef3f81d", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774877789, "uuid": "3a7ef5bc-0b8f-4fbe-a124-52ed81490e5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877789, "uuid": "966b8b1e-168b-42aa-9ca8-8c58ca89a40c", "value": "ZoomWorkplaceDesktopClientAutoUpdate_7.0.0_33767_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8749fc4a-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830575, "uuid": "192641e5-8592-4a8c-a980-b22d162eb25a", "comment": "Malware payload (Mirai)", "value": "3247cbb01fd2f6abe82bd9ab2078690f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830575, "uuid": "5fb78487-8611-4139-945f-bae00930df6d", "comment": "Malware payload (Mirai)", "value": "10a6e578e740603e7454ac3fc19987b67bef1f200c9b7853037472a950131591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830575, "uuid": "ddc1ee02-caa8-41c0-997c-3b53771c4bba", "comment": "Malware payload (Mirai)", "value": "b612f128af6a6864c72ada86e53705cb108587bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830575, "uuid": "3a80420a-c894-4835-8bf6-7865d763311d", "comment": "Malware payload (Mirai)", "value": "d6bcde40a8f43fd96325d727ac792afe0261780480572fe4334a0ef86553d6c912f1bf5b746eab35374834bea2061aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830575, "uuid": "41113178-61c7-41cd-8b92-ddd24ed21f7d", "value": "T1CC834A02B3480D43D1A71EF02A3F37E593AFD59121F4FA89650E9B4A41B5EF2254AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830575, "uuid": "eac17a85-fa3d-4e2f-82ae-8e1a88cf9b8b", "value": "1536:P1C0/rWu3QezqNZxpsOKFC+Qma+4a619tHNp:P1C0L3fqJeF4mn6xNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830575, "uuid": "baeb9398-37fc-48c1-a85a-4dbb60678ffa", "value": 87744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830575, "uuid": "035f7c70-0a80-4269-8659-4b929ddbbf3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830575, "uuid": "f0400557-8657-41c0-8beb-a91b1a593d58", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f374fe-2c1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774863805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863805, "uuid": "96c57bdf-294f-4ac5-ad06-d9d9dd8b01b9", "comment": "Malware payload", "value": "448014732825b5af6d032c6e8dc9f965", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863805, "uuid": "4382f39f-ed9f-4a81-ae15-fd5cfedf84c8", "comment": "Malware payload", "value": "11b7a18b617876c34d98a8ec362f6a08c3e7308b5e7c6d792d4c417e55ce3814", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863805, "uuid": "b06f42e3-a433-4349-8d88-637c53780a72", "comment": "Malware payload", "value": "fa784d3a018dc4e25c2e3afcf4e22ad5306dc516", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863805, "uuid": "7a25f92d-43a9-41ca-81a9-4b2079ff1bbc", "comment": "Malware payload", "value": "08e121f33c39b26def9101577074e6d9a46d4335412637b33af8f5486af497bde6eecd87a8a124bcc14c6e64d535cfda", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863805, "uuid": "584be4bc-74ca-4ede-84d4-641afef8524b", "value": "T181E57C117697C136C57E45712968EB6AD0BE3F691F7448EB27E85A6F0EB1CC20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863805, "uuid": "12d19ff2-06fe-4460-8de6-2ffa2f5ea9dd", "value": "49152:nBLYHGlV9MftgktANVqVZ9Rw4YP/BD/vTTPduTRUhfwEdB6zDojOwfFl8pqLOSGd:5YIHSAbqIPdLBqwYpqLNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774863805, "uuid": "4c6097d7-f7b0-4572-837f-565c8a80d15c", "value": 3091968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774863805, "uuid": "bf55e443-ecba-4f56-89cd-5b037f728cc6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863805, "uuid": "2334a5bc-85a4-4d0d-9e55-fcdbdf510af2", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6585a6-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867946, "uuid": "e3706ef9-ac13-4ea5-8d62-6484284aea84", "comment": "Malware payload", "value": "4ee8a752c01470700deb5c44ff1f4550", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867946, "uuid": "700d3ae1-0a6a-478e-8b52-86711821fb39", "comment": "Malware payload", "value": "11ea9f4c0e001889bd2f0f4068af6415850d93274ad00fb388607c96244e6255", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867946, "uuid": "5754643d-211f-4ef3-8c45-12473fd69f87", "comment": "Malware payload", "value": "67da7d2f4bb2acf8378f2a31865cc4a8e39f262c", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867946, "uuid": "ce12e6d3-4ab2-4a27-b20f-7af499e91777", "comment": "Malware payload", "value": "f205cafe9246d833f8208e881929cad64038edb1c05cc8a0853503f8975f2423430f7e5d8f3b077c600b1299140d4b65", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867946, "uuid": "dc92fa81-6615-49b9-8416-a1ba6e6b4dbc", "value": "T113043D5F93D9022608B3A20AD44E9569EB18C03C4362D328BD9C926D136F5BDA77F5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867946, "uuid": "3bfc79f8-9d06-4644-a100-9c6aea7fbb10", "value": "3072:Q2tMG/h8ZIa7hFB9kzDAJ/hfSPV/ZYLAYaaaF9IhUAvWbe:QsMGwp9AAY/SkzjAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867946, "uuid": "fa930560-ed23-4b72-a230-737178f87e76", "value": 188097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867946, "uuid": "e88b5c1a-61ac-4719-81ca-e58864dbab8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867946, "uuid": "713e3644-71ab-4587-ac08-caaa46f39dd1", "value": "mservice (5).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1999261e-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912425, "uuid": "87172c52-1f42-4c7c-b04b-ae4d6610461b", "comment": "Malware payload (Mirai)", "value": "0f715390ea658ceb87f29aabff167e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912425, "uuid": "1597305f-b28d-4c92-9cea-295ed068ee73", "comment": "Malware payload (Mirai)", "value": "12bad2f53d559715b93055ddcc760356e5d190dcbf9c0756d1ec46eecbfdf179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912425, "uuid": "74d5fc94-25a2-4cd3-83fe-f6a7840b5237", "comment": "Malware payload (Mirai)", "value": "a0e8515fee4ee7e4478adbf2f434c640648028a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912425, "uuid": "af479799-141c-4c03-8eaa-4c2ebe81a039", "comment": "Malware payload (Mirai)", "value": "b2b5102aebd97ed86933bb2b009f93a6d96692f8a2c53cf42fd7a3750bd9a58c435a0d9fa755d42697ff1c00018e4b77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912425, "uuid": "5d12029b-ce75-4402-970f-0a3c4a7409b5", "value": "T13103AE53C93A2D94C62985B4F8219B3E1B53E945E6936FD6D826C274C403F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912425, "uuid": "66281a2e-ccdb-4031-baa4-ffcd80c197c6", "value": "768:AUcaeds3+AuYK6yXPl3uDxmvkR9AKblZ3ay3VJ5ewoUJGJrfUvC5YAqP6:ADDdsOAYlv2AKquC/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912425, "uuid": "6a567691-a970-4b66-b8e7-03fc42dd36fa", "value": 39904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912425, "uuid": "15dd6fff-7441-4014-a79f-8c4ae2c7d0be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912425, "uuid": "34f3db73-cde8-484f-890b-63caf6ec61cb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b762565-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830528, "uuid": "228791e4-0fcb-44cc-a1a6-48704982c9a8", "comment": "Malware payload (Mirai)", "value": "6dfc7fff6eb8303ebec27a2d5fe9b720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830528, "uuid": "2ce1a100-8c3b-448b-baba-6bf9cfe4a921", "comment": "Malware payload (Mirai)", "value": "12c1e3598ad05e4d26c854e83088746c74851a2b06ea69af8d9c5c2f3d4a5e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830528, "uuid": "e8d83e54-3abf-4eff-8410-88b8c0a8abe7", "comment": "Malware payload (Mirai)", "value": "391e3e29bb004f590d6ad80c3a9eb9120789848d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830528, "uuid": "90b26b24-fcad-426c-9f96-19592c4cd22b", "comment": "Malware payload (Mirai)", "value": "c071e2a0625078ae094c1e312705797aa6706a7562f6d69f5bde830c06e53d54d7b60e4a0e33e4c4def27fb35276988d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830528, "uuid": "68858436-f315-4289-b9d3-e68743ad6ebf", "value": "T10C73AE23C8A61998D25C42B8B170FE3A5763E45056536FF7059BCA7AA047EDCF8093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830528, "uuid": "52a5f359-6c67-4a66-bba8-c9ae1f757a1e", "value": "1536:U/G/lVA7lvz4CXKLKIJjL74QN/VQC9yUxdM7Z:Ue9VUx4CXKuI1J/VQ9OS7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830528, "uuid": "fe1ce5ac-be87-4960-bab1-871d2f8c014f", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830528, "uuid": "261f0bbc-9703-44bb-affd-d706ec641e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830528, "uuid": "8c3588e1-406d-4263-a25a-7f86b0061b32", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5634bbe-2c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774904552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904552, "uuid": "5e82e6f3-0e3e-481a-a2c4-0219f9132cf4", "comment": "Malware payload", "value": "a64a395fa9975aedb178a4f77f43f2a0", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904552, "uuid": "26bdc557-746e-4aa9-a839-ef4e36d4fdc5", "comment": "Malware payload", "value": "134698c1813ea65f44fae6429060cb0d859ca10ad33cdba71334bcfb282b90c6", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904552, "uuid": "7112ccd8-c1be-4600-a66d-e0dfcac36397", "comment": "Malware payload", "value": "db177fc843f2e1847fa81fff3e37ea891b7e2f56", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904552, "uuid": "1dcfbe6f-13fc-4b03-9fdc-03bc2c80fbf1", "comment": "Malware payload", "value": "2a1c955069e83eb0ce07dde7f8a52cc87d0eca5eba304ef7e1985939f8bfc120429a1aa0dbb52d624c072a3853d7945e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904552, "uuid": "873b1a26-87d9-4ae9-a219-86de4e0b3e0e", "value": "T1FF26236A5031F0A5C560086BB88C8D20E282D5F965087F34515B47B63FFDBEA6FF960E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904552, "uuid": "85c2d3f9-f38e-4826-b6b0-4ad0b8218c31", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904552, "uuid": "988326a5-f3d8-49be-85c8-4a1e23e3b364", "value": "49152:jNYLGrIPQ3IjiXaT/z4nzHGQ3tKHITqluNa7UGERQU9yJIiVKSdE+mgil2YjlJv8:jf00aT/8HZ3Ep7U/h5WppiQYx6PBHAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774904552, "uuid": "183943f4-42ce-4ac0-97fb-b104300cdd21", "value": 4473344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774904552, "uuid": "d8c18554-90fa-440d-ac97-5869712769ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904552, "uuid": "ae905c07-3398-42a2-931a-226c0dae6380", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d73a9c7-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853214, "uuid": "267732af-7ab4-402d-9be4-3825b5585581", "comment": "Malware payload", "value": "356810798ece6997097caa04727d275d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853214, "uuid": "954ca42e-f603-41e4-a824-a320bdaf39cc", "comment": "Malware payload", "value": "16297d34f3fe4f6b36e7ad8d26d752127bfc9171c932d8f1ca30c736752a8136", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853214, "uuid": "d3ef8c78-2fe7-49de-a780-bd4d82d3872f", "comment": "Malware payload", "value": "b1ac1edfd435bffcd88e96f95792e598e871c002", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853214, "uuid": "5b311b83-6eff-4bcd-a694-46629a3ba21e", "comment": "Malware payload", "value": "70ed53f91a91676da7d729f2a50355a2a1e0d099fa2e71382f7c7eced6d60760519ef1889fbee9f0e8d37008782c2c6f", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853214, "uuid": "48d41e41-30df-4618-86b7-95b05d31db4a", "value": "T1C644027B09C6BD7ED82D0AF7952374F0B24A4D4649B4B5B19A030BCE8D9E84C02569FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853214, "uuid": "503df73c-560c-47d1-899a-5e4dae3537aa", "value": "6144:YbHxktl5lNXlEMsBkUK1pownvPo1zQGKaN1CEuQq:YNktl/NXlQBkUK1DvgdQ61CEuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853214, "uuid": "37364adf-20cc-4c04-9855-56cdfe6152d3", "value": 278385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853214, "uuid": "dcc28f44-013c-47eb-a35a-fc5e5253b8e6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853214, "uuid": "fc678746-7689-45a3-83e7-0acf595ad246", "value": "Order No-25012232025-26.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80e5da3-2bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774850011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850011, "uuid": "a85ced07-af8c-4f0e-9c31-e4f3c271aa16", "comment": "Malware payload (Formbook)", "value": "81be3f57411980cfa40623fe8cfce3c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850011, "uuid": "7a3018c5-abc2-4b49-8908-06bdef28fda0", "comment": "Malware payload (Formbook)", "value": "16c285b302e9e57d77863f6449d946f5ad67056d61226bee7d36f673959fa6aa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850011, "uuid": "3dee26e5-06fd-4a90-8165-7179541a7760", "comment": "Malware payload (Formbook)", "value": "2e19d18042d5f65a4aa6758910dab848a1d38ebd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850011, "uuid": "57720ad2-2ed1-4a1b-9655-87d3d9fd7f72", "comment": "Malware payload (Formbook)", "value": "6ba41f9176ab7006f24fd3c5d264a32a58cd38ea3d989fec5e12d059db7440d723988b5405c73dfc8e03086fd05148e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850011, "uuid": "fde127a7-aa2e-4119-b284-063d2df9bbc2", "value": "T1CA6533201011AB9BD3910AB0F46FB95C7113C2AAC1B8F7CD9991FFA614429FA70DD1FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850011, "uuid": "7a808f35-008d-4c63-9c72-dcb54b56d957", "value": "24576:GoP0ecPQ7LzAu2ThXFF5FlmKAAUkxh69MFc1Pi8WE4GoB5CvKgzDo76O8+cavUy:LDc4DAu2l/QAjI51PzoB52DoOScavUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774850011, "uuid": "d470c094-592e-4bde-baaf-341ef9a1a479", "value": 1446217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774850011, "uuid": "bc018c6d-5407-4c89-8448-f9ae6335ae86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850011, "uuid": "ef976805-079d-49a2-a641-b601574fb684", "value": "TP495909060066.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ccf493-2c8d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774912172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912172, "uuid": "c4646258-50a8-40a9-bf54-89f1dde5ac2f", "comment": "Malware payload (SalatStealer)", "value": "6c067a0542b207d63a6923547271f6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912172, "uuid": "77cf9287-ff74-4e3d-b080-40e1f794fe30", "comment": "Malware payload (SalatStealer)", "value": "16d78af06824bad0628cc7fdd2d3486e4eb0f17964a758351b4f3b088e065205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912172, "uuid": "a63dbdb2-4075-4b4d-ae94-30127677836c", "comment": "Malware payload (SalatStealer)", "value": "75a2bee01cad4db4881373dfbd131b79774b0c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912172, "uuid": "08fe6725-8cc4-48a5-b77f-bbc567ad2731", "comment": "Malware payload (SalatStealer)", "value": "0fa3123fddef47bb1b7173774f56ce2bebbafa51bd95321844612bbc36f67ab0f2d7081978859cd63a3675bff9b8911b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912172, "uuid": "0fce9487-f833-421c-a218-9b540e91e780", "value": "T13FF533784580278AE8EFE7321F4C48BE51C6D9925230DB96BB565D4C17B36C2F8FD282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912172, "uuid": "ec9ba6aa-8439-4d7a-b79f-dbb79c91e885", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912172, "uuid": "9a6e06d4-776e-4e4e-a49a-9f3d1ab53a8c", "value": "98304:9NT58nOHynPrDTD08jP2q5k6miHgRQzBuUj74WXA:9D8Iyf08jP2mkZQzB7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912172, "uuid": "e759d273-5544-4b60-8983-ff63e53b4acb", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912172, "uuid": "50beb171-adde-43f0-9d88-f3977f12f21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912172, "uuid": "4bb756c0-4016-42a2-b64e-48a698d9ba82", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787ad741-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774883808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883808, "uuid": "3be7b40a-8472-4d0a-a783-9559c896e4f9", "comment": "Malware payload (RemcosRAT)", "value": "a60e0fdb7398deca538404691d70e53d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883808, "uuid": "0a45a876-7835-498a-b4f7-4ea08a1f3b99", "comment": "Malware payload (RemcosRAT)", "value": "170852ad01f40abf3922f8520fa170a5965038fa28f0b1878c1cbae4b7424f05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883808, "uuid": "1009f58e-1cf7-4c21-ab0a-9f63f8b4a150", "comment": "Malware payload (RemcosRAT)", "value": "e0d1c9a2b41452d5bc1bd4670a043ad2db0d7f6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883808, "uuid": "1b846121-978c-49b7-90f4-b93dd450c3e6", "comment": "Malware payload (RemcosRAT)", "value": "4124698fb6eba611e6bc81ecf80760edf07c57ab226068298a8aa85b213df1f3fd0dca3a490711a21c002b7f07f2655b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883808, "uuid": "8deaea64-cea2-48a5-beba-a80ec0830d7f", "value": "T16F15BF017C80D031DBAA21B15E3EFBBD4A6DA4300B6865DB67DC35BA9F605C16F32687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883808, "uuid": "3c38ab39-7367-4ef1-aed9-524f3f10752e", "value": "b492aabfbf2837593f4568452d907063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883808, "uuid": "bd8797d1-f3d1-4e19-b20f-25750cc18603", "value": "24576:YbMfnb0NmPKiOaWF14DRF40j30SnOV3o90WcLvAm3I:iMfnb0NmPKiOaWF14DRFMSnOV3Wc1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883808, "uuid": "ffc6f249-e805-4236-9ec0-65053ecc240d", "value": 940856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883808, "uuid": "9dc81c10-117e-4837-8b7c-3f40649a24b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883808, "uuid": "e14aa73b-d856-4151-9a89-751bb958eca9", "value": "170852ad01f40abf3922f8520fa170a5965038fa28f0b1878c1cbae4b7424f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a78f8a-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853897, "uuid": "4f859905-b44c-4b3c-979d-65dbf6a9938b", "comment": "Malware payload (Mirai)", "value": "feee94c02c339d9480ab2f6502a7987d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853897, "uuid": "a4a67934-8a1d-45b8-aa7f-b011a9047ad9", "comment": "Malware payload (Mirai)", "value": "1721839af55e4fe4e24b9e54dff63fb2ba371944be41f6341b916a65a277c9c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853897, "uuid": "4a59c50b-7675-4748-a3a3-a0b43b3b093e", "comment": "Malware payload (Mirai)", "value": "ccf0e11c7139477afafe1721e0127a77b3d6a797", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853897, "uuid": "c1af15f5-53f0-4987-952f-452dc447d791", "comment": "Malware payload (Mirai)", "value": "ef9bc39862685c80fe89ada620ce069ddbfe400d1d92f97815291db777dcffcfd2d05d08c7f54dff04cd43de0bc3b23c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853897, "uuid": "8fa0e24f-4332-482e-b9ea-8293acf9735e", "value": "T159F39D33C9A5AE98C6649474E0B1FE795B539A0641871FBB1AA7CBB54043DCCFE043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853897, "uuid": "7f503764-10b8-4014-89a4-b7072c3640a9", "value": "3072:nJqn73FvDaOmynee0PI71NGH19rVCUQLhQhWjEKpGh3:nJG5aXeEH19M1QsjvGh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853897, "uuid": "622c1c73-2d01-410d-97f1-ef2883e92d7d", "value": 164704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853897, "uuid": "69064ead-1207-4eda-8d44-dddea523bd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853897, "uuid": "cdc7a4dc-75a2-459a-88c9-d39c3f130a75", "value": "kurayami.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d9d2fe-2c87-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909404, "uuid": "a599ee38-2b3e-4a16-b2d6-442f0c919be6", "comment": "Malware payload (Mirai)", "value": "04da8fc3eebe080ea6bea6d5c34e64cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909404, "uuid": "195d3574-af2a-401c-bbf9-486952645818", "comment": "Malware payload (Mirai)", "value": "173e45840734e04d5f4db67166ff15d00ff638b374d8f67177de690321273f6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909404, "uuid": "1ed8ba1a-792f-4979-8b0a-01207576b653", "comment": "Malware payload (Mirai)", "value": "0cae6e547d29fd5b9d9ad82ee1e7c723ecb24ad1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909404, "uuid": "3a4b5e4c-53d4-4869-bf83-197c2def3e4c", "comment": "Malware payload (Mirai)", "value": "882a0b78a8f133040e4f956c42058e7f9c49e17f484ad3d8c1a10e4473b39a789a5084f41e2b50d19cd2742bfb89bf77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909404, "uuid": "3a96bac6-f01b-406d-8cb9-0980cc618e70", "value": "T1897312ED7430CBAFF33BB9D92E4E40DB184972B29D7E4980131A6582F591951428FE7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909404, "uuid": "c9659bbe-3f3e-4af6-b9dc-2cdf0bf168d3", "value": "1536:5p8OvrMdWuvmOc/h9PHWk8XCcs5A+Pn54YHk7rPy:5p8OvrMdxvmbdHW1Hs645ForPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909404, "uuid": "a08c8561-cafd-45e4-b3f2-51d2971bb3c5", "value": 75400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909404, "uuid": "bacc7c30-551f-41d2-827a-ad6c6b16c99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909404, "uuid": "4d20d5b0-f2e8-44ac-bcf4-fe4c6d0feaca", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a410cf37-2c8d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774912227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912227, "uuid": "c9847770-9ed1-4afe-b3eb-4fb535521b64", "comment": "Malware payload (SalatStealer)", "value": "15063b12000aab0b79cd11e737c3a151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912227, "uuid": "89823857-8b65-4b04-bb6d-924d0e29b777", "comment": "Malware payload (SalatStealer)", "value": "1afc8097bd7d9268602e2953ed58cea4487b2760af35d3d429703495bff0a5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912227, "uuid": "84d0f226-3a41-4eec-8b6a-03c31d49c33e", "comment": "Malware payload (SalatStealer)", "value": "d477c7221dfde9c4f959661524cd9d3715046ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912227, "uuid": "a58d63ab-7ac4-4584-82fb-d889daef27d0", "comment": "Malware payload (SalatStealer)", "value": "84e416f213d9f69052a2708956ca893d381e0940a0dd6616af1236c5683bfa4888f6650002b3fb67d425ee1ab4456af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912227, "uuid": "87f60550-82c7-47d2-92e0-0f9e1b8e04fc", "value": "T104C66C11FACB54F5E903583140ABB27F23315D048B28CBDBEB187B6AF87B6A11976705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912227, "uuid": "70303ffb-5c32-408c-b170-546ecfe34eb9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912227, "uuid": "cdc411fa-d1c8-4d2f-a604-dd9c5d48b973", "value": "98304:/jK5vmga1bS1ir22NehKS1Cx453HVdBETO/:7gLE2YDlxSgTO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912227, "uuid": "f9a66dd2-aab2-45f5-978f-10b31c039934", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912227, "uuid": "c59e8d9a-aa4f-487d-ba6f-45ea5dce15af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912227, "uuid": "e9790ca4-fd97-4ef0-ba5b-579106e1d95b", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31efb017-2c3e-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774878106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878106, "uuid": "fd06dd3d-2fe1-48b0-852f-dc940f217e67", "comment": "Malware payload (WallStealer)", "value": "29681cbcb2c75e10d8e392ee9b44d6d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878106, "uuid": "d4385188-ca7b-45d4-94cf-ca74371b1cab", "comment": "Malware payload (WallStealer)", "value": "1b5e293b8a284ddd3cbb6949adb8d1709337d6d4a129159d9aa4d04448506f6c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878106, "uuid": "5e82dfbb-462f-47fe-93c9-436b496eaf0e", "comment": "Malware payload (WallStealer)", "value": "dd45d9e19c5947b4467a55d472bc478db7b5308f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878106, "uuid": "ca42006f-7e8b-4d3c-91d1-4c1214968cc1", "comment": "Malware payload (WallStealer)", "value": "dcb1101fe27b858db8931f22fdf143fcf7c2262090f6814103b3ae84f7e3cd9388401c852cd979423f9a64be1487ef15", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878106, "uuid": "bea3b343-143a-44f1-8543-a094191a09d3", "value": "T1EF06CF56BCE518FAE05A533289E3166237B0FC991B3123D31E50B6793F7AAE06D76310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878106, "uuid": "6b6424c7-cefd-4e28-a14e-74ed9d52e4a9", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878106, "uuid": "95fc466e-9c13-4be6-bd17-84bfdc48dd7d", "value": "98304:C2O4xX5L+9dsqQfW+VkV7dn/lpmmWAhj7eTNVpBf8149qrd5:CSx5LKdsFW+i3/bBZKTNF81+qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774878106, "uuid": "52391372-822e-40f1-a254-f7da7fb5cef1", "value": 3969152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774878106, "uuid": "b238efe3-c240-4c89-9b81-53953b15529c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878106, "uuid": "ca52cac7-b847-40f0-ad10-fcb4c733aba4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c3c93d-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774891633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891633, "uuid": "ce3da5f6-bd8c-4b10-898d-411cec6e47cd", "comment": "Malware payload (AsyncRAT)", "value": "5034d15db285278d64c9cd4447ec48a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891633, "uuid": "db154028-ab15-4ae2-9e5f-ddbdc6f03241", "comment": "Malware payload (AsyncRAT)", "value": "1c67a716387ec64bc9fc591313f2e76d9bac2f106d0549c85fc9d7fc4820e739", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891633, "uuid": "4bc29d0c-d786-4318-8c03-1ed66b8c0168", "comment": "Malware payload (AsyncRAT)", "value": "82d5cca3b16e3362003964e12bb7f52deef1c22d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891633, "uuid": "df0d7184-c669-4ee1-b825-7a9376f5a83f", "comment": "Malware payload (AsyncRAT)", "value": "b3a1bfad30a989efb213e39a636f94b80a3b9497a635a5ce44a3bf4676bb79bf111d1fcf038003cea17ee739cf700273", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891633, "uuid": "29c97b5e-20bb-4b36-a454-e10c2ad67d24", "value": "T199F23C087BD44226DAFD6BF169B371020674E603D913EB9D0CE859EB6F277C08D153AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891633, "uuid": "92362dd8-8663-4d9f-920c-5942754b90ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891633, "uuid": "bbddbfa2-3202-4bdd-8640-715030b6c221", "value": "768:oQ2A5Unv1+tybbH/UASLKygbFf9Yf/pOMh+3fPu:h2A5Unv1+oHHMVKyoFf9YfhOMkHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891633, "uuid": "88214b98-815d-41e8-88bc-0fe37618da35", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891633, "uuid": "c026fc67-a390-45c9-b2a0-4b24760f23fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891633, "uuid": "1331c4a9-2319-4529-91f0-612b70e04f18", "value": "DONTRUNMEBRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6d3b7f-2c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774884349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884349, "uuid": "901328c8-8a29-421e-ae8f-05f207ff5e64", "comment": "Malware payload (Vidar)", "value": "b995cc86f57a59c0a45ecc3f0151f43c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884349, "uuid": "c7ffbb58-f0e6-4f03-8466-1f2b7e54e2c2", "comment": "Malware payload (Vidar)", "value": "1d00b4c41ea980355335327a35a51ceb7b0365e2159a3a2826d969f506572185", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884349, "uuid": "ce3dfff4-11aa-484e-a65f-c9611fa97b18", "comment": "Malware payload (Vidar)", "value": "879a8daf6791f255591e7671c5f6d788c5884e02", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884349, "uuid": "bce385e9-afdf-4b0c-b849-68567c0df47c", "comment": "Malware payload (Vidar)", "value": "f50a724c3b1dd5f5c8020334bcaef28becd0dd7b5baf6339b67bf2ddf32dda454072639c9ca0bc0dae2c06f4bb5b81a8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884349, "uuid": "48fecf27-12cf-46bb-b505-83cdb89cfede", "value": "T1AD858D4A7CD144B6D4AA533288B65292BB72FC590B3233D72E50BB783FB2BD06875714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884349, "uuid": "11383bc0-9db8-4c6b-b3da-0fa276d079ea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884349, "uuid": "dcc6ede9-8f92-46ef-8275-912c919a9679", "value": "24576:1OmQFVYf2s04Ffe79BKuLuXhTm8PtkqnxfDst8xMSgGUqG6WcR/46e:1OJFufnc96hTmgtdn1QuVUOp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774884349, "uuid": "138e7976-188a-407c-bbdc-a83d6258a4ad", "value": 1841288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774884349, "uuid": "81a89fb7-c547-4aad-a4e7-861032090ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884349, "uuid": "72d0877a-1931-4181-9d48-e6053e4bd91b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ab19b6-2c01-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774852000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852000, "uuid": "f60aa00e-d28e-4ce1-93e2-12bb556b8ef9", "comment": "Malware payload (NetSupport)", "value": "42608ddc12623ce787c56bc7ab824062", "object_relation": "md5", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "194-113-235-129", "colour": "#85EFBF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852000, "uuid": "71f0f45b-b80b-4991-bfbc-bed7f3097d4c", "comment": "Malware payload (NetSupport)", "value": "1dc7f4fce6fa3e44a7667eba86fc06304ee84316fe9a1baba8fec3eb02681e65", "object_relation": "sha256", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "194-113-235-129", "colour": "#85EFBF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852000, "uuid": "caf80201-612b-4a4e-8fec-ecb41284a7ed", "comment": "Malware payload (NetSupport)", "value": "412bceeeee51519af3ec1f67364f566969bc511e", "object_relation": "sha1", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "194-113-235-129", "colour": "#85EFBF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852000, "uuid": "7ecdc28f-1024-4768-94a8-1f4da12c5847", "comment": "Malware payload (NetSupport)", "value": "d8e01d12d15e59d6fbe92c65c277551d33ee9605ba8e6900d3c11fd81a6cf8a4a1bb61fb1865439e24c0ce2b5b04efa0", "object_relation": "sha3-384", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "194-113-235-129", "colour": "#85EFBF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852000, "uuid": "50e2c4b6-f82a-4df1-8dc3-a4a751337105", "value": "T13BB533CDB64DC57AD53DC171405AAF396FECA8A3E707397343A988DEA80994CA3D0316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852000, "uuid": "b244ea6c-3fc8-4a37-816b-cd31eef5f468", "value": "49152:EnjW0xx1hwCYrp7lnMsn9aezOCpLwZQTmXzSXe0l1Do8mWLawS65:EnqGXhtSXZOWLrTmDSO0l1Dn4o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774852000, "uuid": "0c1594e7-910f-4eb6-a445-e95917cc3b2a", "value": 2295176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774852000, "uuid": "4040a163-da6e-4cf4-a000-cd1e7fa8ca80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852000, "uuid": "f49e4c0c-aa15-4b64-b2bd-121c1ceb9bb5", "value": "1dc7f4fce6fa3e44a7667eba86fc06304ee84316fe9a1baba8fec3eb02681e65.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e016048-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853242, "uuid": "d3f42299-f0cc-4732-9502-42a097b24435", "comment": "Malware payload", "value": "c6d2394d005fd784fd31870a6d7863a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853242, "uuid": "d2bfa874-35e4-4900-9f60-eec7bab5ff7b", "comment": "Malware payload", "value": "1e6e27faa7f8314b2e61745e8e9ba5ae1a7a32666adfbd828b3c8c9a3e57da99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853242, "uuid": "a770e069-073c-4338-adef-7d2771de9024", "comment": "Malware payload", "value": "4ac392676b9bb349e0c5d075676dc899daac3a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853242, "uuid": "dfa0cf97-61db-4844-87b9-e6a4ae28974d", "comment": "Malware payload", "value": "87dd83f1b5fb50043288652ada15e97c1d5d5195fcb29332b74e44c24852479ba904ac7baef3b93a33b0912d504d88e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853242, "uuid": "b4c522bb-52c6-4a82-9ec6-a4075d07a09a", "value": "T10805AF16F5AC41F8D07BD239CA42650BEEB2780907609ADF13E446A92F637F45B7E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853242, "uuid": "cbb637da-924f-4d22-ae6e-593af45ddeb5", "value": "21b6dc9099148fdf429a05eb95e96596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853242, "uuid": "dd3cbcf5-c9f6-4874-be8e-20afe3d4215a", "value": "12288:/KasUs1vvNxkAw/SoEFYSxUyeFolf4azDChFyPtVYiZnhQQwOi:/ZsDLW/3ER+polf4sDCwciZneO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853242, "uuid": "4c7451b1-2a51-4bb8-b30c-3e541239155d", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853242, "uuid": "8a901e47-c004-4c76-9dde-5092501580bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853242, "uuid": "2c85e880-7d1d-4979-9c26-6219ce3fc7a8", "value": "c6d2394d005fd784fd31870a6d7863a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82502ecf-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830566, "uuid": "928bb4dd-a043-461d-99b9-ae123b6a0810", "comment": "Malware payload (Mirai)", "value": "dbadf2b59516b49fcd6d7f3c676feb82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830566, "uuid": "3f10b654-ae73-4d0f-a752-6510bfe75c48", "comment": "Malware payload (Mirai)", "value": "203cd3515a24b4ba1535e11d8009971e8e654115e24c00ed9bc56bcb0d34bee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830566, "uuid": "aa0d729b-c75c-41c0-802b-1acc640bb132", "comment": "Malware payload (Mirai)", "value": "b60d2d763bb8a337f6098afbe6bfa9e8565f62d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830566, "uuid": "dd148441-f143-461b-b93a-af426ce21f55", "comment": "Malware payload (Mirai)", "value": "b5e3e6943acd16f35a71f5ee0eda6aa04f169dcf0431b141b46a8e5b55b2b0fb88de8ee74015d7875e64d0b8323a057a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830566, "uuid": "3517345f-e6f8-4e84-aa79-11aef4e18969", "value": "T15DA32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF3173865AB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830566, "uuid": "22d1ec45-c1dc-4fb2-8393-77875dfd1337", "value": "1536:AAnTSlOO7kf5J7ZLBpqppsGBgyQxJ4s3k77axrtOXrDsRilp+xfVMv7fh5GYW76:yl5bppsJj4qk77ax4p+xfVkbhUL76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830566, "uuid": "286bb373-5b29-43c0-b6cd-4a1241402575", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830566, "uuid": "34b6b767-130f-4890-8356-8aaf4675234d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830566, "uuid": "5a59c630-fd3a-49f5-a9cb-0b9424359172", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86255419-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774853336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853336, "uuid": "93e17538-5482-4a44-b067-8b206fca2781", "comment": "Malware payload (RemcosRAT)", "value": "f81da5bc1ded34716a7678c6d7c66e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853336, "uuid": "a2016c10-8b9d-4d38-9778-3a362cc10357", "comment": "Malware payload (RemcosRAT)", "value": "22fc997ac6c6a621ea50f6c15a124432e9a9e0c2f86bb9a9014b513207cacdf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853336, "uuid": "3ac114ad-8857-4cb7-aa9b-66816a7b417a", "comment": "Malware payload (RemcosRAT)", "value": "25b8b4fd3d436c098e754ac2e7aed9c7bd02f455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853336, "uuid": "7df3762a-769e-4759-a52a-ce508902bdff", "comment": "Malware payload (RemcosRAT)", "value": "c31868b07cf34587c5cede8adf0557429f1b6d52d51562773bcdce75ad25e71260ee03097f4a2d7f0da959cd855058d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853336, "uuid": "0d6e46a0-cff3-4132-83a4-cd3c04071e57", "value": "T10CD40107BF08D8A3C458557098F757618FB99CC1BA98CB533520BF28D9B36F1A52F286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853336, "uuid": "246f0e38-2ad0-4f99-88fb-e34cfa1727ad", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853336, "uuid": "0e49471f-25d0-4e99-922c-42841e2219a7", "value": "12288:AYCANBNkBFhgPZ6BEON6xGp0LCcCewcfh6ztcNtEJzj:JNyhgABEA6ox9eod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853336, "uuid": "90b1dd66-af4f-4bb7-abf2-feda3d1aa262", "value": 648920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853336, "uuid": "5c0dd1e8-adb1-41ea-b2d1-71fd99748e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853336, "uuid": "d4ae73fe-3714-49e7-aa33-c57595ed84c9", "value": "Drawing&specs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02abacac-2c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774887905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887905, "uuid": "630da9f4-a458-4294-8ea8-56bf3461ed1f", "comment": "Malware payload (Formbook)", "value": "f93beb08e9204ba23b67c34a83dbe44d", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887905, "uuid": "01620d76-9951-40a0-9011-74f8b6a51379", "comment": "Malware payload (Formbook)", "value": "230d016086472bcea8ec59bb5224e107746e79a72a67a2562c58a7ae3caf504c", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887905, "uuid": "d61f8312-7622-4600-99d5-0dd5217b4840", "comment": "Malware payload (Formbook)", "value": "acd744760c8c90ac7f6cd5f5844d847698d2e544", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887905, "uuid": "bf5f6eb4-5a52-43ab-a19c-e0e630342873", "comment": "Malware payload (Formbook)", "value": "9f67dac4f93963f8c0be51d9a3c8ea6c9ba77e70cd40de7ff1901980c8fcba8182d343cb9bfb6ce4543eda00084791c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887905, "uuid": "56f56987-17ec-4d32-814c-cb53fb3dbc7e", "value": "T1A895021289C82FB9CFAC5A1C90FD150E67F04A8F541AB98EFB33BD46AFE7504511B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887905, "uuid": "8845efb6-4c73-4e7c-a7fd-7a5fa3b27a41", "value": "24576:9BjLje0JFCVe3fVSNh8JmeJdOwK7kja7kcpZWPbMJbJm10rO6Pw1p2hedzCQSfaP:9N7JK6SmMZxZBI10SxOycb8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887905, "uuid": "2b51c184-50ba-4aca-88c1-468aa756797b", "value": 2004126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887905, "uuid": "d6a6b671-4c95-4859-9d1d-cf616999bb82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887905, "uuid": "20c2eee2-cca1-46dd-b832-95ac7a838664", "value": "REF. 00211136.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909dca25-2c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774870963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870963, "uuid": "1138b692-2c60-4211-b991-c66e2f1c9d46", "comment": "Malware payload", "value": "b1c6036b046bcf8c80601742ebcc61b0", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870963, "uuid": "ba2c8258-7355-4d2c-b6db-a0220c78fcbf", "comment": "Malware payload", "value": "23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870963, "uuid": "1d15e2f6-948c-4785-bf8a-31c7d167833c", "comment": "Malware payload", "value": "512efdfc832b012677341d251670c7192c463b21", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870963, "uuid": "d4581ad8-2ce5-4a10-a663-aec83ca67b3d", "comment": "Malware payload", "value": "c6832842d2a8e797906f02a32cdaa872ebb7570efae1bb8262d26484991c453354b82c871fd2610acea37d39e7024400", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870963, "uuid": "080373dd-03dd-4b9c-8842-5990582d174e", "value": "T1BB74BF4BDB0DAD71977662BF9053AB4324351463C638E12CFD2E62606FB3344B5E0A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870963, "uuid": "8eedc2fb-705c-47cc-b66f-51a0c1aef2fa", "value": "3072:5NgKC9pJ0ueaIs840OgsY4QL0CjlJQ7lZ0eZNEEVk0wtzP44vi0RXzH0m1:HgZ9pDeam+gsg7jlJmtZNfUtzPBDXz51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870963, "uuid": "165ee65c-d6fd-4145-81b5-a3c02b1d4b24", "value": 351121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870963, "uuid": "82536f5b-a5b0-436b-897c-4d2a082d3fc4", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870963, "uuid": "d5cf8144-dc97-47da-9924-8321a1be2033", "value": "v4.87.1_client.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235f8b26-2bee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774843722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843722, "uuid": "905581f9-da2b-4198-b85d-095677ef6424", "comment": "Malware payload (Mirai)", "value": "9cc990a820baeec7921a4330ccc53491", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843722, "uuid": "7a0d1dac-1707-448f-9a5c-3a629b1cb1d3", "comment": "Malware payload (Mirai)", "value": "23ce78d055be74cfb1e48e0710bbbe7a521a6aad6e7cbc125d6936a216c656a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843722, "uuid": "35fd1b98-219c-4a35-aec5-1b0b6ef0f784", "comment": "Malware payload (Mirai)", "value": "1a8325ef50152b00716b8a7bd4192a8780e30beb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843722, "uuid": "0fd6456e-0e9c-4c26-b7b0-99685852541f", "comment": "Malware payload (Mirai)", "value": "d2828e801bbc5cbcd16e70084970d772023aa24ca0f369497ca6e56cfff66fe3ba87d594c5de707fe98127ca0c571699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843722, "uuid": "85cb3ff9-9371-481b-a416-a7c849fb80c3", "value": "T17F3619132761DF1EF359C1340973CAA12AE515A229E584CAA33DF23C7E60A5A741FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843722, "uuid": "b1ceb11d-f0a7-422a-a472-a81af8735ab6", "value": "49152:oPuDkPGrxWFLLQHz5vZE4pnC6/cVafvTXXg9efz3jP0Yda3YKL76fYu4Gn7dqyEl:XDkAx7/vOQcQHYupAgWWFGNig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774843722, "uuid": "7b1cd102-d1f4-4f1d-8848-b605cf5b03ac", "value": 5340792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774843722, "uuid": "9cd54bb7-a445-4e7f-b149-cd9dda9f6ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843722, "uuid": "539be030-2680-41af-9905-b2f3d37667d9", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe0587b-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774879793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879793, "uuid": "dd0d5045-f6dc-442d-8834-23b47e24497f", "comment": "Malware payload (QuasarRAT)", "value": "8090c32b447f955e276ad8f005ea4775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879793, "uuid": "ee994609-d7a2-4f9e-835e-04f4a247694b", "comment": "Malware payload (QuasarRAT)", "value": "240e2575f20c75c6b5e2ea69bc0f0d9675ffd3fea315ca818bcbee2572ee972f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879793, "uuid": "01599086-7e1d-4e8a-946e-83bd3728783e", "comment": "Malware payload (QuasarRAT)", "value": "d498af82aba3f8d9be1a5df2bcd07ae5a4011883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879793, "uuid": "d26af236-75ac-4f83-86c6-8676f8060acc", "comment": "Malware payload (QuasarRAT)", "value": "645bdc2e246e34ec28559e31cdfb2281d47b822b28cbacc1ad43b71b1f84f1c5f225c45f3542411fa26287b1c86b8608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879793, "uuid": "8ff0d494-d51d-4dc2-85af-59e68f8f7697", "value": "T1FDA5F151B3F5820AF1BF2BB9A47604590773F942AA35E74E098CA1AD1FB37408E507B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879793, "uuid": "3e240002-14d9-41b7-b76b-b875cc689139", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879793, "uuid": "6a526b27-4173-417c-8ae5-2888d2518210", "value": "49152:DqW07wRPirm2NnPTKKm77LrwCB6uan36z6:DqWjoZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879793, "uuid": "dc2ad58f-fc7f-49d4-a1f6-302decb4c326", "value": 2181120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879793, "uuid": "bd4d5b0e-0874-4c2c-ac0b-f78450587977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879793, "uuid": "0e6e8ee8-7179-41f4-ac93-19d25a7d3fd7", "value": "ShadowClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc99b2d-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774861320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861320, "uuid": "64dedc01-71f3-4315-980c-1db584fd8794", "comment": "Malware payload (PhantomStealer)", "value": "da72dd86d50939520f99d812719bf85f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861320, "uuid": "db2fda87-ca15-4f8e-ab2f-8ee91837525a", "comment": "Malware payload (PhantomStealer)", "value": "262bb0abdf65d6d2baa592eb249d2693281a1c9c6180d1e46c57e79f52cb37b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861320, "uuid": "eca78627-f2c1-48e4-bc37-8710a84d61c1", "comment": "Malware payload (PhantomStealer)", "value": "216d0133968088779713b2e809d976110279a5d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861320, "uuid": "3cfeb958-13bf-47f2-ba13-3669a4fa869f", "comment": "Malware payload (PhantomStealer)", "value": "512d451765d155eb7cb59e7cc3cf7df92264b1063be6f16398e38dfa8fede673a8298a81eca106812f3e82fb67b0815f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861320, "uuid": "b59f142d-e02d-4fa0-a83f-b77b6220cff8", "value": "T1EF532EB2F28942624B5377ECF0948447B708CFB9FC9176691A69C4BACEA6C1E40DDC5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861320, "uuid": "70e3b3c9-70d7-4b07-8566-0587a58ea082", "value": "1536:hQMFeECP11aTSsJgBzwFFgib9RuEgDtNmbSAxhyeDgfEC6xnHYXatEOMBBL2rGtE:hQMFeECP11ausJAzwFFgib9EEgDtNmbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861320, "uuid": "24955323-99c5-4067-8883-44754f4b6d23", "value": 63529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861320, "uuid": "0e5ae11a-b0d5-4460-92c5-c06522676088", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861320, "uuid": "0575152b-c5fa-498b-a1d0-9d54b10207e6", "value": "Siparis No -083891TEKL\u0130F-Tar\u0131m Hayvanc\u0131l\u0131k G\u0131da San. ve Tic.A.\u015e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98396192-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867969, "uuid": "2bbc39f5-8bfb-4725-828a-be6581335342", "comment": "Malware payload", "value": "654135833c23cfe2c6877928ea122637", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867969, "uuid": "57643863-04d1-4a3e-9f97-382e0d21311c", "comment": "Malware payload", "value": "26b77b3fc1caf1e76b1a3c65f384804b0461bf74fed0eb6596632693c4cd8135", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867969, "uuid": "304e8f5c-d37b-4cdd-b8f6-d2afff7815c3", "comment": "Malware payload", "value": "218a98c1dee5c5478f7786305b561af73b21869d", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867969, "uuid": "40e9324c-091a-44c8-b6fc-bc78a93d4951", "comment": "Malware payload", "value": "24b1738ef670b3e1efd2364d9c670ba75a114396952bdcc108a6c8006c0e2497d861a2676e3fa224f4502a5900dc3199", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867969, "uuid": "011bfda2-f309-4bb4-94f1-c8b343db4333", "value": "T10274236D0E5BE85BEE7AB43640093FE1A91F343008F8F88BE65DA9F05E25DD41721D62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867969, "uuid": "28fac047-251e-460f-b9d3-3069b5b4d0ed", "value": "d2417a461d149f6138e0bda40b497c4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867969, "uuid": "38641c46-10e2-49cb-af51-a0e3445d0952", "value": "6144:2yu0myZaMY8db2szpqkjUGglsmJZPxJNtYpLQ1HcrAwwHW3x:C0fcMvks5gnPTcLEHoAww23x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867969, "uuid": "88f55a2c-add2-451d-b739-8be300d4d2eb", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867969, "uuid": "b15b2891-6aec-4b57-89a9-974ce645cf46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867969, "uuid": "b6f64f3d-2f3b-4107-b8e6-e4646af4e333", "value": "mservice_l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244565f7-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774853602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853602, "uuid": "f5318543-6a31-42e4-859b-56238512efa9", "comment": "Malware payload (RemcosRAT)", "value": "41568a04e04d0a2d3d4bd752f6c4bd79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853602, "uuid": "84965d9d-00d9-4a76-a1cf-5df0c75e325b", "comment": "Malware payload (RemcosRAT)", "value": "275bf4063b21fd2c5082b240d8db243e19f3bc1d02652dd3c85e3a59c236994c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853602, "uuid": "a287edf9-10f9-44f1-98e4-b4b86225ac98", "comment": "Malware payload (RemcosRAT)", "value": "cee5a4e81ffcd2d310a3e516b238f581bb3863d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853602, "uuid": "511723ba-ec10-4ff5-9ff3-c5b8df304443", "comment": "Malware payload (RemcosRAT)", "value": "2d7b397299ec22d44aa1e5a8c1ddb6374758a494cbe1d685c0f3b82824f53b674714639af83ed1010df061ff3a7bafa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853602, "uuid": "66757703-eeb2-449e-abd3-9353eb044e3c", "value": "T16EC402033B00E263D9A85B71D966D6B55BB06C2C1AC0DB0772E8BFAB3D772D25C2E145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853602, "uuid": "ab2264bd-4d80-40d1-8d10-e682604f8596", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853602, "uuid": "6d7a68c6-f48f-4e46-a1ca-1abd5a0735b3", "value": "6144:IhRqd7s0BLf44CfJpieKNgZ8ZQ0HRVwquvGt/GQRH572qyxJXu7BjnQwh7+Jbl21:uEch/KPvHRXtzH4J+FnvhKlhojNrX5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853602, "uuid": "d2d38d1f-cd31-4da2-92ac-cfec56c25e11", "value": 560544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853602, "uuid": "6b313315-019e-4583-bab2-6f684b254a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853602, "uuid": "7438761a-448b-417d-b411-0c23a3a94f39", "value": "SHUHA_QUEEN_II_Arrival_Docs_20260329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734a2cb6-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830541, "uuid": "361ac192-20d1-4115-9a49-c9ba4e9fa2dd", "comment": "Malware payload (Mirai)", "value": "087e7a8d97dbbe5798cb9f0622eb2f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830541, "uuid": "aaea86ed-276b-4ba4-ad56-2b49c823e7d3", "comment": "Malware payload (Mirai)", "value": "27c8ce01234e093b4302eaab7c3fdc8033ab848fe36c727a218d430477443273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830541, "uuid": "3a186a88-b31f-47fb-aeb6-9eeea28a060b", "comment": "Malware payload (Mirai)", "value": "2d39861cd1e503411852bf16aa7bcc0ee59cc2cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830541, "uuid": "e6e8f739-a3e5-42b8-a871-5572259d21d2", "comment": "Malware payload (Mirai)", "value": "f3eb4f3a0e4d4966e66b9a34bc89e8f2a27677e75ea78859608103455c18a88558d4d5022e7a95526f3cfd8657f2ea49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830541, "uuid": "2e2a6a91-4ead-4a55-8863-96bbd7987b95", "value": "T11813F2BEFB9C3891CDB9897148BA0E259809984335EE07E857051EC5E334E1AF70E4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830541, "uuid": "1cb8b6e5-2f59-4da0-b595-aced8a68ad63", "value": "768:wAYkIy0mPPUacW/T9UbKJ9EzoKW/0mNyCt5eGsyMBHDvuKzPhW1V:wAYkznKW5JAVmNyCtsHyMBHSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830541, "uuid": "b07cbadd-1486-4bdb-be5a-f71640053f2e", "value": 44548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830541, "uuid": "adb080b2-8367-4221-8a9a-7dc844079fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830541, "uuid": "9bb40787-3706-40c7-b334-543b3d3edc05", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25220208-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774879802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879802, "uuid": "26d8edbe-ca48-4388-b5b6-0c1f548da484", "comment": "Malware payload (AsyncRAT)", "value": "ca2e595881e56dbf63cf891ee14300cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879802, "uuid": "275a7ada-aa72-4065-b2da-02dce2ea721f", "comment": "Malware payload (AsyncRAT)", "value": "291543374d0ee4f983132128dcef16ebc8c058f07b1dc1b1f7d7e11d189fd42a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879802, "uuid": "2362dee3-852a-4b8c-b64e-79576de80c1e", "comment": "Malware payload (AsyncRAT)", "value": "7bb190d425645f02724329c6f909432e2441cc70", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879802, "uuid": "cc7beeb1-4423-4512-b481-d46b761534ef", "comment": "Malware payload (AsyncRAT)", "value": "e67edd200d5ed4ed23767d19ddc3302e3f881f3eb61834c1c9b04f524cbe6f52009107860412a2b3b89f97ffbc822304", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879802, "uuid": "eb69f472-02ab-4c79-9b05-e91c3928bbe5", "value": "T18D538C487BE14629D0FE5FF449F2A227C774E3935803D69F68D901962B27B8C8D14AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879802, "uuid": "0837ce90-1d08-4519-8b6e-b8784a15f2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879802, "uuid": "79c73a82-e558-4cae-b328-91a74d285dc3", "value": "1536:DVBi1Y0TD+tokrjoTBDIT1+b/8ADQCwlhradOXWv/:sY03aosjoTBD61+b/8qrUr+OXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879802, "uuid": "c718a92f-eefc-469e-ae83-87af4e026d9c", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879802, "uuid": "0a74be14-aa73-469c-989f-d35a975b64a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879802, "uuid": "c1b3ce6b-1836-4bd4-b352-f6e3261b7b90", "value": "XWormClient2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9eba600-2c39-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774876213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876213, "uuid": "1449670d-8d0b-46f9-80b8-dcb84d2efe2c", "comment": "Malware payload (RemcosRAT)", "value": "fdfdb6e371238288d83fd191438afc4f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876213, "uuid": "37e0b487-8915-4cbd-bf67-073c722a5e42", "comment": "Malware payload (RemcosRAT)", "value": "2a18e7d8393d65193e5f02ab329796cae6d97a3af7f1bd146d9cd3829f5e7a6f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876213, "uuid": "c2e08caa-f594-47cb-ad30-20c49cf62dc3", "comment": "Malware payload (RemcosRAT)", "value": "1a26ea010b0e8afa365d5ce9f58243effe14cca2", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876213, "uuid": "5a842cc6-c6d7-4884-8bd1-ac71f230ce98", "comment": "Malware payload (RemcosRAT)", "value": "51f20ced607affad0e32b73ae6351942b460cde5b2096601f5a77a9cbd9475110f9b991eb1d52b20e8763e0bef907ffe", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876213, "uuid": "43b2030e-481e-4be2-8b10-53fe0416022a", "value": "T129A1A005379520DFD85D8E319EE2DFF1BA682C8E5E3C29D42F849E473BE8062C453629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876213, "uuid": "5ecd4c18-8381-4d17-bf96-27f996aabb0d", "value": "96:Xbg2SD4P5UqtlItlItlItlItlItlItlItlItlItlItlItlItlItlItlItlItlIt6:k2pP5UOl0l0l0l0l0l0l0l0l0l0l0l0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774876213, "uuid": "7278718a-8c98-48d2-9922-dc34053caf5f", "value": 4678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774876213, "uuid": "4365082b-25cc-40c3-8e3b-bf7faf616937", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876213, "uuid": "7234cc1f-2161-4a1e-8b8e-f440af2ad1ea", "value": "Purchase Order PO122961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c77063d-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867977, "uuid": "b9b9d163-5d4f-42a0-8071-6500bbc7b841", "comment": "Malware payload", "value": "c7f58d90750dff81c45484b5d089119b", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867977, "uuid": "f6788ec9-6aaa-4329-b061-debbd8525312", "comment": "Malware payload", "value": "2ccbf63166810474169cc1d632b6a651db67a2b139b785c4639535962d6ed0e0", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867977, "uuid": "c4080fbe-6de8-48f7-a89d-b9310cfeec14", "comment": "Malware payload", "value": "75ad5cc94607f7ac08bc6b08e8d1ece4cce4844e", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867977, "uuid": "c438d509-ff6d-4832-ab4f-fddb7d9772d7", "comment": "Malware payload", "value": "85d1262d17ee2610b28dab0ac106f64c1e749294a86c938e81369919e1db130700d225ec93caa61f8436cd81545757d0", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867977, "uuid": "7236ba45-72c0-4552-8edf-ac706f9f9992", "value": "T138F423E92AD527FDD88860FEABDF0C56D653BDE60E4A500029340695CDF9824FBB170D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867977, "uuid": "98687e52-dab9-4160-a7d7-ea9fdf2bef82", "value": "bec9eeadd4e78e2b82a4cb142bb3fe2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867977, "uuid": "e558439f-8a36-4764-9bda-293465325da1", "value": "24576:CiRivTLG7iZW7vu/P5ObG+o3XDG/s3M+K:AvTLm2GWna/t+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867977, "uuid": "4743ff72-ff0c-4a02-8cd0-e27acc1cd56c", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867977, "uuid": "0829194e-b2e6-457b-9239-ba98d410f1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867977, "uuid": "e8ce5e73-9f2b-4baf-ba7c-32f577f7a700", "value": "RuntimeHost (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7137e0a1-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830538, "uuid": "e8ca1590-7feb-4045-afe1-8ee53e62d4d9", "comment": "Malware payload (Mirai)", "value": "9fbd8c89c715eb98f633f558951258be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830538, "uuid": "65b09ad3-975a-476b-ae37-e9633bcc93ce", "comment": "Malware payload (Mirai)", "value": "2ee89245c6dd3edd3e14f8bc52c866757ad98b97955b181d0cd5dc719004b893", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830538, "uuid": "71bdaee3-f436-46a4-b208-b0234b46a3ab", "comment": "Malware payload (Mirai)", "value": "3baf171f6a9801539e7947cb2a6e6a6d84a240bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830538, "uuid": "1bcc7456-14ca-4b7c-b768-0d33a4886e79", "comment": "Malware payload (Mirai)", "value": "1596fb7c5bb817002e8a8059888f8799b4725cd26ec0d880ed4aee6f45ac2269a7cbbc7913051201706181407b7ef292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830538, "uuid": "e95bb248-0db1-4059-91fb-fa505048bf8b", "value": "T1CD51B5C751015F723D52DE2276BD484830BEA89A6DD79FE558DCB8B4408CE0D3C4AE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830538, "uuid": "808f2917-d8cf-47f6-8c9f-dd8a08326954", "value": "24:ItOsDPIhOE93VArPs8NTYTGF7JY2GACLnyNINks0ryjlTzyUp17J:iPdE93CQ8NTYTGFljCLdJ0rulTzVHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830538, "uuid": "0fb56ac3-0ef2-4745-8a06-9db37e41acb6", "value": 2789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830538, "uuid": "7676896b-81b7-4fa9-a038-18459fd039bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830538, "uuid": "494e6f79-1131-4d03-a68a-93f40094235c", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291cf09e-2bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774849315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849315, "uuid": "e6c1dd2d-d66e-4b8a-a37b-9c75c6a6b740", "comment": "Malware payload", "value": "892c2e4966131425f7c45fceabac6123", "object_relation": "md5", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849315, "uuid": "b2e8fa8a-7e5d-4e89-83d1-1c48367ad840", "comment": "Malware payload", "value": "2f2af0029b55190dbcee3cc21a09f04a84b1ab10fb19d558c073dcd2fa158991", "object_relation": "sha256", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849315, "uuid": "34056003-2717-49bb-9ee4-1eb7982c75f7", "comment": "Malware payload", "value": "fce5a2e5f7d35eb5159688970a04ba065641acc5", "object_relation": "sha1", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849315, "uuid": "50e8800a-bcc8-48fc-90d6-27cadc0b61cd", "comment": "Malware payload", "value": "e7abec070e0f4c0619a4b839ce9055a9e6469a4c020f2dd19f2bfbbae4f63d69482b39588d1017d8693933ed36974ca9", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849315, "uuid": "eb43ca9c-1b67-42ea-b0fc-29a0b3813333", "value": "T102F4B35A89B315A87807D47917EB1B166376C003D40AECB47FCD6298CF8B984D9E738E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849315, "uuid": "b6264ecf-8d52-47f4-9091-56486516a5f7", "value": "6144:GZ5KO/24isO18el3zWBOrksDKRQHu10drJ7B1:GZ59/24isOHV7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774849315, "uuid": "b58d3d9c-ac32-4afc-bcfd-5fc1e7a8523a", "value": 793078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774849315, "uuid": "d92ff1bc-c063-4aac-bcf1-61be0f0c1c92", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849315, "uuid": "ff980538-34ed-407c-b9cd-207d8e5086da", "value": "start.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36f418b-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909300, "uuid": "4119827a-33c7-4caf-9922-ccf21e94a7b6", "comment": "Malware payload (Mirai)", "value": "cd100c13b4f256678014851a47bca7c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909300, "uuid": "4c3a28e4-3495-408b-89d4-86914d98331c", "comment": "Malware payload (Mirai)", "value": "307e5436fe5ab6e021d1595ad885bbb9249daad0cb0e022b5b35e36bc9ca0184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909300, "uuid": "9c2c1aeb-770e-4177-b604-fa15f1462988", "comment": "Malware payload (Mirai)", "value": "bf064c6848e60a9e548a51259955a4582c105fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909300, "uuid": "772432be-f6a2-4f8a-9873-56ea587de778", "comment": "Malware payload (Mirai)", "value": "aa3850e20c6ee7617151c6d302f53c234c4ef9fd1b823f40fe9bbd46ce4215bc86b4f8a9cc0f9f6f7aa304ff58825fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909300, "uuid": "b3499b98-f2a1-4e5a-9472-e0c45f6abe68", "value": "T1CC045C07B7108FA1C369D67109B3CB6796D726A216F19985E76DCD107B303AC6C2FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909300, "uuid": "7601e34c-0f95-43e0-8e6b-ad4dc9ca1237", "value": "3072:uMawMXrctlMW4v73W/+GTohOSyc/fmCDtoxrxpQhCvAzZolCfatK:uMaZXrYlh+Gshgc/f7GrpQsAg8cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909300, "uuid": "92536811-3265-4a7a-b8d9-9a80cc1a0826", "value": 183280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909300, "uuid": "ea1d68c1-6df3-41b2-9f1a-5b4a1110aed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909300, "uuid": "27dbbee2-6a46-4365-8bdb-ab59bfce5338", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a0da8a-2bec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774842927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842927, "uuid": "178f5c6c-ce12-4c6b-b202-33bb60d138ec", "comment": "Malware payload (Mirai)", "value": "a9144ee70fb6eeef73b14f10224dcd67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842927, "uuid": "90e82476-c321-4bde-b311-a2e5903f23e2", "comment": "Malware payload (Mirai)", "value": "32b7ac293d85e7a6d302192b99aa60f3b857cb11e73df7af5e25fc307c7bcaa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842927, "uuid": "b0b283d2-14a1-43a2-81c5-add46dd838b2", "comment": "Malware payload (Mirai)", "value": "59e7b0ddfd1979d8ed80b8f20a084abbc1414c8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842927, "uuid": "4a2260cc-6358-4802-93d5-bb06bfdbde5f", "comment": "Malware payload (Mirai)", "value": "c270f06f20a1bb886004e434c8a3e5e5b7e732d8322bf0a327d7374bd2ec9857d458c065e5601e0e324755674a68e381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842927, "uuid": "78f9007a-a79c-4671-b513-2d048c2fff00", "value": "T188464845BB2C0923D6530DF0993E43D5F3263B4382B1A22B6B0F67473179A36A6D7789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842927, "uuid": "fc5edb86-7a5d-415e-82d5-ab8e58690bb1", "value": "98304:Zwk0+TFHop0cg3VvcNeAkc9Xx9F2L/hHB8xccE1zaZ9oXYUFOubHVwUMSSPjYgD5:k0cdtHshTm+IriPnef3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774842927, "uuid": "8e50b519-9766-40f2-8e06-cb86b0040845", "value": 5530764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774842927, "uuid": "8c7de0ab-d489-4123-b0d9-fa7eee3ddbfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842927, "uuid": "07550c3d-683b-4c77-aac6-f9d04e663d11", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7404144f-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774883800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883800, "uuid": "3f3c9ada-ad67-4f8a-b702-948ed17be76c", "comment": "Malware payload (RemcosRAT)", "value": "793eb0eec0caf7d22604f35aa0e83bce", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883800, "uuid": "1d2214ee-d54e-4b63-8cf3-9c62d29ed06a", "comment": "Malware payload (RemcosRAT)", "value": "32cad76bb888bbbf53ee40977f90b612ca41b2af749eacaa3ad3af5d0c2da268", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883800, "uuid": "30881dce-0031-4268-ac3c-227139747887", "comment": "Malware payload (RemcosRAT)", "value": "76cd33886b093ac6d6791cadedec4629db23db08", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883800, "uuid": "69e0a3d3-6d8b-4e07-8ec1-ae92d0404bfd", "comment": "Malware payload (RemcosRAT)", "value": "be3f72a3c5ab011125ab6cf3108c923b525b98d6c9351d8ddc5233c8e477f6c3a6d226af67c9428e9af528fa4f603d4a", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883800, "uuid": "f6cafb55-e0b1-42c9-8956-95c6bb0d98ab", "value": "T1D325BF017C81D432DB6A20B14ABDBFBD4AAED8300B6519C7A7DC68FA9F705C12B32557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883800, "uuid": "a1f5144b-a81f-42ea-a699-d3a9213f69ed", "value": "5799f031b5c4ea5a5a51635c0de03869", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883800, "uuid": "2c1c012b-a2c7-4dfc-b691-a86b5c975e1b", "value": "24576:GmngzegUcuaBHFn8y07ByOrW9xLF1Pxax//QM7tNYmI:Nu2aBHR8y07ByOrW9xLF1Pe//QM7ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883800, "uuid": "e38821c8-0f54-4c9f-ac77-3849d4aaeaa9", "value": 1009464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883800, "uuid": "47220ed6-9239-4259-9a03-37544a1b84bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883800, "uuid": "5b5e1149-a9be-4896-952d-4852c6e94591", "value": "32cad76bb888bbbf53ee40977f90b612ca41b2af749eacaa3ad3af5d0c2da268(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1814f60e-2c54-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774887511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887511, "uuid": "27bdaebc-4199-4d3c-84bb-eb48e672b5c1", "comment": "Malware payload (ACRStealer)", "value": "2b63b5a382b4fabd3e7076d083eb97ee", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887511, "uuid": "8d29074a-b871-4b0b-aebe-12f09b5d548f", "comment": "Malware payload (ACRStealer)", "value": "33c47942c21d84fb64295b61e73a2135a32559d010dd0d10e5b15c4c0c9f0660", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887511, "uuid": "958a8b74-f369-4dd9-aabf-c0ac0e4cc1dd", "comment": "Malware payload (ACRStealer)", "value": "a3dfbe17dd253604e3844041b84c45ddad65d803", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887511, "uuid": "116f4551-bc8d-4647-a23d-68b6bf238cf4", "comment": "Malware payload (ACRStealer)", "value": "8d0b39bfe5e4f741b7e5e9d332004511a13177720966e06b65880c58d7fd38d485af65ab3e29001d8b89e97d9616d6ca", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887511, "uuid": "6eaa4957-078a-44a9-97e9-421358bbf1c1", "value": "T1E9365B0BBCB158E4C8E991308567825ABAB17C455F3123DB2EB0F3781F727E05AB6758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887511, "uuid": "3e3dcac5-e919-48a7-a626-9ddd4db3f3b1", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887511, "uuid": "d7ea5009-fb26-4b28-88a5-25afd5ce6b33", "value": "49152:8nIHOnPQLDjXTmqFFq5Un2tcWcs2KQXj9YjeCTB+QclVxZrpc:8nIyqC5UBZYjzBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887511, "uuid": "baf936f7-2aae-40fa-9276-761e4b898358", "value": 4972544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887511, "uuid": "a82efee5-59a0-4996-a384-1a5ddc4e7e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887511, "uuid": "c1eedbbc-4361-4f82-b94e-f06d16b72ca0", "value": "SecuriteInfo.com.FileRepMalware.16373796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb72cd37-2c75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774901959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901959, "uuid": "bd9b0b60-dbe1-4cf1-ba85-4348188e0520", "comment": "Malware payload", "value": "1e4b6ee69365046f298e31e8796e634b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901959, "uuid": "983d0662-6151-428f-b26c-dfc12b35eba4", "comment": "Malware payload", "value": "361d180b738fce6d9740b97edf6b2729690e32b50c5c994663c214da71b3626b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901959, "uuid": "8c5095af-835c-4129-b68d-17e77b42174c", "comment": "Malware payload", "value": "39e131452ddd8508ed505a38e8c7692aad2e9961", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901959, "uuid": "24e5fe41-c800-4590-a56d-d10a454b551b", "comment": "Malware payload", "value": "fde1fd5637a83a23994109e6618a96d3f9e03b9f6be774482ea51bca75cdb7c1983cfbf16dca04a2bc9233208f057350", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901959, "uuid": "3a542b6e-b7ea-4da1-8e34-8505ae79607f", "value": "T1F012C53CB41C9CF157FE7192A3277C989A36253794E6DC4E2DB7A4C12A202413D758FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901959, "uuid": "749fbc02-1a4d-4fad-a620-0e0ca252321b", "value": "192:NPDhVkmhGPbCusEIMEjlMiJ5UlGD5nouOWwsEo6Qk1QHQj3AVRRVPlvAtlb:NPDhVkQGPbCusEkFmKophsZ6QGR0DRVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774901959, "uuid": "a110ad71-0cef-4b12-9e91-5370d050071d", "value": 9116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774901959, "uuid": "cce8fdc9-eaba-41d0-9faf-0b8bf5ac22c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901959, "uuid": "7e5c2bc2-cee1-4f7f-b883-40a7f053df25", "value": "ea1vOu7x59.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56a1b47-2c36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874998, "uuid": "ab4b1f53-d943-4f65-a6ab-908e52a3a556", "comment": "Malware payload", "value": "cda2b40126dc35c92b089160996231a1", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874998, "uuid": "9bd49ac8-c1c3-4c5f-abab-5c8e9904c16f", "comment": "Malware payload", "value": "362d697f7a0cdf972c3033cd4e3a405617798afbf25ade6d0a08035ec904c71b", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874998, "uuid": "5aed1076-ae17-432e-9b1d-5f11832a383f", "comment": "Malware payload", "value": "e958e7d9c41e6d903943dc243c51e9d2797c6f4f", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874998, "uuid": "18a2fd06-7783-4a8b-b19d-3302f7bd6336", "comment": "Malware payload", "value": "db172ea6b465679f986edbf457c579ba2a617c8811410fd9ae155085eafa73e766c3349408a8a39c2a9566d8c20f3d7d", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874998, "uuid": "e8380c0c-4998-4e0d-b705-a3becca2b488", "value": "T193C18EA55C0745F0C0F09034E1C75C86C2A9DAC7493F3197929CD3EF1BEAA263289469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874998, "uuid": "c2ce7a5c-8ea3-440d-a168-acb4b1b4b624", "value": "96:M9Kvb9HWW8yA6giPNZj4WNSTvUpxUPT0TaO1e+YIpzF+s16keeepIMjKfzZppjIx:M4AW8yP54jyITKWIpg5eeqMjkP5GX+9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874998, "uuid": "922a532d-a30a-4804-9a00-5fcf17ed3bc9", "value": 6084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874998, "uuid": "13cfeb33-d005-4b76-964a-41f5cb2e007e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874998, "uuid": "61db2574-bfd8-4162-a406-ead336b5b35c", "value": "ce681356c8870af8583ed753fff330e2897f4629c45677f8065649a47b20a111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d3979b-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830572, "uuid": "fc403676-57da-476c-a63f-45416a18a5be", "comment": "Malware payload (Mirai)", "value": "ed118ec6dfff846c2426ca55a1556aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830572, "uuid": "500f33e3-2db0-43f8-bd2c-f861d3916581", "comment": "Malware payload (Mirai)", "value": "3699ec23ec854c4eab8b6660bb944f9002e4230c1d3fbf7f387caba560f1a2bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830572, "uuid": "7003976b-7ca6-49df-8da4-3bc34ce4164e", "comment": "Malware payload (Mirai)", "value": "921269d4cc03fa399e3f345e0510568cc724781a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830572, "uuid": "518a0ef1-7748-411f-83e9-106855c0d68f", "comment": "Malware payload (Mirai)", "value": "1cc58a38a04d9606f439a48c1f12ea3b2b2cbacd472cb3d626d0fbe98a86cd533e02f89e4eff1f11a69d9d81e7d98281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830572, "uuid": "57aff8f3-7bee-425c-bd4e-dbd257053e02", "value": "T13F736CC9E983C4F6EC120A350136BB379AB3E53E2169DB83C3A9A565DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830572, "uuid": "bb05a11d-84e7-4f09-ad6a-26d1d7429c7f", "value": "1536:rbsv6XewvV2uo0NDhVRW9Z3J8h3qaccSXa:rbsiJsuo0DhW9zs3ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830572, "uuid": "9f9bf63e-177f-4183-b0df-7eb8fd45bea4", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830572, "uuid": "524b5779-81de-4d4a-b8b3-2247fc39c2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830572, "uuid": "d4cc6e25-de8f-482f-9587-acb1bd07d387", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93ac441-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853905, "uuid": "421c1fac-55ba-40eb-9e12-e9ba05e58537", "comment": "Malware payload (Mirai)", "value": "477fda782b6603f03a735f9c6afd05f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853905, "uuid": "4bfb7b5d-acc1-48b3-82c3-8b4fe808973f", "comment": "Malware payload (Mirai)", "value": "37586b88969bb679d2baa26a5385ef70bfcf239015d53f40f8113197e01c515a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853905, "uuid": "750c6e56-2671-4a69-9763-bad692b8434b", "comment": "Malware payload (Mirai)", "value": "f8ca941d76c8f241b845d6166e3a6309ffc1bc7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853905, "uuid": "348ede53-235e-43a1-be30-4a82a5bb8ba0", "comment": "Malware payload (Mirai)", "value": "2922a0c604cc2181ff88eb2431ddc72b075e26203a253539d7e1c520220ed60d5172f47ef15e4ed5868d5e924319939b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853905, "uuid": "60122b18-d42e-45d0-bd95-a4403e469f69", "value": "T1C67302B0B5496433C2B224E6F873ED873DECAA7CF49EF50740ACD469F512A4354D5246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853905, "uuid": "0b28040a-9c9b-478c-9514-03cc5bd15a9e", "value": "1536:kguWOMb9QllElTTTg4GbhbbvxnhITUewquxIf5ZuHT7je7MKnPBvIEFOPB8/h5LP:kgGMbKi4hF7tHewquafuH61BfsE3LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853905, "uuid": "357be212-5978-4ccd-b9d8-ab1f95565aa8", "value": 73656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853905, "uuid": "38ef0291-180d-4b4e-b0eb-01d99658563a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853905, "uuid": "5fe18dc9-8a5d-4dab-968c-dc75484659a1", "value": "kurayami.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7699e2f0-2c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1774905709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774905709, "uuid": "99adae56-c40c-4e7b-8711-5b6ed6a47a50", "comment": "Malware payload (Fuery)", "value": "4d54a5adebf934b5f4d6a83813347901", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774905709, "uuid": "c62a8b2b-6fe8-485c-971a-076a46e86d3c", "comment": "Malware payload (Fuery)", "value": "39de4a90a9ea45452548651029f410c1946fcb66c330e93ba622efdc9630c359", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774905709, "uuid": "f7b17b2e-d9c4-4dd3-b530-78b96027abfd", "comment": "Malware payload (Fuery)", "value": "4a260a1f960913c8bbd95448db5e038daba407d4", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774905709, "uuid": "23c53115-1904-4c13-bef9-a940a9eb9503", "comment": "Malware payload (Fuery)", "value": "99cd6129d1d871d79a05005b39e05e9c0d811aa8d04fbe03a6f71c1197f759eda71f0e0011641b9a1987e01078c96e85", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774905709, "uuid": "5cdc3041-e95d-4cfa-ad8a-91686878d6d0", "value": "T1F035018872A8EB01D4BA6BF84C70E3B913F52D996561D3168FEABCDF7438B505905383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774905709, "uuid": "befe6685-62b0-4781-bf13-260ea7a6cd9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774905709, "uuid": "7064ee6b-99b8-4d94-83f9-9e9f0fec2d2b", "value": "24576:6rZnHnvkaTqA41r9eslA5FM0sbfmY38zEzo7/gmt:r2qA4C5FQmSo7/gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774905709, "uuid": "ca9aa5a5-ea19-41ed-985c-1d09737b650b", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774905709, "uuid": "80e2ab3e-5e85-4a1a-b713-8538233ae04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774905709, "uuid": "9f2e1e65-640f-451d-a887-b00f8f3b81c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d734d5a-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774879789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879789, "uuid": "c7b975b2-f49d-4b0b-95b4-4c15d4963cc4", "comment": "Malware payload (QuasarRAT)", "value": "f162419fce4eb4dff92be342c47662c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879789, "uuid": "91c77542-e137-41c1-8331-59c9c27dab18", "comment": "Malware payload (QuasarRAT)", "value": "3a4b0f50ea3eac55e22cbf24d873f9a1632d8f71e1fba91178c539030626ab32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879789, "uuid": "6649bba5-0958-46d8-8b30-76660e4eda8e", "comment": "Malware payload (QuasarRAT)", "value": "ad4e81b84f3c6f8b30863f90e8a09631112b0f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879789, "uuid": "f86ab97a-8d70-4f41-a992-c2fe69c8d504", "comment": "Malware payload (QuasarRAT)", "value": "69cd19488853bd9ba25f574c6f87551c6c66ea566b5cbc128271348385f56dd106c4ae7713c72589f2db53a0ef91c158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879789, "uuid": "ff643956-e7d6-437a-8aca-f49b789eaacf", "value": "T10EA5F191B3F5821AF1FF1BB9A87205590B73F8429A7AD34E458CA49D1FB37408E107A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879789, "uuid": "518efb70-709e-4f88-b738-887cdbec4b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879789, "uuid": "e64191b1-4194-47ee-9a9b-0d2311c3427d", "value": "49152:VqW97wRPirm2NnPTKKm77LrwCB6uan3Z:VqWCoZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879789, "uuid": "356106e5-d743-40a1-bfc7-f4addc2aa152", "value": 2182144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879789, "uuid": "f43c9a1c-ae7b-4252-a615-b03cc0d9de6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879789, "uuid": "7b68e0ab-d4d1-4452-91d9-e669d1a96a5d", "value": "ShadoClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acc4f41-2c65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774894925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894925, "uuid": "e23ab10e-c28f-4e4e-85b9-616ff0e6c66d", "comment": "Malware payload", "value": "a93f6f5d0890e048bccec21c2b4106ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894925, "uuid": "fa866154-5568-4749-9cfd-cf7725e62d28", "comment": "Malware payload", "value": "3abc0f69ffba3e1dfa3ea7832255dab4961bf8c92e5fb07da7f180450328eba3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894925, "uuid": "84fd5a59-2825-4e63-8c89-3043ab44ca4b", "comment": "Malware payload", "value": "088b1f9606aec37bbba34fbfe61619c067e7b7e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894925, "uuid": "4fa0177d-b617-4387-ba0e-6082188acf8b", "comment": "Malware payload", "value": "cb2fd427e67dc8e4453e4ccb5dfd67944b96b9e34f7d886a01fc4b97ebaeeaacd9ade9c5f474eef92b6d84f83d089cce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894925, "uuid": "b3782080-7fea-474f-b634-cbabde6dfbec", "value": "T1B0A52ED950901C6590A8560FFCFFEB1A651430FAEC9A46FE3D8882E85193B213C779F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894925, "uuid": "797aaa67-0a56-4614-8b55-1602b8095a64", "value": "48:oKqVeFgrYRC3Qkjiiiv7cdxjUZUq3DrLJvliiiBrb7s+YlyZtvMNTjtAa7cdxjUK:tq4R2CBMV3HQgC66i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774894925, "uuid": "42760ff4-65ca-4f1f-880b-7eb7c61d5ba4", "value": 2209079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774894925, "uuid": "a7cfa117-8e53-4c9b-b594-3b1a0f7c04c6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894925, "uuid": "3a760cf3-0e41-4ab3-b071-f971e5cb158d", "value": "pztHk3TcF5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed73adb-2c53-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774887335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887335, "uuid": "7fcf8f61-642a-4b79-bd87-bdb857f96c5b", "comment": "Malware payload (AgentTesla)", "value": "d209b84613c98ca55f5802ed538bdfae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887335, "uuid": "52d15ef2-45b2-44a5-99dc-5f5c7a3535a7", "comment": "Malware payload (AgentTesla)", "value": "3e11d3500fd9600650fa600a8712a6c1c2a9a72265bd9683d16789744daf944b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887335, "uuid": "9520360e-9db4-4b54-81a6-edb67caf86e5", "comment": "Malware payload (AgentTesla)", "value": "017d595c69caa3e72b2542c5dacf153d696cd8b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887335, "uuid": "a83e3797-5418-4abb-b540-6297ddbd2fea", "comment": "Malware payload (AgentTesla)", "value": "1dceb926f08eeff2ee493088964a04944816fe48f943b767cf38d56e8829926cfee33900ea43877ad376c888a5544602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887335, "uuid": "76d7138f-5b2f-45a9-b0f0-2d83246ec2ff", "value": "T1789533AB5B9EE7BB062673182CD1499B54338908DC396AD0502A9E21F615CFCCF4FF91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887335, "uuid": "e2e10dd9-2259-4956-ab7f-2e7461639dae", "value": "49152:y5/+O7iMVHhHTSvv+qB8/SXpKNgolAOIuDV:w/xWMlhHTI9u6Zsgo/zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887335, "uuid": "8ffa649d-4c57-4d0d-99a6-c56f5704657c", "value": 1897070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887335, "uuid": "0ebb8635-89e0-4ea4-a223-0ed474b6b9b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887335, "uuid": "50b9b83d-00fd-466d-8a32-6a0a6ba905d6", "value": "richiesta___e457327662.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddb71b0-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "f0d630ef-cb4d-4296-8b9f-892956d8da59", "comment": "Malware payload (Mirai)", "value": "1942cafcebd6f573f294f8b80a148d96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "3402f598-fef5-4b87-9bd6-e6f2af76a76a", "comment": "Malware payload (Mirai)", "value": "3e219672cfaa9e4aa9ba976eac51ad624a4444c483a17b6a34e9ee867fc9b8b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "aa1a88b4-632b-4e2d-9a10-226e243fd9c2", "comment": "Malware payload (Mirai)", "value": "fbb76a67081ad7e2b7ef8d04fd6cadb12e06420b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "1f859f90-04fa-4eee-b154-9fd5de50957d", "comment": "Malware payload (Mirai)", "value": "e065817667d85e76473d14b23cf48399bb7a5109878c54c4f828fa0e7f3dfd0664678a8c59ccf068d938266b96a2f2de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "ca67ab6c-8ee0-4319-82ca-ed6a10c4982a", "value": "T187E49D98FE4E3D42D2C7E33DDF8597A1212BB5E4D32382B27981025DE4DAEEDC6A1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "07c2b0b2-d4ff-4dfb-af77-dedaa3eb7a22", "value": "12288:bFhJTGTHEt243J2s71DLj622oMOAd+Is5W1LFV:brJyd4171DLGBoeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853913, "uuid": "3c90982a-648e-429a-b02b-27a58e6f20e3", "value": 719264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853913, "uuid": "8ba8cecd-236e-4bdf-ad83-8c2a92536ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "ec1d966e-f9eb-4ca2-8c76-13f162ac292e", "value": "kurayami.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c27487-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774861412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861412, "uuid": "cb0c8cb9-abb1-45ea-b48f-c5f007ae1ce9", "comment": "Malware payload (GuLoader)", "value": "b148eb44160868f64935a7c20681c1dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861412, "uuid": "1d213192-0ad0-44ac-a658-e35223dd9a42", "comment": "Malware payload (GuLoader)", "value": "3eca2d75b0cfc8e13590a9d2e41691863dd3c7d3fe506f3ebf4c5bdacfd21451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861412, "uuid": "84103451-54fc-42e3-a3c5-d9a346f85143", "comment": "Malware payload (GuLoader)", "value": "64214515c3427f4ad884d31e922ab0a29831f9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861412, "uuid": "2196bbfa-68f8-4b12-9ad0-66bd20b14211", "comment": "Malware payload (GuLoader)", "value": "d47845059af3910874eacf780fad48a7b8484a030f8022bd220829f52aa067690224704e1cc6e70623d367ef1eb3fc9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861412, "uuid": "2ed166ca-3573-409a-9b57-ede356f7c357", "value": "T106741262BB98C817CEA155305C76B6BAAEF2B46511125F434B10FE1BFC307918E5E2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861412, "uuid": "5a7f0efa-e1a3-4682-8883-3ba5646555ab", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861412, "uuid": "aa82f28a-93a8-4a8c-bcad-2265db000004", "value": "6144:apkXGhw3vBw57b99VLPk1uc0vlFS0CM96gykKHrxJddCdZUwlqWVO:7X3C5P9nqhcUFM4Bk0xJ6qWVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861412, "uuid": "03d561bd-355d-4ebc-aa80-0c43f629cf19", "value": 338472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861412, "uuid": "afba9232-d374-424b-8a2e-d187231ba369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861412, "uuid": "ead5a953-ff8b-4d26-8b86-67c65579a74e", "value": "Lejret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c75e094-2c69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774896592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774896592, "uuid": "249ee92f-eb05-422e-9345-254c392bc4ef", "comment": "Malware payload", "value": "8cb4c9846f28f3d83f713c2d682dc2d2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774896592, "uuid": "9ac843f7-3f55-4e17-b928-831c1088c7a6", "comment": "Malware payload", "value": "3ee7037e1cc12a0beb3b58e12614858e63979845c05247a3bf7d52a6b54148d3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774896592, "uuid": "0b9a4047-7d23-4710-a326-cf399908354c", "comment": "Malware payload", "value": "3aaab372e2fd231aa06cbc8d91c5e116cc91497d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774896592, "uuid": "0eca210b-0b64-4a5a-9505-c6ae565868e5", "comment": "Malware payload", "value": "de4d5b93626adf455ef082f5d3c24591c7734e84de6e24e68a426413de5ec9f09c2f0ac19426ca9a2501a5c165f01528", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774896592, "uuid": "b8bbc0c1-95e0-49d8-ad79-900d61cf014a", "value": "T1B2D5D549AEB454D9FC2641314C2EC960D62EBCE39B5146CB11A1FE2E7EB3E901F31A1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774896592, "uuid": "e051aa51-7831-4d14-bc32-fd1745524016", "value": "9315bef4b5484b572936d208e8b654a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774896592, "uuid": "c11e0242-b874-4b42-aea9-d28a6748686e", "value": "24576:DrpXmNMi9MxO4oKAovTcPRlXlmnVjzV/2FxvNEYr8oSUGeP9PDkjjqX:DrgM88vYPfUn5zqxvWCXSZeP9PDk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774896592, "uuid": "122372c7-bec9-45ad-86e7-62de0b31f2e0", "value": 2973696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774896592, "uuid": "86265787-15ff-4d44-aea6-0f4fd4c7203c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774896592, "uuid": "8a203618-9fcb-4b0c-aef0-05fad723677d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5949eef-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853899, "uuid": "a2661ce1-9d93-4f4c-a482-2d9e80fb5c29", "comment": "Malware payload (Mirai)", "value": "4ae6bfd217819cb335c720e562aad0ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853899, "uuid": "b7b52b50-6d4f-4385-be12-e35ff3ac963e", "comment": "Malware payload (Mirai)", "value": "3efe93f0c0b131fa6458770452eb2fe66d070cdd79e80140c677f974334f5c48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853899, "uuid": "abc7889e-72f7-4379-a13b-fa471dda7bed", "comment": "Malware payload (Mirai)", "value": "4476d2b3078deb5b7979d7705a148d6efc666b22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853899, "uuid": "08a7b31b-c64e-4fb0-93a0-1d948b87c90b", "comment": "Malware payload (Mirai)", "value": "14c210cc8ee63deeedcbfb9ab3330d57db6f02ecf18bfb6e522aeda9c3f7e20ff361e473d0143246927af9455468c460", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853899, "uuid": "527df697-853f-4708-92b9-ed8fe4f0cfee", "value": "T11304BFA3B34F2491C87106F80BCB6B9D262361125DA7DAD76C6F753A5E375DE08023E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853899, "uuid": "1a41f7a2-aa26-4807-b7ef-db31f0bf881d", "value": "3072:ADBdjwnSSY0VLtsYPtkchPPd2WenqkxJjg/ClTK3KiyMq:mX0LsYP2chXdCqk/yCdK3sMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853899, "uuid": "258cecff-4063-4494-b711-9a8dcc7cc67f", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853899, "uuid": "731a67de-8fd8-4fa7-b631-e25263b302b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853899, "uuid": "902e419d-aaf9-490f-bec2-f600b020c88c", "value": "kurayami.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c84fb22-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853132, "uuid": "d31b784c-befc-4ed4-8b2d-c28d4c9ed510", "comment": "Malware payload", "value": "0578c47faaf4ab97682b82e6ca40e9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853132, "uuid": "6afff0e8-eb05-4422-ad5c-6467bbca6b50", "comment": "Malware payload", "value": "3f4197e11f3302d776639170a8ed193aba1960aabd1ae98e2ff7e9c59e8ef23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853132, "uuid": "57bd9ed6-6408-4450-975e-bc7637de4296", "comment": "Malware payload", "value": "5407308314ea9f345e9b6d28b3f2321550e9929a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853132, "uuid": "d532dd41-40f3-4c18-9933-c56d1e26cf33", "comment": "Malware payload", "value": "f08d4e51d4b7df89e12ff54f3ab5ea141e84cb141e9d45a0a1655269d1654a47b579ebb382b8d9f252785b2d98cb18da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853132, "uuid": "02925a72-f63c-4b52-95de-f56d7b492dc6", "value": "T11CD4AE24F7578E62F389277481E99740A3A99B5A9BA3F34B340831F8584238BDD075F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853132, "uuid": "4602c1a2-2b90-4883-a125-46e61a8dd568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853132, "uuid": "bb75d20e-9619-4549-9510-0b41971d3013", "value": "12288:y4zEbAXiknsIn5OQkVz7LwgWjA2cGMA+E3UL/AHrrvW1qU:ydAXDsI5v8ogQA2cGM3QUL0rjiqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853132, "uuid": "766a0954-9f42-43e8-8fd3-966238fa8c59", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853132, "uuid": "9783c9c0-8516-4c8b-aac8-943cf8ffae3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853132, "uuid": "771b883c-8ccb-476c-8bc6-b0b53135f9c5", "value": "0578c47faaf4ab97682b82e6ca40e9c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac77866-2c3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774876859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876859, "uuid": "6c614eda-9286-477c-902a-693dd1da84cd", "comment": "Malware payload", "value": "0067afee74f2613496cb362f654b24a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876859, "uuid": "aa2ae517-0ffb-481d-98af-6d9e68ef9798", "comment": "Malware payload", "value": "40517a7274f989a4a9deb13160f0695772bfda13826b4e67a01140ef95432c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876859, "uuid": "a82ef96b-0d58-4937-b042-b6784f849f04", "comment": "Malware payload", "value": "539eb7e386f16d7f40f63adfd3c84b29dbf0f5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876859, "uuid": "3aa906e1-a283-4694-99d2-847f6c0a18f9", "comment": "Malware payload", "value": "dcea86fefd27b187e53d6487bf15532d07b95505508d20244898e1c09fc3eb51af8649c2748f6fc1c648cc57a86a0c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876859, "uuid": "97ed0e4d-2c3f-4507-939c-205dd26edc53", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876859, "uuid": "5819961a-d5ee-4787-86eb-5b23a6142b84", "value": "3:Wlt:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774876859, "uuid": "e2188367-82ae-454e-a291-38b69ff51bb6", "value": 64, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774876859, "uuid": "a0c7d323-c2b2-4a9b-9ea1-a6d4cd997c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876859, "uuid": "1df724d7-f1bf-4d58-b620-08f678322298", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7d6cd-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853967, "uuid": "3925e0e7-21e3-4fef-842f-ab81e7031641", "comment": "Malware payload (Mirai)", "value": "cf2d7e478bd59ff38b959f5e6e8e7215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853967, "uuid": "349b06d5-f01b-4dfa-a5eb-5b1dd437ef41", "comment": "Malware payload (Mirai)", "value": "4099e66fb2d7464096cabfbfdf2740c42facc1505a5e1fb8d47e42fd74cc160d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853967, "uuid": "318fcc4d-464b-4134-9aeb-6c0ca97accf9", "comment": "Malware payload (Mirai)", "value": "15511eac8327c329d46be12eac33e49d2754a9d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853967, "uuid": "6dfc6711-0089-4854-9e64-de2032bbbd20", "comment": "Malware payload (Mirai)", "value": "7efd38d4fa42c58bef62767df98cc485e2edc7cfc124007b0ff37c8fd85bd672af3967949ad43b9946ff03b9a3b14802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853967, "uuid": "296af105-6c28-4a32-981f-0a18edf403c0", "value": "T1A8141886F8C18F11D5D012BEFA1E128E33135B78E1DE3212AD255B21778B9AB0F7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853967, "uuid": "608ebe72-531b-4073-9461-caba0966c4f1", "value": "3072:SoHOLb7otuoJBONyMdUyGBZ1XSQHjoWaS7rbdKtuSarTErqx61:NHsbFA0kMdJ41X7HjfaMAtuHTErqx61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853967, "uuid": "462b1255-31f9-4d40-a94a-6cacfc527613", "value": 196988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853967, "uuid": "c867a355-2743-4fbf-bc49-8f1f7d55b3ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853967, "uuid": "b8a9b2ff-6979-4c28-a55c-3e13579b9338", "value": "kurayami.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17de2e79-2c27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868184, "uuid": "d50c60ea-821a-4575-82b7-c960167773ee", "comment": "Malware payload", "value": "0cd18db736762d9416d553a1d377e705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868184, "uuid": "a8814a3b-d932-482e-86b7-eb0436ba3644", "comment": "Malware payload", "value": "40ff49194227b67044cd908f885cc45c9ec8af8c4c0c45be8829291018a1a23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868184, "uuid": "67d0097f-eefa-4644-b3c8-d2fbb05259e0", "comment": "Malware payload", "value": "d92764c85d6bbcbc6e44d02612add939a643ba31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868184, "uuid": "7122ab2b-f126-41e8-b987-83ed48f579c6", "comment": "Malware payload", "value": "b9b132ec8eba61fbf3da11548e4928c64fbad72e42532738e0c958e4df3415f117fe8e239f5a8ad42040ac23e66ba208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868184, "uuid": "57a821dc-37e8-488d-9c84-c566eeb5ebb3", "value": "T1B285BE51FAC681F3ED820A34619A9B77DF3D56580724C9E3D2801D69E9202D2E73E7BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868184, "uuid": "54281185-7cd9-489f-8696-507cbd27c0c5", "value": "a674842875097e81fa2b2431268afd76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868184, "uuid": "e1dd4d22-1e63-4b63-b714-b815af8b77b5", "value": "24576:Cu1bOG99ECZAfLTj70N1C2RFU0j6WATR06mbkkU75V4DG3Z6Iqyc/YJ53NNhPC3U:CuJJN0al6FFm04q3ZWtYZChBmq5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868184, "uuid": "6d23ac2a-58e4-4c0a-8adf-c34a0da34cac", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868184, "uuid": "b6f0d0cb-a008-44d9-9f22-0c306a285d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868184, "uuid": "000ecb39-3e0f-4436-98d5-422cd83e0263", "value": "RuntimeHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec8b404-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774883791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883791, "uuid": "91516ba4-ab49-4db5-a1f0-8a70597feaf9", "comment": "Malware payload (RemcosRAT)", "value": "4a248ffc46712f92638e289f3ae0babb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883791, "uuid": "aa6e850c-24ef-4424-95ad-e89d61b5fc01", "comment": "Malware payload (RemcosRAT)", "value": "434fe31c97eb8cb0b0a917ac582bba2fff11e02544425164fca7cee520d239f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883791, "uuid": "dd8e0c5e-d761-4380-95fa-d797686f227e", "comment": "Malware payload (RemcosRAT)", "value": "750f7c54690c015ed030ebe6efc2988f74dfb54d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883791, "uuid": "bad39cf4-d4d3-45cb-9e0a-179200ac28a8", "comment": "Malware payload (RemcosRAT)", "value": "db8c8d693c897d7757905cff172ac6477edc9df39311a8dc69572782973ac0aa9800d9c43ecfabca2be42f3289af4f5c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883791, "uuid": "c61fe82b-a681-47ac-8542-099af245ba98", "value": "T1A515BF013C80D031DB9A21715B3EFBBD5A6DA8300B6875DB67D839BA9F605C16F32687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883791, "uuid": "dc062441-d472-435b-9070-cb1b755023cd", "value": "b492aabfbf2837593f4568452d907063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883791, "uuid": "3d9bf406-611c-4bf5-805c-bd1002cf1c94", "value": "24576:lzHD6nL0NOPKiOaWDH72rBJYBn/yOgL9usm3t31:Jj6nL0NOPKiOaWDH72rBgn/yOg0sg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883791, "uuid": "3b13b689-bd8c-4b9e-8cdb-da10bc9ef4e9", "value": 941368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883791, "uuid": "b934c07f-9baa-4192-aee6-58c61cdee3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883791, "uuid": "4a76fa59-ead4-40ef-baa1-3f427654d3c4", "value": "434fe31c97eb8cb0b0a917ac582bba2fff11e02544425164fca7cee520d239f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab4e49-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853914, "uuid": "d9e6ca41-c355-4e9e-9663-b9a7107600df", "comment": "Malware payload (Mirai)", "value": "00c44f5734f9d5003e56a749653fc1f5", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853914, "uuid": "0f214c08-8040-441a-9db1-96a562581285", "comment": "Malware payload (Mirai)", "value": "43929c55f1ce5cd5b573960734f53b3295a27b0c8e994b2a62aa7be767899e8f", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853914, "uuid": "a6dc9cdf-3845-4c8d-84f4-3818e97cea0a", "comment": "Malware payload (Mirai)", "value": "4cf031c3f60671a900b5d35014d1db0b4aed3647", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853914, "uuid": "170fb952-c14d-4caa-8345-c1446a7c4179", "comment": "Malware payload (Mirai)", "value": "26c15e6f70cbaabb1334105fbcd5f2fef6ac7f69066c27142d5e25550a8d0c8b3152a54325e5eb7b0ff4e37cd031b2ef", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853914, "uuid": "c5435f4c-6207-420d-8237-26a10342efd2", "value": "T1FDF2F175A67F70B4DBB2E472B028CA9CD24B59EAA1F4723B2CC00A79D0D500ABD35247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853914, "uuid": "ecbff15d-ee24-4450-9248-fe0e0c11a06a", "value": "768:8pxQBX9ACn0tmkFXL7Lfa0ZlafgEOIGr2PLF+kKLiM7lhs3UozM0p:8rQDAztmk/sfg5jracHLPez3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853914, "uuid": "0ffc15a3-fd7f-4984-8b92-78ed2c797690", "value": 34600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853914, "uuid": "229b794c-43fa-478b-9667-61e7d78c352b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853914, "uuid": "e577a0e9-b8c1-4958-b7d2-abc839991c0d", "value": "kurayami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173e07b1-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912421, "uuid": "cae8953a-9d23-441f-908b-d62d24e10ee3", "comment": "Malware payload (Mirai)", "value": "f639725ab3e18dc3b36ea31013e2834f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912421, "uuid": "cdff2a46-bf8d-4fea-8f3e-4f65c8ec0c4b", "comment": "Malware payload (Mirai)", "value": "446f4e4d25f2b3a99a034b1fb2b4b0fee48a82ba02346f068f2bbf5238e38f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912421, "uuid": "9d7afc6b-2595-45b9-8f86-40c5e3939f0f", "comment": "Malware payload (Mirai)", "value": "1a0b9fbcd21d1df0c95b9d6263cc9f4f366119ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912421, "uuid": "afe364c1-53b0-4d28-96d6-e920eafa639f", "comment": "Malware payload (Mirai)", "value": "9c34c0648c76b3770b5d72cc6c9b71309c9c1c7e7983ceb31024f1cf4640ba03f658a5d92ed8565634de825ab7c75e96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912421, "uuid": "a249b83d-c983-4e96-a9a8-e1924574f4a1", "value": "T1DE53831AAF650FFBEC2BCD3705A91B49349C640A12A93F367934C918BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912421, "uuid": "47e6b3bb-3c4c-4f0a-87cc-dbe75aa7055a", "value": "1536:SGF/Q8QKCTeDcVfR5z3XUAFo8CGHaqirZQ8yMp:ScKKC6DIHzHUSir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912421, "uuid": "3b4a4980-ada5-4087-a951-f0738d60a6bf", "value": 64364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912421, "uuid": "43058305-f2bc-46de-b468-9b6a1393afda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912421, "uuid": "c624d3fd-16b5-4e47-8a34-aa3cea17890a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a02391f-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774883783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883783, "uuid": "20031c5e-5e44-4a55-b58a-37a9bab3f773", "comment": "Malware payload (RemcosRAT)", "value": "93e4f3fd6c0001717cf22ebb32723a0b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883783, "uuid": "f5f38824-a935-4569-bd25-0783baf07e19", "comment": "Malware payload (RemcosRAT)", "value": "44f23052f2fd19cafef38adb1d146e348a8bd9b61c4ce608ad062440ec364286", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883783, "uuid": "067fe39c-19e7-4aa8-bbc6-35f55bb22a70", "comment": "Malware payload (RemcosRAT)", "value": "da3e4f549e80314973f8c10ebf039c9604f8f26c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883783, "uuid": "bf67d7b6-6a86-4090-a846-7d0703fe6676", "comment": "Malware payload (RemcosRAT)", "value": "647bc0739b2d1370990c78cde2ed5cff9a006a7afa58f194a7b8170c5076e2069bcad3a1e04d7473b6faddf516626fba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883783, "uuid": "a19a2228-9090-46c6-9abf-f8d0426977ea", "value": "T1D325BF017C81D431DB6A21B14ABDBFBD4AAED8300B6459CBA7DC68FA4F705C12B32657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883783, "uuid": "fe111c97-1dcd-4c9d-a26d-fb43c8518586", "value": "5799f031b5c4ea5a5a51635c0de03869", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883783, "uuid": "c234875a-b5b3-45b6-8bb1-d8ebdf0cabba", "value": "24576:umBgPDgUcuaBHFn8y07ByOrW9xLF1Pxax//QM7tNLZA4:FMfaBHR8y07ByOrW9xLF1Pe//QM7C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883783, "uuid": "a7686fec-cf3a-4ea5-be9b-eefd9782ba3b", "value": 1008440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883783, "uuid": "8e60a51a-f3d3-409a-bb57-41e349a92f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883783, "uuid": "995d6a44-3a8a-47d4-b99e-82d3aeba7121", "value": "44f23052f2fd19cafef38adb1d146e348a8bd9b61c4ce608ad062440ec364286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4823ad81-2c79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774903483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903483, "uuid": "5a22eee3-7fa5-40f8-99f7-0dd26681ab75", "comment": "Malware payload", "value": "3a64f186f63246aa8b8e36639ef08b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Hosts", "colour": "#3EB039", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Staser", "colour": "#91A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903483, "uuid": "57da110b-f7ba-4511-9fdb-0adab74f0f6c", "comment": "Malware payload", "value": "45e561732f51c86136add911e40f0106d62aa8d6bf7427393ea9afacd4adf6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Hosts", "colour": "#3EB039", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Staser", "colour": "#91A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903483, "uuid": "1d1f9fc3-6a77-4d78-8749-aa63b7792adc", "comment": "Malware payload", "value": "3d60540d567f717f402bcfeed953628ba9a03d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Hosts", "colour": "#3EB039", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Staser", "colour": "#91A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903483, "uuid": "88b3cdaf-6f36-4ab1-aff5-a385a7e93748", "comment": "Malware payload", "value": "f8392313e6f1fbc695a4906e9ebd9c78eb304ef49cfc931bc9025f3cb184a7aa57eba4ee0d3f85900eb09eb70c229351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Hosts", "colour": "#3EB039", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Staser", "colour": "#91A23E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903483, "uuid": "47f9637d-166a-4f5e-b265-2958b761840f", "value": "T129C34A6EB15360FCCD26D23487E336B2F13338E86171AD2746A0A6753E706917329A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903483, "uuid": "6c5f5053-41a0-4970-aa6b-033d5ba31f5a", "value": "783b0d703be787781566d709b0e216a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903483, "uuid": "2a0de7a4-edda-4878-a653-1c6cde31f547", "value": "3072:qNc7Bfm4rD8QQImKlgW3nqg9TKs3hNSx:qNcFD8LKl/3nThMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774903483, "uuid": "115e4e07-882d-48cc-b89a-6a0b4a018ccc", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774903483, "uuid": "536912bb-fcdd-4460-a027-7ef98bfd0335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903483, "uuid": "d9be267a-3c94-4be4-9253-442a89337d11", "value": "winhostg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4732d63a-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774853231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853231, "uuid": "eca6c78d-da8a-4936-acb4-43f86f3075cf", "comment": "Malware payload (Vidar)", "value": "678b611a2d844057a1504001aa218412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853231, "uuid": "8803d33a-0a8d-45d6-b706-1d9033e11556", "comment": "Malware payload (Vidar)", "value": "47fd26b0a4504fc3a363580a57e95e1a98b14f7b0066e6b97c9f4ec4ed55ff43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853231, "uuid": "af00c2be-f418-4ecf-9a66-53686928f758", "comment": "Malware payload (Vidar)", "value": "c6354d4d8c9c994a49806988e42917f70e50d420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853231, "uuid": "a8b057dd-a4f7-4936-981a-d78b5917fd9d", "comment": "Malware payload (Vidar)", "value": "189fd1be015faf10d99f0de73292f4cd8446a4f527f13cd6a79ffd98f0e23b6646e0f375a04c322852efe0fb62a49bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853231, "uuid": "9bb02280-ae3c-4f55-bbb3-2c7a30217377", "value": "T10F958C0A7CD109FAC0AA63328DA762917B71F8490F3223D72E50B6793F766D09D39758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853231, "uuid": "bb50298d-e5aa-4488-9c2a-e0e1d620c443", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853231, "uuid": "12073909-ca0e-40f9-ab97-92a4774544a5", "value": "24576:ejW6sauQT1/s20HugNbEOimtXUlSdINGSC5Va4nhele5nK23TPGKnj:ejpsHQTK20OFsSgbd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853231, "uuid": "0291dc49-de36-477e-94bd-8f879dbbc118", "value": 1917568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853231, "uuid": "eb112b42-d5e0-4466-b5ea-57f6b13ae7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853231, "uuid": "6355471e-4a49-42bf-83b2-80768e229c7e", "value": "47fd26b0a4504fc3a363580a57e95e1a98b14f7b0066e6b97c9f4ec4ed55ff43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180076c2-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912422, "uuid": "232de9bc-4cd6-409b-b1e4-b3bf82dee66a", "comment": "Malware payload (Mirai)", "value": "c5dd72c21672c0106052ca5d314f4bbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912422, "uuid": "82595a95-2356-48eb-b547-19c1feddeb5d", "comment": "Malware payload (Mirai)", "value": "4885331407de9b6c53c1745baf61d02cee868378f20e9d4e52f9319af7e57d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912422, "uuid": "c08d5ba4-18fc-41c1-8c54-eb5e56f25e86", "comment": "Malware payload (Mirai)", "value": "7dbbf91867777cf7d67041166bf93f89f4ceeed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912422, "uuid": "ecd5c796-f3b5-4875-bbfe-7f98435dd34a", "comment": "Malware payload (Mirai)", "value": "e0ed0cd1fbbf24a582acecc82f58b6e95ceff0c5b422f20d9cbdaff1b889305c119884641cefbb6e8de338c020b89ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912422, "uuid": "be62f029-7e33-4aff-bf61-aac6e6e9dfb8", "value": "T16F230894B9819A17C6D0537BFE0E42CD3726A388E2DE3313DD225F6537CB92B0AA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912422, "uuid": "5e46b1e2-4c2d-4962-b58d-b1c153ab6425", "value": "768:jQGsyO5cPVQEYJVvKwtPFVcmlu6JjnNCR6gPj5+uB4Pl5Q1zL0lkb8FWBMcEZz3:Ux+kvH1c76JJMPj5+uBaluyyb8UBUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912422, "uuid": "b7cd2865-73d3-4e34-ba7a-1962a9db5c37", "value": 47936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912422, "uuid": "26aff068-230c-40fe-afb2-a2b73b5acebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912422, "uuid": "2352413d-fce4-47ce-96f8-4fe33c05d722", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c850c0-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830520, "uuid": "3eb7f4be-baa7-4681-8888-614170dfb32b", "comment": "Malware payload (Mirai)", "value": "3edc9719407ba5071612649c37f6b28b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830520, "uuid": "a0f3e0eb-812a-48da-a260-5aeaceab5e81", "comment": "Malware payload (Mirai)", "value": "4b26846adb2ac4e7f5a17e7da697a36611b080ac77702ac3290faef6c8353b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830520, "uuid": "c683b304-90e2-4c17-a968-1eb8013deb85", "comment": "Malware payload (Mirai)", "value": "b9f1a8d254a9993a5093a611b3b6c69688502c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830520, "uuid": "30accb15-802c-4ec5-8283-a9f9f8ceee43", "comment": "Malware payload (Mirai)", "value": "d291954899146c7fab98eb750b2e600cdb7fdf4c7a85bd573fc092fef121d3605f11024ac14e2950e98b275e4f5b190e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830520, "uuid": "b0821bdd-06db-4b29-9a61-9ffec4d158a6", "value": "T192630235418734C2C7120A35C9C8C4D6BE1C2AFDA5BEA9878DB9C96C2267644BFB4D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830520, "uuid": "8734ecb0-1a81-4631-9cea-9d5ff6c73627", "value": "1536:kRMSbdHYEnQfaib05SM7ZAaI8qL/B9kU+09Zi:kCSbJYEnLVjZAa/qLpmU+0zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830520, "uuid": "9308e0dd-f5e6-4b41-b0b4-29d105a7c668", "value": 67416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830520, "uuid": "6498c724-eec0-4a71-8824-d2750dfc0769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830520, "uuid": "0b6af0ca-c94f-4668-8f17-5b2866f720d9", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64c3d9d-2c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774914003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774914003, "uuid": "7a98754c-cbf4-42a6-84fb-b41f193369d8", "comment": "Malware payload", "value": "61fdbb52235404c975f7c0911035ea99", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774914003, "uuid": "4dc79d99-0cd4-4c8a-a827-f0914eb8fb18", "comment": "Malware payload", "value": "4b7ff1442740140182512514df9d8500de558339b868242a29f4dcd9b89c2861", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774914003, "uuid": "fb714fee-3259-4baf-8b9f-3157b8eb2350", "comment": "Malware payload", "value": "05339ce48de2c2c309b37177a2463aabd6613900", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774914003, "uuid": "d262e1c4-fe42-4602-94a7-f78e62c5fc6d", "comment": "Malware payload", "value": "2eba1e6f7d4209144462f2321b35bf3962db49d0c4ade5f66375ae0ce70126d56bf6bf4087f3e782b6bcdffa3d847fde", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774914003, "uuid": "7e48b0d0-2e58-41c9-b587-a6294f77a81f", "value": "T142D42BBDAD10E326F60CD0BAE282D7538F213804123A75A719BD97241246973DB677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774914003, "uuid": "db7d5fcc-f947-42ac-aae3-32570a096c13", "value": "12288:Ly0Yj34rhLooycHr2BIEDJvnhKaMG01W/KD8XV339S:LNYD4rhLbxHr6DJvhKaP01kXV339", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774914003, "uuid": "f8e2bd25-924d-4b28-ade7-3a4280491854", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774914003, "uuid": "8d604301-5901-4470-9cb3-ebe3cca15c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774914003, "uuid": "03936358-e1c4-4fc1-9b90-9be4370d1746", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f94d7-2bd1-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774831372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831372, "uuid": "272f3230-5c0e-4a43-9e2a-f0a23364f714", "comment": "Malware payload (ValleyRAT)", "value": "1aad15cd0b16884ff5fcbae5d3efa652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831372, "uuid": "0aeac78d-84d5-4433-a44f-21d96960369c", "comment": "Malware payload (ValleyRAT)", "value": "4bf8707ee3eae011e239dca5f7dd1c79e6c564542f3fa9427e3657b35c578c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831372, "uuid": "88041618-1e60-47ff-b417-31552097fd8d", "comment": "Malware payload (ValleyRAT)", "value": "abc39fdcae552935b7f5715ab52fe61dd335864a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831372, "uuid": "a56ba318-7b58-43d9-b4b8-78b4c8d36a0e", "comment": "Malware payload (ValleyRAT)", "value": "dfadb367db4e99a9878db6d0548cd5d2150d1bdc6d28953a2744f7aecf636eab12bd819e282456319fffa0da3e2b5555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831372, "uuid": "9f769f05-cdb7-4918-81cc-43664f4fa7fd", "value": "T11E477D4A72B811A4D17FC07CCA578607EBF1384903B1A7DF16A196EA2F23BE1653B351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831372, "uuid": "12b0a253-6414-44c2-a8c6-c07597f2748f", "value": "f2d5024be2da1cb1960c1e79d9066478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831372, "uuid": "c8d581fa-c29f-498d-80d6-cd71c07f776c", "value": "393216:1w7BBazMVR/9yllKYVE1C3d8S7dUpuqh3SkdvBhjP8X5jN:/Tqb78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774831372, "uuid": "e61ed2cf-0b0c-4512-842c-87d5510b528c", "value": 26078208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774831372, "uuid": "1bf6ce98-940e-45fe-b695-4c598a33734b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831372, "uuid": "e103fc79-dc0a-4e36-8d3d-2ff98f4bcaba", "value": "69c64a451eef3_doubao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bc38dd-2c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774890063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774890063, "uuid": "65dfa604-e158-4562-bccd-6430a48c82b5", "comment": "Malware payload (SheetRAT)", "value": "7e2f438805ae1f3897cd5a526e419e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774890063, "uuid": "c5bf6209-f90f-4d21-b474-65d6cbab294b", "comment": "Malware payload (SheetRAT)", "value": "4c192817f54f244f3988505f6d6ac3ac5205ab6051fabb5b4419be5a9c529dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774890063, "uuid": "a0a0939e-d9c6-488c-847d-a43c6adfb7bb", "comment": "Malware payload (SheetRAT)", "value": "a29d90a3bcce0e5efeb3927fb8235a739391ea62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774890063, "uuid": "3c7f6325-a9ee-487f-b338-a9c691367f43", "comment": "Malware payload (SheetRAT)", "value": "b9246e31d7d91ada870eb2811a823ed80f4c72ef823e47431d9182da6da83e6e5676fa1a3d8a304f53939c55f25843e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774890063, "uuid": "57aa8bdc-a974-411a-bcf7-d3532a54fe65", "value": "T17B84D60CFE91F805DD2A3D77CBF610144B7126C12E219686324AAFFD8B5A37658A71BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774890063, "uuid": "02e54560-d4d1-42ab-8d1e-3d263e8a588c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774890063, "uuid": "687aa574-cfc2-4f4d-92c8-2336d3e3cb6b", "value": "6144:eIkNzuKcgCu+5vEe6VlWT8b9eLSJUXDLxuW0gU9QRbZTV1:8N6Kv0cPVle8y2UXxIgZTV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774890063, "uuid": "dddd481b-6622-4272-ba50-a2dae4024618", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774890063, "uuid": "ddfc2b23-974d-4b5c-859f-84113e0333b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774890063, "uuid": "bbf236ff-3f1e-4e81-a425-30182ae3eb2b", "value": "Clint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe5a01c-2c08-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774855198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855198, "uuid": "0ff8631f-1ec9-4611-af1b-b7376b9b6a91", "comment": "Malware payload (Mirai)", "value": "66ff03f5365428aebe374ce8b6c0f3c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855198, "uuid": "2886cc48-ec95-4350-a744-1fe443bd9130", "comment": "Malware payload (Mirai)", "value": "4c2fdb14697376c1eebc362266536c5115e71cfc1fb21aa0c44d855cdd48beed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855198, "uuid": "eaf4c5cc-2268-4513-b345-edd0b2336969", "comment": "Malware payload (Mirai)", "value": "413366e3610f7c88f73bd197b19359d020bd6751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855198, "uuid": "c7dbb1ca-f2bf-4a3a-b247-17839afeceab", "comment": "Malware payload (Mirai)", "value": "08d4f84fea9ed62baeb3ff4ec8d85e2578272ef708e9b89927306a82b839fb3d5cc3cea564393b11c39edf265ac6b860", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855198, "uuid": "d326d2c6-4793-4c6f-a667-8ae6bcae621f", "value": "T14C83C606BB550FBBDC6FDD3746B9071535CC651B22A93B363934D828B64B20B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855198, "uuid": "a40cc5c0-9e6c-4276-9b6b-ab9d6cf1fb40", "value": "1536:C8EE8BuAlXfbMuWqeqFUq/vG7UUrQqZMsDhrFLw:bh8Buqvvr/vG7Eq3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855198, "uuid": "6e2c44fc-b292-4ec8-b3c3-d6fa12d3a335", "value": 85200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855198, "uuid": "d2b4a6ee-bb80-4ea7-9ef5-94b347b437e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855198, "uuid": "0db23a57-03c5-4030-a5de-716c6a56d688", "value": "mpslk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825001bd-2c6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774897997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897997, "uuid": "5f8858f0-f8c0-4ab2-a75f-e55b5140f1d0", "comment": "Malware payload (Mirai)", "value": "ce2e8460788f2dbc1059a3a46a656413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897997, "uuid": "f503e31e-b4a3-47ab-ab3d-f63a0a7e2c1c", "comment": "Malware payload (Mirai)", "value": "4d1a284c4ddb0bcd930b456c330a2dd1f2ccae7f37c61a7470bbe06b5458402a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897997, "uuid": "e2bb4a43-8f45-4e1d-9a58-cfc70b4e3595", "comment": "Malware payload (Mirai)", "value": "943be1c2d304fe5679c7960683b15159b74a07dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897997, "uuid": "50cf0780-5549-4b24-bfe5-4dcf9e9f6281", "comment": "Malware payload (Mirai)", "value": "2075205edde6b1fcf74b054856babe1beded1e988e7845900cd1640545d4f79aca3116b3ee59be890f387d31b9e3f988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897997, "uuid": "ee1c9cb5-45e4-455a-87f7-6889d8190ac2", "value": "T17B835AC1FA8B80F5D4074830116BF73FCE32E5654261C62EEFA9DE36EE63542A91664C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897997, "uuid": "00ad3f09-0fd0-4be5-95a9-1b3bc05e4a76", "value": "1536:xe1Pv8ucnATIyOzw+wMKj8ybS6YWjc0HheIc1cgrE/yez/zU6:wJv8ucnAcyOzw+wMuLGOw0HRc19r2w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774897997, "uuid": "bee140c4-2998-4c84-a26b-80bc3613158e", "value": 87440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774897997, "uuid": "1544a962-6e89-4fd6-a7a5-6f40a5b173b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897997, "uuid": "fa3f8066-6715-4c80-8825-c02cfd4af58d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e27738-2c53-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774887345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887345, "uuid": "d9c7a7b9-75a5-4548-a827-376e14fdaffe", "comment": "Malware payload (AgentTesla)", "value": "2a8bd9a84c5bf2ac9fd35f4dc1712e05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887345, "uuid": "cf9e3789-6756-490b-b968-79a8e0f650e5", "comment": "Malware payload (AgentTesla)", "value": "4e3e9fc624e6a7a31aefe47d92711abfa24589a8371359c1323c940e84cd151f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887345, "uuid": "7821800a-0995-4bcf-9b5b-4f5e1c8d2278", "comment": "Malware payload (AgentTesla)", "value": "97bb4fb2db9d9e7e2499815f26aa410b8f4f5b32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887345, "uuid": "b19814fa-ae95-467a-a12f-fe550b9d183c", "comment": "Malware payload (AgentTesla)", "value": "a689164032ef7c773683a718d5fcec683a1c75a9bf79bafd4f2639e935a4c4c67335ce5bf90c3e8ca323e103e15f79f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887345, "uuid": "e78dbb3c-119b-462a-909f-ef4b8db3cc51", "value": "T15D56B408E4F4755D85D2EF998A32A5A048CEB0AB3E4DCE67A01F057C2D62FE3A5504DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887345, "uuid": "0ed0bbf6-060e-4987-bf17-c1470ae1dec7", "value": "98304:CMpCtKmXF9lzo3da1AJUEHbPj65D3xJ52eRZbiHZ4cPSE93G5DJNu1TmHnF3dtCn:hCtKmxotaiJUEHrj6FJ5DRGXKEmDJNgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887345, "uuid": "6518de3c-80e7-4e40-abea-936ce0a1bb22", "value": 6203356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887345, "uuid": "f61546dd-e2ee-4836-9b93-b22df3ae02fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887345, "uuid": "40e289bf-6bc4-4a52-ba09-aa988b2d7ed7", "value": "richiesta___e457327662.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ce6d2a-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912417, "uuid": "85e1504e-4aab-4fab-b6c2-053579a6d176", "comment": "Malware payload (Mirai)", "value": "c5f22148c28aedd723f026a5616ef707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912417, "uuid": "936a361a-44ae-46ee-b89e-251960da4f14", "comment": "Malware payload (Mirai)", "value": "4e965cf78d36680d88890fc0df2e41d81f289c407eae66bb4749532f04240e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912417, "uuid": "80e208ad-c476-40c7-981a-ae288117b429", "comment": "Malware payload (Mirai)", "value": "a9ba657a8d849e3a8e0e4a20bc0120e7720a7da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912417, "uuid": "d1da4477-5c08-4b52-a126-65ee3227a815", "comment": "Malware payload (Mirai)", "value": "d189f4c032d220b244e3d53e18a4c7c517ade670b3a45e1e986056e8567ed2b10dba20397495337f9cdc3341868adaf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912417, "uuid": "10302fa8-045e-4be4-83e8-22755372c82b", "value": "T1C91339D6B400AD7DF85FE77EC0430A0AB531B65505831A3762A3FDB76C322A85D76E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912417, "uuid": "cb1e5f53-3c9c-4715-995d-c6486110b3c1", "value": "768:Oqh/D4t0MoRjR6Uw0Ae+kqbcPHWluv811ZlTt/GtYYVS0aiwfXNEH:OCGWFG5elVHWkv8117t/GTclzeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912417, "uuid": "de8d268d-d2af-4bf5-a754-4ad171027ae5", "value": 45512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912417, "uuid": "036a439f-187a-42f2-9450-aade59a335cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912417, "uuid": "187d11b4-a6aa-4245-a152-03bb3b957268", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2529b3-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853907, "uuid": "689de8aa-5a6e-4d6c-8722-4dd137d7b9db", "comment": "Malware payload (Mirai)", "value": "e816d3bd8af1c5dce5cf3a8b69c9e095", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853907, "uuid": "ec6b1a16-45ac-4ef0-bf75-2b88a04e2072", "comment": "Malware payload (Mirai)", "value": "4ef8ad9cf632ce26be2f565262ded3a22842c586313a16d38ee4777e5f85f96d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853907, "uuid": "b0d82777-4350-4cb1-9c0d-19901d24c353", "comment": "Malware payload (Mirai)", "value": "cef86daaf76ae8f52561602b56b4279649ed1bca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853907, "uuid": "8ed17bc2-c2ce-4b25-b4d1-4f5add12e05a", "comment": "Malware payload (Mirai)", "value": "88cc67a2efe2debd7afec5157640c0d783f30c7ebe50598a5106f88f87c20641f5cae70e1ee59c8fe83b0a370cd8ab67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853907, "uuid": "76292ea0-f835-4bb5-9f44-70dcc27b5022", "value": "T138630298C711C9CBCEDB6DF40E547BF1A3326D08A57619D2B379878067E6E0A520ADC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853907, "uuid": "bdae87c6-42eb-43ad-b07f-dee150d126c4", "value": "1536:VjT9TY4ATMQiJ9LEf2q33MSwnI/FPZ7TKMMkqsLfZCkljeV2E4u+qgw09+:HY4bLPLEf933Dt/RZ7TNZwV74u+qgwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853907, "uuid": "f4654478-0540-48c8-a2bf-1fb9c1132a92", "value": 67684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853907, "uuid": "cf314af1-9314-480e-ab80-011cd974e898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853907, "uuid": "88b72137-9a89-4521-a55c-8456b5a02b14", "value": "kurayami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109bb6ad-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853139, "uuid": "7fd8b76c-f6ef-4e89-8a25-45e0850d1c51", "comment": "Malware payload", "value": "c424e479b40238d1b5dc10df5b7eb3c3", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853139, "uuid": "e297013a-2688-4b28-949a-b9fb2a4febf7", "comment": "Malware payload", "value": "4fa15e271c89ced8724966e1a53edd2f7f4434c6f58abf501599c8b98f005435", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853139, "uuid": "b2465ac7-f15a-4079-9ff3-651ffb492275", "comment": "Malware payload", "value": "5040e3cba69fe39df6ee0f793c2859641b9210ce", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853139, "uuid": "161b8bf2-392c-4e9b-9c16-ff727b0c3755", "comment": "Malware payload", "value": "e59281a94601e05c8098254606ff2a0d07d02d76d9e595283cb6a642983e55a61dbbc8d684fad2dbfb8153a00dccd087", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853139, "uuid": "e2fdee4d-8262-4ce4-9514-224d8159ebf5", "value": "T1224401BB8AC9FE3ED80C46F34863B5B0B10A4D4696B4B472A6170BCD4D8D54D065A8FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853139, "uuid": "e22a184c-40c4-4187-b2ba-169fd1e6a812", "value": "6144:Q0Hxktl5lNXlEMsBkUK1pownvPo1zv6UyqetxUpaezioP6a7pY:QSktl/NXlQBkUK1DvgdXetxUF9NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853139, "uuid": "b27fbb25-ab1c-4b39-90cf-8dac694a12ab", "value": 278341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853139, "uuid": "35990720-fb19-4a4e-aaec-66dad8df6666", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853139, "uuid": "b0fdaae7-2f6b-4f1f-8534-839791046212", "value": "SalesXContractXMIQOSZX040441XRevised.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44eb28fc-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774861387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861387, "uuid": "145c8d5e-ce7e-4694-9b66-343f74816f2d", "comment": "Malware payload (PhantomStealer)", "value": "a5b4e2795d8bd203c9be70c96c307d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861387, "uuid": "b1a5e067-ec3f-4ac5-a91d-f591602831c3", "comment": "Malware payload (PhantomStealer)", "value": "501738b2515bb3e418091fc3cd9408ee7f8d84b527c643be1ed6f8057353b20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861387, "uuid": "0666d5b9-1612-44e2-9f8a-44fcfcf006cd", "comment": "Malware payload (PhantomStealer)", "value": "9fb524d522284060b4a7e3e9d06cfb34980e1891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861387, "uuid": "f35fe773-a3a7-484e-a3a4-81da4c4f0c24", "comment": "Malware payload (PhantomStealer)", "value": "4fb17466e3de95878703698359293ceb2bdaddceb405f13045f3bb80651ba2f7ec34f74a6da67a66543bc3951f87f195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861387, "uuid": "26c84361-9397-41d2-b27c-76e840a52249", "value": "T1B3B2913CD6E5EDC0CB6B12F479AAB7C101ABDB07ECA7172CB9C815461E20754AB7468C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861387, "uuid": "239adc7e-f303-4ed5-9dad-efacbb78a277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861387, "uuid": "0207e915-3cc0-4575-81bd-f380ba0dcde1", "value": "384:Xz57Ngy0RmMH4b1Pk0XnYEzW3pjc83PmSB9lGbvtPYrt+r3Mbp9XhUDM5vmNR2c5:Xz57Ngy0RNYbF7YECw8/mBrtP+vbjqDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861387, "uuid": "12b43d7c-2377-47dd-a166-e6f49a8c55fb", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861387, "uuid": "502c0614-7c7c-4582-b7fa-eec829427615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861387, "uuid": "50a5b8f6-257e-452f-b7b1-aaffab8a8e8a", "value": "CHK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d2b7d8-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830564, "uuid": "812aff8b-0bf4-4402-ae16-d39f35102c21", "comment": "Malware payload (Mirai)", "value": "4ebc1cc2f9d941c92dce1d2d518526b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830564, "uuid": "9e7ed7d3-ccc4-4358-a123-e0062f00eb50", "comment": "Malware payload (Mirai)", "value": "522731428ca0e5b9c20d4b2ddd76e82095e07277969c193e2f1e77d82f457cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830564, "uuid": "2c0c3f57-b28d-49d4-a49c-52f88388d328", "comment": "Malware payload (Mirai)", "value": "66515528c8825be003b745dcc3ac8e64d9492ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830564, "uuid": "8eafc4fd-79fc-4c61-8648-41a46d0944cc", "comment": "Malware payload (Mirai)", "value": "5f2a38e6ac848331e81bbfd16bc2e263ee4452f46f96caf0b5414e179c6ce1743854ac92c3d4d2d792201673781e0f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830564, "uuid": "ec7733c5-de8d-47b4-ba11-0b3910460f19", "value": "T117431680FCD2996EC2D4137AA73E318E33A1B3E4D1CA3613CD585B25738A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830564, "uuid": "8f8bd19d-8c64-4d57-8cd1-a550a8a96412", "value": "768:/cyu0nuoHwf/StW3AQoy7EFMQ5Bl5UTyS8kTIM4cLBRKIoNiitsZNMfg8BNdTWnN:/lnrHw36ADbEFM+UpcMLLBRKTt27S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830564, "uuid": "9b1f3aa0-1be6-450b-8430-5affb07bb41c", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830564, "uuid": "86e4251e-f7cf-4ebb-ab6a-a9769767aa6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830564, "uuid": "29c6fd91-9e17-4734-ba20-db364226e2ed", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd09ae3-2c30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774872170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872170, "uuid": "03384805-7ecd-417a-939b-5e98ad585675", "comment": "Malware payload", "value": "49e06269c77e9f028aef505f2c92d5a6", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872170, "uuid": "a98adea3-1e73-4bfb-bafc-de5a6b6a45d5", "comment": "Malware payload", "value": "527f795a201a6bc114394c4cfd1c74dce97381989f51a4661aafbc93a4439e90", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872170, "uuid": "5ee71856-5d9b-4ea6-8710-ed9d5c2423b0", "comment": "Malware payload", "value": "193c4ef77cae0b08922aea0eebe4a14f22a7e67e", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872170, "uuid": "8dcb2454-5f8b-407b-bf41-afdb8db6d0d8", "comment": "Malware payload", "value": "238405774702b030f0cc12af493d958604ef867e7927c60492785ffc1079c083f8b01545efb2b11a197a939ee1daf762", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872170, "uuid": "954eec88-19a8-4281-99d7-7be98b0a26a9", "value": "T1D3816359ADFA792182B334FC672FD009E57D95131158EC10BB8C8AA09F1582893FBDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872170, "uuid": "e4016588-1aff-4e82-ab32-cd2b8029c29b", "value": "96:KBmqxHELy62uFtLKmnJEOgSNREoThjEL+y4Yga1lTuux1yEPncwwdXSyAJy5Cl:0xk9ptLn1nEoThgL+DYga1lauxgE/naQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774872170, "uuid": "8dc3eb11-e97e-4e84-885b-45616390dbc1", "value": 4202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774872170, "uuid": "14bcf839-60e7-4a45-8244-1abb5f324394", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872170, "uuid": "c1e9b7d7-ec4f-4a90-b49b-8a9067ee4565", "value": "527f795a201a6bc114394c4cfd1c74dce97381989f51a4661aafbc93a4439e90.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da04fe4-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830532, "uuid": "abf04b42-5213-423e-94d9-a2a6faaabfda", "comment": "Malware payload (Mirai)", "value": "31dfdf2f3f0c3f8c612f8635680c31ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830532, "uuid": "5a5b6a84-9991-4021-abaf-a41a83ce8903", "comment": "Malware payload (Mirai)", "value": "530c362961621cd44eef36f02bcd6ab5d1fe45e78a883686b53aa2be7fb3456c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830532, "uuid": "d50e67a1-ffff-4552-86ea-5f54ca358aab", "comment": "Malware payload (Mirai)", "value": "3c0f1fc241fbb4369b85891a886e43e8457f1971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830532, "uuid": "c7a0486a-449b-4099-8d00-53187a8cad22", "comment": "Malware payload (Mirai)", "value": "0086eb7b91f316a9f881acb675b6c64ff933946e9e5aab2a24fc6d75bf38f5f702cf670b379c0eb255f06411e9593140", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830532, "uuid": "95275cbf-f5a9-4105-93a2-b59c4c987997", "value": "T13D13F1F371277C315AF058F4DBE800011A335BBABB653DA78BA0422F67952EA38F0511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830532, "uuid": "96f1a015-e12c-4299-bcf1-ae201f535cdc", "value": "768:F7oU/wnvDrWgtOlcv65hzwL6JXfviUGhIGAu5uYg6rPYGSbbxs3Uozcg:5j/wnW2OlVr8WVfanhtAu4Yg6robcz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830532, "uuid": "2c86811c-103d-4558-8235-fcf809a0825e", "value": 41636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830532, "uuid": "9d1d3352-000b-4928-8383-3b703dd0dbcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830532, "uuid": "c0faaff1-468b-4a6d-89c4-62ba4473d516", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1a3dec-2c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1774884324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884324, "uuid": "21013218-e855-4609-9b59-416a6383488b", "comment": "Malware payload (DCRat)", "value": "033ef3cc1c3d944c67fabb4b8c25424e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884324, "uuid": "8c4ef329-8cce-40e4-9825-380c91d6dab4", "comment": "Malware payload (DCRat)", "value": "53c0fd7ee5d286a84725a9c7443d9b35f10ace5c0971d63f2c3bc18e814cff43", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884324, "uuid": "c5f853e4-caab-42d8-8296-58a0da5cb7ef", "comment": "Malware payload (DCRat)", "value": "0f2e33560d55f695bbb11f8a04328011c59ce5ae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884324, "uuid": "c205aa1d-9c3d-4139-b52d-02197787f87b", "comment": "Malware payload (DCRat)", "value": "e5d78977e8fb117315b70834a84a25e9c7c2a9de25210c36738598b681a352e826ad7934016d9715580592eab90c069b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884324, "uuid": "7103b62d-4038-4360-90f6-1da693b1f2fd", "value": "T1B5454A017E44CE12F0191A33C2FF458847B4AC51AAA6E72B7EBA376D55123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884324, "uuid": "b7e1aebe-8b4a-4e42-bc83-8a2e557d37b6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884324, "uuid": "6ef71aeb-f1a4-497c-933e-a173fb7a83a3", "value": "24576:U2G/nvxW3Ww0tmFoKAo4vFGzMdMt+nr4isR08bt:UbA30TdMjYsisRhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774884324, "uuid": "a48b482b-f135-4ec3-a33d-12dbe463464c", "value": 1164382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774884324, "uuid": "c3708dd4-7ca9-4bea-9383-1252369a51b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884324, "uuid": "3834df7d-9a7b-43ac-94c0-8842bfe39358", "value": "033ef3cc1c3d944c67fabb4b8c25424e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8671b82b-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867940, "uuid": "dd47b986-8872-4b7a-8791-b7b0e20c034d", "comment": "Malware payload", "value": "aaa4e75e8c546940845a742c8cd593db", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867940, "uuid": "94c05e0b-bc9e-43a1-94d0-2508afb0cc75", "comment": "Malware payload", "value": "5612d72f0e7c57f029b1ee501f2dc400fae2358ff782aa9e8666eb0a92f3395b", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867940, "uuid": "4ca6094d-985f-4769-935c-4658a96b09b5", "comment": "Malware payload", "value": "7dea7316998327cf8ad472dfcc85b5f25937048a", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867940, "uuid": "fdd65767-c10b-4188-940a-b42e49530fe7", "comment": "Malware payload", "value": "8bc941af663a9a912fc3f36450ab4b5d6f93b682ad4bb6c9f0f530899fe492ad59dcf4068a26899d9730f24926ac7c88", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867940, "uuid": "873b4d3b-58a2-4d95-8518-f46ac6a5a1b7", "value": "T181A423E59876AF1BDD99E4FE50D3EAE4ECE9636D81C8940B0A0AF9005673CD51239C3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867940, "uuid": "72318a80-4283-4ad5-b595-036ae438aef2", "value": "2fba329135cc0c3f76528bfb5171cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867940, "uuid": "b1c5c65f-b9aa-4594-a11b-47ea1bf3e641", "value": "12288:YFcQ2seHbztilQKpyeWkipZY+lha9EThgPM:yoF7ay7Y+l7MM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867940, "uuid": "180ad437-1eec-4bb2-975b-2ae63d0b89f4", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867940, "uuid": "1814c8a5-7c37-4fb4-8f50-09df92db4d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867940, "uuid": "6c2f9d15-3c77-48a8-a4f7-2f5cd5fb03f7", "value": "mozilla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1584fcca-2c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774887937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887937, "uuid": "a0ca6e91-65ff-403c-bf8a-272d3e929788", "comment": "Malware payload (Formbook)", "value": "61290f34e0563207a0fc0a9e4b35181c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887937, "uuid": "6af740cd-90f7-48c4-937f-7dba4006e055", "comment": "Malware payload (Formbook)", "value": "56f6193794056ad2198ce52e11b84663eaa5a16a7e5aed0b0c054239a4e7f8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887937, "uuid": "d0768a49-bdd6-4deb-90e0-dd37bcf7bbf1", "comment": "Malware payload (Formbook)", "value": "e9fae0724520a32a16824b2e530d7e7afbeb36ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887937, "uuid": "7a631e37-2497-4766-83bc-58b4b1e02ff6", "comment": "Malware payload (Formbook)", "value": "b347bd623d492220784174301ff82efc63f2c1039754bf344f0195c60bf6725da3e33d16e4656a0007e36c813a27a7cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887937, "uuid": "98663417-428d-44f6-a6a0-fd780095063f", "value": "T15975BE41B3C41AA9D216C939CB979232D2B2F8624B7585CB16A5C71E3F73B911F3DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887937, "uuid": "1957476b-ba4e-4b9b-83c7-1594ed23f748", "value": "26208bbb7ef4515666b101b62088afa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887937, "uuid": "0558c568-c4c5-4396-94d1-af0b3e3e6394", "value": "24576:gHDwRbjk9sj7SZP1y2FygZfAsAzcRaexXNzXmQpGyaftTVhahrOVH92qX0+7lC67:gHDwRc472fAsAzcRacXNzWLyaftTjah7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887937, "uuid": "5cffc83e-057e-4ad7-b093-174329b1da47", "value": 1558016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887937, "uuid": "45843f70-d63b-4cfa-9b52-f6b7ab6c71ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887937, "uuid": "a52c921b-fd87-4f62-b546-0afef5539a85", "value": "WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc180c14-2c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774904537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904537, "uuid": "4e94c9b3-88c8-432f-9718-d3f60701e9f2", "comment": "Malware payload", "value": "602e9bbc9612720a686cc7439d269fb8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904537, "uuid": "6d154ac8-ad13-4bc2-9889-56136f277597", "comment": "Malware payload", "value": "57580979dd87ab870adb9b179c4c89b614f8f432bec0f8e5ed9999a53c618805", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904537, "uuid": "f519a4cf-e272-48bb-8380-a5fad347ca5c", "comment": "Malware payload", "value": "ac8d8492c701d9cd46856578290be30c99e79a42", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904537, "uuid": "27f5d4b0-f680-4fb8-bcb5-030930843b9d", "comment": "Malware payload", "value": "c8c024f8a9f89748a965a1397516cecd3d6dae26c45fd3cd109d5892048f0dee1772f11160a526d8c92ae6dbec0ce623", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904537, "uuid": "649bca0e-ef90-4aa0-a798-dfecd7a1a302", "value": "T1CD857D4B7CD044B6D4AA53328CB661827BB2F8290B3773D72E40AA783FB7AD05975714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904537, "uuid": "6ac716a1-583b-4e96-8c9c-da67fd6fa970", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904537, "uuid": "503f107e-b6e5-4409-b4ae-cfab78ec4d89", "value": "24576:xkVxt1R/XahnQaXePfGeFNmPXcUlTCtktN69qG6WcR/4O:xkTtP/MefTbmPXcycktg9Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774904537, "uuid": "44cf7c80-67d3-486b-9482-fa92f74fde5a", "value": 1841288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774904537, "uuid": "5c927362-2333-488d-9d96-5addeb391751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904537, "uuid": "f2d85b28-794a-4ef0-9f2f-a85dacd08a93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecbbc49-2c18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774861914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861914, "uuid": "6b5ab523-89cc-4c80-af07-0f18f05a465e", "comment": "Malware payload (Mirai)", "value": "0cd1d46581dfb2ca0bdc657e3a06fe44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861914, "uuid": "65bcc5e1-a12c-4e66-a76f-7d1f1334dd83", "comment": "Malware payload (Mirai)", "value": "577a330a1a0b95f01463160419e118ca690b025b24c8ddb71084b65eaaf6f773", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861914, "uuid": "54b247c8-0b37-4da6-8f86-c4403b881252", "comment": "Malware payload (Mirai)", "value": "bbee07cc83bf75ab53ae97597b8eafbdb6bfda66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861914, "uuid": "3f356de2-7081-4b75-96de-83cf74f393a3", "comment": "Malware payload (Mirai)", "value": "b1c49cc126c00b7202978871826e044e1d5ff703239ce87ade28f5c86ff16a7332604395a4d0188f314b934fa7c41eca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861914, "uuid": "7cb60e21-9beb-4249-bda6-e92865b95a08", "value": "T1A0632A4AFD81AB01E5D522BAFE5E5149335307ACE3EA7112BE105B2D67CBD1B0F3A412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861914, "uuid": "375520e5-e515-4cf2-b020-70e712e15cbb", "value": "1536:iSnm1FIisAWAKI0FJ4YFJwryUh0llr9i1XP0iLk05:qki7WomJ4YFJwrKSXPHLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861914, "uuid": "5aa6f7dc-a35f-417d-9e7c-3cfeffb8d257", "value": 73188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861914, "uuid": "61b5efe7-1076-4559-b2c3-132830d78ac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861914, "uuid": "99618921-d791-497a-bfe5-63f088a3b46b", "value": "libcyn.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69935a8-2c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774865524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865524, "uuid": "610328b7-526a-41af-bb60-a99c9bf5e5bd", "comment": "Malware payload", "value": "90d49c97991e26ec76d9ac163a8c2b13", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865524, "uuid": "c62baf09-553a-4325-984b-fba4a78cb4e1", "comment": "Malware payload", "value": "598523e055c583075ee3fd70d5e9672207afb5fd5d70696afed5755be9f01da6", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865524, "uuid": "b8eb9966-aa2a-40c4-a1c2-d39afe5059ea", "comment": "Malware payload", "value": "c9c89583aea163a74268ec6cf1001c22e2ab2a9e", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865524, "uuid": "0f3aec1a-b790-4fb1-8d5d-74daef38873f", "comment": "Malware payload", "value": "657861a6cd429cd5411b745a3bb80213ae8b85a87108767795a825b036a5c3c64a6cc709b27907d431745edec57d2d74", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865524, "uuid": "3e7b4767-3171-4d8f-a2d3-0c8fbf7d7202", "value": "T1E8443C1BE391137908B3975BAD8EA4E6AF25C07C6350E3286C5D956C12069BC437FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865524, "uuid": "d8b022b7-9d78-4621-bf16-f7b81ce42cc3", "value": "3072:GwVJcLaJ5BgGddk3xOuxt+6Qrx65+znE8nkpC0rtx+5SXP0V5oSETBuxOQRFudF5:GLMkUuxt+rg5gn0tw5RX3Hqdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774865524, "uuid": "5640cb94-0256-40f5-90c9-9328c7a29aef", "value": 259618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774865524, "uuid": "c279f09a-6e7e-49c2-b710-1827501da77f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865524, "uuid": "b79c2bb5-f522-4a5a-aa8a-d3849ec5e609", "value": "598523e055c583075ee3fd70d5e9672207afb5fd5d70696afed5755be9f01da6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f385c0-2c6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774897970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897970, "uuid": "dcae65b4-2d0d-47c1-a2c9-0dfdaace77b4", "comment": "Malware payload (Mirai)", "value": "9828c5f9ffd647466a530c9c17df956c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897970, "uuid": "b4b78aeb-62e1-4322-94a0-a95c7c01d22a", "comment": "Malware payload (Mirai)", "value": "59f58331db299a26516255ca986ce79f4f362343eee95e387e0331a53007312d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897970, "uuid": "ee7141b5-8a45-4580-8552-9cae7f7edbc9", "comment": "Malware payload (Mirai)", "value": "d67584529e0ccdcad52773b3101f50b2f58a544c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774897970, "uuid": "a9e11cb2-925c-460c-873e-73cf142091bd", "comment": "Malware payload (Mirai)", "value": "513b2ac2fa73024ac479d248a5d58f865c394f7b973599d30fcd9427b4ba18360558c41050c527894bd6959650ebe606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897970, "uuid": "be39e41a-5712-468b-835c-9efe78d3e6e9", "value": "T17413F1D3E4E5C305EDBE21BA28AA328B5410762D8925FDF7C7C13709B6427B560DCB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897970, "uuid": "1267784b-0689-4bea-94b3-8458637c93ec", "value": "768:wIz4nYXX626Oy6z+R3zjbs/S9EEYZm655F3haSV9JL+nbcuyD7UHQRj6:lz4nY626Onz+hzjbGMEEgm655pscL+nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774897970, "uuid": "f6e1d0c0-703f-4f74-a86f-e7d74029fa0c", "value": 42920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774897970, "uuid": "481fa1af-afd7-4a3e-82b5-ca3b85e0e4db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774897970, "uuid": "e68ceb2a-e4d4-4195-99bb-1a98f03d7a4b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d54796-2c18-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774861879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861879, "uuid": "5d8c47e5-d8b2-4a3d-b5ce-ff9a583adc58", "comment": "Malware payload (CoinMiner)", "value": "762620614382c128262bb804b8a0e899", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861879, "uuid": "6166843f-c09f-4575-a961-bbb7244bf8b4", "comment": "Malware payload (CoinMiner)", "value": "5af51f2ec97c8d378b521046ff7fa2af47e24a0d2e517060783f4ce04846f1ce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861879, "uuid": "bc81e187-9a59-4194-819e-eff0972fff83", "comment": "Malware payload (CoinMiner)", "value": "de44712b72614dd5a96028e3e7efeb2cb526b91f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861879, "uuid": "63765ea6-cbb7-4038-a618-0028a352dea5", "comment": "Malware payload (CoinMiner)", "value": "83c2ae26d13aa88c4f73a15d6917a6a744b7a3c4da33643b78d35190ca8724032174c59f0dae82135d7c35d1fe0918a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861879, "uuid": "be8590b1-0c05-4cf9-a5b2-47beaacaf951", "value": "T17A569D55B7A400E8C8BAC53DC6479603E3B2B81553B0ABDB17B466BA1F237D51E3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861879, "uuid": "4eef2fe8-6eb6-4f8a-8d8f-d28fea483cca", "value": "1c809dbea2460a4cc65b61e488da1d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861879, "uuid": "c52b8fb2-7449-4941-bc05-83fc90315a61", "value": "98304:tzip9sHZH8U8ImLlPuuEZ7rB8Ish6z+o/m8GGwZ09YnYbQKJjU3Y:t8sHV8zYCoe8pwZHY86cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861879, "uuid": "f2c1ef43-96a4-4e9e-9f5b-d39c602a52c3", "value": 6414848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861879, "uuid": "9bdcc063-d6e1-4c73-8b28-f7f02291532c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861879, "uuid": "b2925be8-a425-43be-b3c3-54da5ee32bc8", "value": "mservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827a943-2c3b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774876935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876935, "uuid": "09405477-ba04-4eda-82f4-39103a129509", "comment": "Malware payload (RemcosRAT)", "value": "25aef77ec008ed65d513a47352deaa8d", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876935, "uuid": "31e9fae8-bee4-43d0-8bf7-a81e7584afb8", "comment": "Malware payload (RemcosRAT)", "value": "5b3089eefab0e043af8894de86022bdc6df2f42f7098dbd530f42c0ec861d5d8", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876935, "uuid": "752daf40-9f74-4e83-88ce-899563258934", "comment": "Malware payload (RemcosRAT)", "value": "6e1062d7b1c241a177509baa8bd7c7381aa6b2a9", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876935, "uuid": "12d57db8-91fb-47ed-a28a-678bcc977727", "comment": "Malware payload (RemcosRAT)", "value": "124b242365331744301be0f1978c08f2832773e873f7354f02516a9c36dfa336a6d3a352dcc4933a48eaebc5c15517a1", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876935, "uuid": "c907438d-7925-4d96-ac96-6ca7cd6371ca", "value": "T1E383D93030A0C5E7A283D8C09F81D56CB26BAEA5FD8434365A4D43E7ADA54E4F17B7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876935, "uuid": "30411f56-85a6-476f-ba64-606e8ffe66b3", "value": "768:mmutiQDifVU+B1zCBa/u3jJQcdEnaszrW3MwG/fieU4T2/ZyfvMNLY5:mprDifVU+GooCcGnXfW3MwQi/Ao0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774876935, "uuid": "63ef962a-6e80-4e06-bc64-6d56a71de495", "value": 82774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774876935, "uuid": "e317cc6f-2cf0-47d2-912c-67b1e1da9ab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876935, "uuid": "6c505114-99f4-45ab-b491-3c423752f253", "value": "Bestellung.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66cdfe2-2c21-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774865846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "4f8194fa-c496-44a0-9491-3de49b7df748", "comment": "Malware payload (RustyStealer)", "value": "216802e2db94f5ece208e703a6b96278", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "f56f36e7-94a2-4e07-aab5-a9f11b7df2e1", "comment": "Malware payload (RustyStealer)", "value": "5cfee411d7ba4c997cb819bfa5f9c4993e20083a707af675945cd5c6ebc73fe1", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "0aed0889-e773-4a11-9dda-e547090f7fa0", "comment": "Malware payload (RustyStealer)", "value": "1e064acf44f1542c2113a02b56ea6f7deb6adbd2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "086128cf-9904-48ad-abf7-de715cd5a34f", "comment": "Malware payload (RustyStealer)", "value": "4be9e872936b90e23d08c0321e7719484485e48d738b33906bff642af3fad4d42a1852e1d3031788897ca7fa184cf3b0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "5d3ab410-c520-4922-a7a2-84b16d40da49", "value": "T1A90512257685C4EAE369C0B4428149B6EA71B4DB1B3255FF12C20274BE3DAF71F3C626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "8fb56d13-56e8-4f33-bc01-5019672e82a0", "value": "f7aeb1d849876e463427b64c9e414b8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "cae737b2-f99d-433b-9fd3-118393a9e0d3", "value": "24576:PvBWksZJKjqiGt+MpExlO3WqG/vWMn2nlbW+NkTF:PJhsZjtB+v0G/vJ0lbKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774865846, "uuid": "44123288-23a7-4555-b276-868d0a197bbd", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774865846, "uuid": "60abbe71-b201-4559-ab7a-f5701d9aa831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "41f337c5-2438-4957-bdc1-1ec64ebc264f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56711de-2c3e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774878299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878299, "uuid": "eb975b12-d839-4ca7-8e24-c73104340806", "comment": "Malware payload (DarkTortilla)", "value": "062c6cb7a15382f891e3fb9656b44cf7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878299, "uuid": "40622528-7243-4b90-96f3-403b75b8fa66", "comment": "Malware payload (DarkTortilla)", "value": "5d3efd95113c0c2bf75aae8fc89d318123ecb178e4303b52cbf1ca7887357838", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878299, "uuid": "a46fd10a-9ae8-4684-976b-d1ec15bde0e2", "comment": "Malware payload (DarkTortilla)", "value": "f8b87d28c9633d0f28dcd2aaf2ec8c15b8d13010", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774878299, "uuid": "cb8e1dd3-7ad8-402f-80d9-82b9479cb95c", "comment": "Malware payload (DarkTortilla)", "value": "9dadaae7c50f349095943071759d777f4d8aec3c752e160b60384a1cc250672cb8da45b736de48919d7f3b26856c9493", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878299, "uuid": "8063959e-05bc-4b2b-98f5-4de822426a0c", "value": "T1B335E0106E8B2F88F92D0F78C0025469B3F8D9579657E79F6FEC00A9ADAAF46CD17011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878299, "uuid": "e2aef794-325b-4705-b336-1c8023a77a40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878299, "uuid": "ca5104c8-e5fa-43b0-ba39-4237f8dd7da8", "value": "24576:4B9mlEF4Am1UB2TKf+6uVgBHsjF3ledhr:xs422TE+DVgBHCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774878299, "uuid": "381786fe-520f-4d0c-8985-d182ad2e4e0b", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774878299, "uuid": "3139fd86-33b5-4729-b2ed-0866887a622f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774878299, "uuid": "f39074da-a94b-43c6-a011-151873c518ca", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0be663-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830588, "uuid": "c1640ab5-480e-412d-80bf-925aa6022959", "comment": "Malware payload (Mirai)", "value": "04731a79d1a059286886e27a88b2f7b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830588, "uuid": "5da4b1a2-fb0e-4bd7-ba4f-4a7c11e47ec3", "comment": "Malware payload (Mirai)", "value": "5e0d0328d592caa187c6fe4351cc042560e84cab57c094c1f082d9404b9802ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830588, "uuid": "17accf76-baaa-4b7d-9375-8851e9e45918", "comment": "Malware payload (Mirai)", "value": "aa72cbf466fd85b7ff39aa032d09bbe032f158f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830588, "uuid": "5fd6b3ed-d6f0-4fe6-a0fe-36ad87eb9cab", "comment": "Malware payload (Mirai)", "value": "55f802184152ff2f3f035dbcea020d04372566e80ccc371abf85a9c3ae05edd3944d4c47044c7c210381907d6d355a4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830588, "uuid": "1b7c84c6-4f0c-41bb-ad88-0e44c5781679", "value": "T197B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830588, "uuid": "3d0abc69-5ba3-4467-9206-62e3e09fed16", "value": "3072:Idub7djS5HECmVZLWzRRhFcDcmFhhcqpxi:Ido7djS5ECFz4DcmFh7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830588, "uuid": "d03db68e-bcc9-4a85-9fb8-33e6c4b0dd43", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830588, "uuid": "5b894654-7596-4ad3-b70e-50a969e31f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830588, "uuid": "5e1f6d8f-e5ea-4f29-a1bd-37b165000268", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693b8e1d-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830524, "uuid": "cac99323-4ee4-40ca-a7d7-9875a14f4322", "comment": "Malware payload (Mirai)", "value": "c265e5b3b1b068874c1734ebca8d4e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830524, "uuid": "d142ffa2-1e68-46a9-9a03-d28e6c723c46", "comment": "Malware payload (Mirai)", "value": "5e7cc31353413f298326dd7c39c2831a627b1a83a9c127dd0909038f64f3c679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830524, "uuid": "54be7fdb-47db-4ca5-910c-0fd1455347f6", "comment": "Malware payload (Mirai)", "value": "5670f625b96ae35f5adfb9b6c3dd04adeeed7b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830524, "uuid": "6c087a24-ad41-4a9f-9957-ed0301c26f8f", "comment": "Malware payload (Mirai)", "value": "3481184fff6b90899f60e8d10d7c965ad4cb16165806feb7198a204ae8d18b09f1c71cff1d085eded6850b387e2024fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830524, "uuid": "3554673d-f37c-4bbe-bba8-27fb58617609", "value": "T1A403F191E2496C51CF7B9EE054E6ABA6BB650273035A9CB2B4E48F1270B73312915FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830524, "uuid": "202e902a-b949-4592-8e7d-bf74ce13db4f", "value": "768:hffQ0AgTXpS0GSboKivAj2NZQNZGd4nWip+vFznh7dlg4/AemLycf4uVcqgw09k:JDg0BMKiIjCZiW7xvFxnWLycf4u+qgwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830524, "uuid": "97589ef2-1a7e-4307-859d-c4d16de5a4e5", "value": 40180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830524, "uuid": "24809625-a537-46dd-80bd-1775df811057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830524, "uuid": "3dc18aad-2a74-44b3-85c4-204ca62ca178", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bc8542-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774891695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891695, "uuid": "a27b330c-a5c0-4468-a615-14c86eadad35", "comment": "Malware payload (Vidar)", "value": "593db619bae1ab218cc3077310683b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891695, "uuid": "e962531c-2578-4550-99ef-532460b59ed8", "comment": "Malware payload (Vidar)", "value": "605d3f98e1ca4015f3c1ed75e66daa17bc08f1a93d454977a6c4f888a652ebb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891695, "uuid": "f78b7ecd-34b5-48c9-9730-ee28e9e8f317", "comment": "Malware payload (Vidar)", "value": "d8a2effe566db329a92b0cde263ca4811bdb31d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891695, "uuid": "aa44cf6d-627a-4703-8911-6c2d8f7b0501", "comment": "Malware payload (Vidar)", "value": "e52ac0c128331e9f5259e8adfdd820c1ee9e5e5d1c2ee03b7d1eac646aaa034de7570f4d4ab05040ab7c88a48c66f92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891695, "uuid": "359638bc-0c0d-4374-acdc-bd0b7a72ae12", "value": "T10B957B06BCD008F9D06A633289B726A17B74FC690B3263C72A50B67C3FB6AE55C75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891695, "uuid": "f3d9faf2-4a13-4b20-b054-52f5fa6f880b", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891695, "uuid": "5f34cee5-3127-46f6-bf78-87be7a5bccd6", "value": "49152:mrYmLf+1MWuuNijHBW16xJMl+NFWpHWtf:mrBbL1U16xJMsNFWpAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891695, "uuid": "3e881406-bd62-4a95-b70a-6d3b6c0dda99", "value": 2056832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891695, "uuid": "17f59888-5080-4bfb-8a19-ae8c6ee8f69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891695, "uuid": "22356965-f290-421b-98ed-832e2ce991b5", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8d530f-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1774861375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861375, "uuid": "9e04bf76-709d-40cf-bfe9-d67869e36ee5", "comment": "Malware payload (ArkanixStealer)", "value": "8af3cb0c29e15ecc6a9430971f1168b3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "gmail-7z", "colour": "#7340B6", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861375, "uuid": "5964d535-96ab-453c-bf37-45092caf59bd", "comment": "Malware payload (ArkanixStealer)", "value": "636dc28ce8dc8008991b4555abff7664ffb34f77b30422b2062e61a1583ad745", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "gmail-7z", "colour": "#7340B6", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861375, "uuid": "2e9fe3fb-743f-4e46-b66d-c299ed135504", "comment": "Malware payload (ArkanixStealer)", "value": "6c696936742435e00e56b4f5528dc16a6dcd4627", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "gmail-7z", "colour": "#7340B6", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861375, "uuid": "234b55ab-375a-451c-9876-87197acaaf75", "comment": "Malware payload (ArkanixStealer)", "value": "60e4934599051bf32fb4b86104ad1a1638fd03664f9f66c8755c4b6b8a18b584b0a3249f982918574278fbeabdb3b153", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "gmail-7z", "colour": "#7340B6", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861375, "uuid": "7590ad9c-ad5c-4d92-91a6-2596d566ca58", "value": "T16C4633DAC80853451C0A5D8ADCFB4475E1D9F8224F93142C92BBE1BD93DB179F81B8AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861375, "uuid": "660e61a9-0b91-4a0d-95ae-5d07055a490c", "value": "98304:k1JqenTfimWAM55K/2gNmi+7w9/1yfU9YrfYulNn3jyzuexSkSiK7611wJLf/SJ:k1UenTaM+K/CRoyfRF3j+PSkFK70ELfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861375, "uuid": "3c75b78d-7263-45f5-b2ec-366e0bfdf010", "value": 5380609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861375, "uuid": "1cd54141-c29e-47d8-b4c8-8c310537d9f0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861375, "uuid": "64a88b5b-bc51-43a4-92ab-ff623d2da4fd", "value": "gmail.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659f89dc-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830518, "uuid": "fe54de6d-8bb2-4018-bef2-e62926b8e2b7", "comment": "Malware payload (Mirai)", "value": "0d07f8200d748176ccc7d23ef31915b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830518, "uuid": "a1ed8854-8fa0-413e-9a69-f1a9db075c1a", "comment": "Malware payload (Mirai)", "value": "63b36d9e77a05e324ce805274ef6c173dac5fd5043ecb52977e479a62c9f085e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830518, "uuid": "dcc5941a-d760-4192-8a66-484d0ed882bb", "comment": "Malware payload (Mirai)", "value": "fb2c9f277a5ab151a3a849a28ca149248f0a7976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830518, "uuid": "4e3955de-c5dd-498d-8e09-03c9a05d15ee", "comment": "Malware payload (Mirai)", "value": "782cbe6d4966d22fc120149b72ca2e71d3876518d468227ca1807acf4325d9c712c531265760c27e013638d1f97ba910", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830518, "uuid": "2ef69f18-b474-4e23-aad6-77b4e14bd67f", "value": "T1C113F2904EE8BD36D1500D79C96A0CCA1F4DF7F84AE77629097BC5A887C31C791E7688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830518, "uuid": "6838e62c-fd2d-4c9a-b98a-6d2bc70d90dc", "value": "768:jrzD+GhbCRAjFUvKF5ncFN9gNFKHR5zJHQ21Cmh/d2HI9x+5x9q3UEL3z:jvDzbCaGoch5Fh1pd1x+5kLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830518, "uuid": "43896d58-10d3-4f7b-8dc0-6e5910ede188", "value": 44780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830518, "uuid": "395837b1-5078-45d2-91c3-4588c1b3a279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830518, "uuid": "6d018f28-41f0-4904-9267-b57366fb2da2", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad843243-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853832, "uuid": "0e12515d-3c15-42b2-8774-337960512d2d", "comment": "Malware payload (Mirai)", "value": "649d114a22afd05947975a5b58d5d0ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853832, "uuid": "30ecc949-d3ee-4b04-b65b-ead7c0c1d70a", "comment": "Malware payload (Mirai)", "value": "640aae768ed104fb6c8f5fc5693d3984d52c3656b418ff55b8bff5b69250294e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853832, "uuid": "dae70d5e-37fe-4cbf-ba20-7c263175697e", "comment": "Malware payload (Mirai)", "value": "cd7339171f95ce22a6f48dfcc00dcded447ed71b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853832, "uuid": "904ece47-d5ad-4baf-91fa-5150de1336d0", "comment": "Malware payload (Mirai)", "value": "768e3b7a72f3bdf05601ceb03233899cf4b13ec63d0bd4499a3a76359c5b859f2ea82a2910af3f3f17cb626d050562db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853832, "uuid": "e84bf0d9-5af3-453c-aa3d-0d5f5af574ad", "value": "T165630287F11FDC76DC5259B139A38088F310E64FDABA132D45052A784DBBE721469FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853832, "uuid": "69046668-2c3f-4ae6-a422-cebfa6b10fb7", "value": "1536:2SA9ENb1r8Vr6oU19i0lzM339BtKfdYMWzT0nmMCaV/lubVy:2SAUb1OQ19i0lz439BgdY10mM9g5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853832, "uuid": "46f88508-a65a-47fb-ba36-35b025eb58ad", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853832, "uuid": "daa701e2-a2f8-4506-a9d2-4d94c9386f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853832, "uuid": "d8c9cf06-cd54-48f8-9b6d-2f827a46b1da", "value": "kurayami.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645dfc1a-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867882, "uuid": "1cd045bc-fca1-4a33-ba79-bf9652c4b6bd", "comment": "Malware payload", "value": "3b5cc0ed38237132533042e9e41b34bb", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867882, "uuid": "66237cf2-8508-4880-a633-fa4c2d4d2930", "comment": "Malware payload", "value": "648f4ee99b7c8bdb33376859eee319550cf0dba4493a7c947cac18ea7f6216c2", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867882, "uuid": "9fbb199b-7663-442c-abe7-64d342c3372b", "comment": "Malware payload", "value": "28689cedbb8d709cb0cc05375223e0b3633c69b9", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867882, "uuid": "fa5705e7-cc90-4c3e-82bd-bf01b28136f0", "comment": "Malware payload", "value": "e4989c3448970a37a5ee655b5cf8a7dcd54b7955d291cccf6a38213d2788de18bf4280fbbf5e3715cd25c7b1e2962cdd", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867882, "uuid": "c07946ca-330f-453e-9ba0-4077e655203d", "value": "T199A42378E02AFB05DD66B87934500DFAA9A7FCC80CD9C86553C96A134EF1C51063EAED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867882, "uuid": "344fdba0-236f-4544-94df-842dd904957f", "value": "2fba329135cc0c3f76528bfb5171cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867882, "uuid": "ede6a865-9836-40cc-8ed0-7b51027a0da1", "value": "6144:Kdt6cAjU3MS1S0yfVPj/h5qhbUYqW4MV6mmuqF7N0SBS3M7R/X5N3Wjq0eH0Yl3h:Qt6RCMATydj/zqRYMkN0SBd5N+aprzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867882, "uuid": "0ee80522-5948-4b7f-a83b-4aa0d9aca547", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867882, "uuid": "1a968339-7401-479c-ae4d-d3d3fa866953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867882, "uuid": "7b0f9708-7afb-4674-a0fd-3b293516b2a9", "value": "mozilla (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905633fd-2c6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774898880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898880, "uuid": "7cdcc00d-1767-4b7d-88c6-2705037d8263", "comment": "Malware payload", "value": "859195d02b1b7dbe1ffbe32e2407b23d", "object_relation": "md5", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898880, "uuid": "e749e5ea-9103-45aa-a091-6295a513b807", "comment": "Malware payload", "value": "677b0c49587c2ddc626b4e9a21aa161fad715abc8074ddacb553bd26f8eb4661", "object_relation": "sha256", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898880, "uuid": "6ff89902-90f3-4484-aebd-88fbe5b54c9e", "comment": "Malware payload", "value": "98d39d79f46d3c321b00628804b6623c8d02cdbb", "object_relation": "sha1", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898880, "uuid": "810cc3b9-f078-431c-a9fb-b16f55dbac1f", "comment": "Malware payload", "value": "6d8cb6f458f79b5eefb49d6aa3010dc9ec8624302b1efb2fed4c09f9196cac77151eb07742720888f74b74662427de24", "object_relation": "sha3-384", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898880, "uuid": "68216117-018f-4a1b-8034-5cf723f48f9b", "value": "T12AA2E80FA24394DCC81FC1789AE98277B5B1B91164A7671D27B0CA320F34DAA6F3CB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898880, "uuid": "20e29111-767d-4b27-8370-3a7d30c5d103", "value": "da653b036f3daaaed2f1c91cd466ba46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898880, "uuid": "9b21f389-2dcd-4aa7-9369-292f0d8b0c12", "value": "384:Y8M81ycmDlbwiBqZ0Gx2vUZWNFnnnFjtjacuVxM1e+:LMWycm94j88WNbjtjacu7MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774898880, "uuid": "b0c75eec-9278-48e8-9355-048909aa12ce", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774898880, "uuid": "8b31bb44-8a86-44e2-86ac-f409d8965cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898880, "uuid": "7349233a-867c-4846-8a5b-bef9e162080c", "value": "677b0c49587c2ddc626b4e9a21aa161fad715abc8074ddacb553bd26f8eb4661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544871af-2c45-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774881170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881170, "uuid": "59cc3862-39c0-4f18-99a2-fb5749377e94", "comment": "Malware payload (Mirai)", "value": "08f421109e15bf6bb928c0dba89d02d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881170, "uuid": "61b6248c-d4c0-4340-b4e3-70533cbf3d84", "comment": "Malware payload (Mirai)", "value": "6913460e32fb1d5be1199afb22d2646c4ef115d615988c97a96c63e012fd8199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881170, "uuid": "371ac368-9b39-43d4-b37f-95c400b9467e", "comment": "Malware payload (Mirai)", "value": "7e877261d504eef9f80b406685c5a62502d5aa8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881170, "uuid": "3d8b2465-9484-4125-92bb-ccb49329e6b6", "comment": "Malware payload (Mirai)", "value": "936e154887db15e06ccfb34b7505b3d52ffe850b4607bf8ec3651ea4713a6a738a8668f4ba19e91491c02f3ad7e1df10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881170, "uuid": "e8132791-a352-4e13-8859-6baeb55e46be", "value": "T19713013304E4F439E232613F8EB89A0AE6051A54C9FB327E9165826B63C90179DE7DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881170, "uuid": "50a47864-a348-454f-9f4e-7610d6696bf8", "value": "768:7WxVDfLABoGgFnwVLrWieCYNjp1+530kAAGBAb17JIQPgZAI00I6nuvQBi+zs3UL:7CDfMBDGIrWieXN+5ksGqJIapMnUh+ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774881170, "uuid": "1e0e0723-ad31-4d39-b29a-7155781ea736", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774881170, "uuid": "160f5ab5-d753-4b47-8529-d9b2c41e4ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881170, "uuid": "de3aa992-f63e-434e-8e8d-9c2aad08866e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd64ce6b-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909290, "uuid": "dfd91dc4-192a-4044-8e23-ee6a8ff72323", "comment": "Malware payload (Mirai)", "value": "2b525cf87726271388d6b9115a61f2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909290, "uuid": "de791f6a-bd10-44cd-bacb-2eeeef41910a", "comment": "Malware payload (Mirai)", "value": "6aae138458ad50fe0af7fa3f709ff4bdc7c85f33eb15c665bef85326406b7b90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909290, "uuid": "f304cd51-06b5-429e-b1a9-d8c0f7ae1053", "comment": "Malware payload (Mirai)", "value": "c80b0c86db6ef2e7889cb081aee0a5fcacd08e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909290, "uuid": "a58b0270-18e0-4b9d-af5f-72b893d4f561", "comment": "Malware payload (Mirai)", "value": "c158a5e1f22721a52c4beb56e58c13f86fc78bc5ab66c3eec2671e952c675a7a86f0d27e51492efc59c500ff90b81852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909290, "uuid": "6bd4e686-3c69-48c2-bf68-5c68d28928f9", "value": "T135E35B0AB8D234FDC687D17152AF9B21EA36B49C02183DABD3C3AE711D36DD06E15E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909290, "uuid": "ca94a8a6-f03c-4a1e-b823-5b18a428ca16", "value": "3072:Mbu5mVmRRiy5++oy9OIc5v+8a36CBn4slFjQ85YueuwQ:Gu5maRi6+RvO6CBn4sjJfeuwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909290, "uuid": "84571fd8-bbb8-4691-8e93-005d6fa3f42b", "value": 144288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909290, "uuid": "e0c77303-0a42-427a-b8f4-7f97f8a08729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909290, "uuid": "49815027-7e22-435b-bf46-537e02670d12", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104fba0b-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853568, "uuid": "aeb2c8a0-3f67-417e-898d-58e914edf4ad", "comment": "Malware payload", "value": "0444b36c2603c925db6461f81aef184c", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853568, "uuid": "dda2e41a-0468-4bc5-91b2-213cbde45e67", "comment": "Malware payload", "value": "6ad6c38552304b963d6a53e77078c6741cbebf52e758716c470be92c79805cb4", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853568, "uuid": "78f8e7eb-2560-4dc4-ad34-a965492e247c", "comment": "Malware payload", "value": "ed2d17e71c69242976c1fb043a5d75bbb76b09a0", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853568, "uuid": "090571d6-64d0-4210-8302-1c1f8c2c9e12", "comment": "Malware payload", "value": "dbd25e261052554a0046b2233223a86193d71e6ccc6bb1ba6fa29ade6095453272948421b2bfe2b27b813ac6b3b296d1", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853568, "uuid": "6d1aec16-9460-4323-a918-ebcc057533ec", "value": "T18F4401BB46C97D3EE42D1AF79823B4B1F2850C579A78B1616A131BCE8C8C50D06658FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853568, "uuid": "9401492b-d12d-4b4b-8110-a5e055160d5a", "value": "6144:yMHxktl5lNXlEMsBkUK1pownvPo1zZKDWwik2HIr9KhLK7edAz2e:yKktl/NXlQBkUK1DvgdZ6Wwj9Kd8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853568, "uuid": "803d9a7a-89f0-4353-8894-7487554a43d8", "value": 278390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853568, "uuid": "d1037d16-1088-4af5-b063-ba89e0069bd1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853568, "uuid": "07fb5da0-08fc-4a93-875c-6583a7d2d25e", "value": "Rfq and Payment Schedule.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb76b25d-2c34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874149, "uuid": "9282455d-efa9-4891-9fb6-0b1f69e2160c", "comment": "Malware payload", "value": "8ca60ad84b6f6b3b9352e77cd8682d81", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874149, "uuid": "ac34e8b7-7194-4a76-aed4-e5b22ac8a261", "comment": "Malware payload", "value": "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874149, "uuid": "b45e131c-59b1-43f3-9969-f58f8408b8ee", "comment": "Malware payload", "value": "3af9a3c6983f6f18261a1c410541502d0f2bc864", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874149, "uuid": "a7ccc7c5-7516-4632-be29-7ce640544a93", "comment": "Malware payload", "value": "12047039496d03ca86c967e6eeb810686e1fa3c1c1f039fe09dd316b9b787b6816d07b796be2792862281eb719cac373", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874149, "uuid": "a0879df3-5fe3-4405-8734-5bae012f145f", "value": "T1E421AB53E9082592D78290255924EAF573CA7C1FEA0A88B07EACD6B41F8903540F5A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874149, "uuid": "2666a599-290d-408f-ae7d-0f6d38ae965f", "value": "24:Z9Gt3hvVJKLvpU8O13aHLf9zYYrpzfKwsf8Nxj:ySxKurBKWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874149, "uuid": "620087fa-50f1-4ae1-b0d7-4b088df229eb", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874149, "uuid": "0fa95e47-c25f-46f7-9642-6c07f1004b55", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874149, "uuid": "8d12c16c-e238-40f1-aec5-a98e7c3745f6", "value": "sysmon.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c050da9c-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774909268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909268, "uuid": "903fb6ca-121b-4050-8ba3-b79383bf7f59", "comment": "Malware payload", "value": "588276ecb80a9d785bb64c2ab8a54229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909268, "uuid": "ea2e1c04-4fe6-4431-8712-726797eb69db", "comment": "Malware payload", "value": "6d58aefc8df90394a08e40b717146de9ecca92e87b667f14e33c13cfb6ca3e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909268, "uuid": "8db6e3c0-77cb-43c6-a8a3-712890dec366", "comment": "Malware payload", "value": "3e679bb523c6bc1cd9045a39ae5b62fdef404c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909268, "uuid": "028a1706-19f1-4105-9b7f-03ea7608b53c", "comment": "Malware payload", "value": "5f720935e29e4c4c8d5816e33431ee5c461f46f080ed4776b0620e3532361c8aa165c87f1236d6e0308deab705c3ba7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909268, "uuid": "12519a70-62a5-4302-9263-081a09b0646c", "value": "T159D5184C7E43C960E2D42A3420E98FF96E8A1FDBD372B0467FD83A8165A7C1ACD94D54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909268, "uuid": "ec67817f-fdc3-4534-b9c6-bed64e8df037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909268, "uuid": "0a98f147-dac0-4b17-aa0d-6074c81ffa90", "value": "49152:T86fOJvA7AdP+0EFlYRguMAadRNxYeS9HrnaJ9qoN4Qov+/z6d4GGPO3:A6fOJuumTOguOjY79HuX9t/z6dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909268, "uuid": "568df8a2-2b71-4078-a8ab-6842d5e844c0", "value": 2758440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909268, "uuid": "434affcb-8d67-4632-9096-a9f3f17ee505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909268, "uuid": "b75bce75-66fb-43af-93e4-b7728a6c00e5", "value": "BorshFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651c6f29-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774883775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883775, "uuid": "60c7b71b-c7f7-4491-9a3c-c8d42c43ecaa", "comment": "Malware payload (XWorm)", "value": "43056ebe359f39126488a39cd7f3ab33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883775, "uuid": "b4ab28fe-4dc9-49ed-b658-a5360f47fe85", "comment": "Malware payload (XWorm)", "value": "6e903365b95c58d682d2bf9022ee64c3d672870bede3ecc925022f32984358ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883775, "uuid": "b5823905-4bd8-4a4e-9082-a569f5e4bdf2", "comment": "Malware payload (XWorm)", "value": "6e6ef0b1ba8eccdddf8b1dfb4e42c201e359339c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883775, "uuid": "eadb1d3a-96a8-4be1-8176-51d447341c5c", "comment": "Malware payload (XWorm)", "value": "04eb9052dc0aa3c44ee0e026e7750ece4546c046a0d7af247e32ccc479619c7a585599719cafd9d9258808eff5235950", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883775, "uuid": "eb1bdf2c-0db6-443a-bec6-2e03e0897a51", "value": "T11B15BF013C80D031CB9A20715E7EFBBD5A6DA4300B6875DB67DC39BA9F605C1AB32697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883775, "uuid": "591911cc-fc53-4adb-9310-256a702071b4", "value": "b492aabfbf2837593f4568452d907063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883775, "uuid": "39db3e24-c78f-4412-94c2-d1589faee11a", "value": "24576:gv1fnb0NmPKiOaW/14DRFJ0j30SnOV3o9ByvmbX:i1fnb0NmPKiOaW/14DRFXSnOV3W/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883775, "uuid": "393d6e7e-b1c3-4ce3-9dbc-51c35fe98a05", "value": 940856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883775, "uuid": "76d8f356-5259-4bb9-ad57-824764902be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883775, "uuid": "17b5e252-492f-4850-9bea-997651d1e7f7", "value": "6e903365b95c58d682d2bf9022ee64c3d672870bede3ecc925022f32984358ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b60df1d-2bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774849292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849292, "uuid": "10491ab8-dc8d-47d8-bd39-c6f3042871ad", "comment": "Malware payload (NetSupport)", "value": "392df0b480678c1eda56a6b9b848de2b", "object_relation": "md5", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849292, "uuid": "271e0f66-6caf-436a-8ccf-5a27d7886397", "comment": "Malware payload (NetSupport)", "value": "7021a1d997076a913a0d7d3f723ddb897fc1f63c5cecc87a0a737846a95390f5", "object_relation": "sha256", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849292, "uuid": "28cdeeaa-c42e-4026-87ae-6d696367c931", "comment": "Malware payload (NetSupport)", "value": "2997f36f0ace302623bd0a1ecd45136cbee48520", "object_relation": "sha1", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849292, "uuid": "bcc14855-0521-4ec3-9d32-f1bf32e06c26", "comment": "Malware payload (NetSupport)", "value": "d00368192590c3c5af5efdf767ec436fff43ad1eab5dfc6c54d895b9320b4e938cd04050c4a91146b44c1916e61c830d", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849292, "uuid": "1d9aeaea-5f2a-4c48-8fb7-2ae7dac6ad49", "value": "T153968CB88B84975EBE6E1A07E078571E67F37F26D09271FC5A62370B266FC085239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849292, "uuid": "df877152-3b42-4c23-8fed-3d55eb70bcf9", "value": "49152:aOI+y+GXEAcIei5toDaLXTcKuaRGw66Q7b0AINsaqF4VbIUCOO3aYV:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774849292, "uuid": "c2218b6c-cda2-4b3b-aa5a-58b285c74c1c", "value": 9411087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774849292, "uuid": "2d2814c4-9d25-4934-a7cb-7f765e2f283b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849292, "uuid": "39e33b0d-c3b8-496a-9a15-c15458d1acaa", "value": "agdosve.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3b6c7d-2c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774871228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871228, "uuid": "561c63e5-312d-4991-992a-ca25ab2f2e63", "comment": "Malware payload (AdaptixC2)", "value": "c59a50d7cfed1451fef8fa6e782b0411", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871228, "uuid": "70e2bba2-391b-4c52-889d-90ebf0e3799a", "comment": "Malware payload (AdaptixC2)", "value": "726af976bb1d0125b004ca0d03ac7ce4c315ca8ba7d7de0d7b646b29b6a70feb", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871228, "uuid": "f9212773-20d3-4a6c-b71e-1a0e298fc3cd", "comment": "Malware payload (AdaptixC2)", "value": "23c44bdd9610e871cdd6c0cbadc41fdf9c4a31a0", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871228, "uuid": "62c668f6-bbd0-4b3b-a1d4-0cef7950dc85", "comment": "Malware payload (AdaptixC2)", "value": "89d74d62de84540345e08413f10baa665ec949b1179c831d471b564346d9e3f767eb062817e61c4e15913b61ace60348", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871228, "uuid": "6e257a9e-4133-4444-bcfd-39e6768a92f8", "value": "T1FD74232F89393076DBE3A47FBB3D949E73164B98F69B1645AF2E56D075B008100A36CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871228, "uuid": "d35b7b09-51ee-4575-97b7-deda4aab47b6", "value": "6144:aA/xwwneD/Xaaj/WDQ60upg1GhuYKLwYgioaBacS+r/jBNVhQf2Ts9ikr7:nn1ajPep8G0YKkxNaBaf+Dj5XUi07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774871228, "uuid": "49a5a862-d15d-4d8b-b10c-812a3070a10a", "value": 339961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774871228, "uuid": "50ad7cb6-acd8-4e24-a31c-07c95133e4a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871228, "uuid": "223819f1-adee-4c6f-a895-fd5a509b6e76", "value": "hangup.wav.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fba6808-2c30-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774872143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872143, "uuid": "5d91cdc0-4315-44e4-b6ed-7051ddd6b200", "comment": "Malware payload (AdaptixC2)", "value": "d528effabbd9cd66aaa11bc8777bb110", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872143, "uuid": "fb461023-0221-41be-80c0-372eab0aeb37", "comment": "Malware payload (AdaptixC2)", "value": "7290353a3bc2b18e9ea574d3294b09e28edaa6b038285bb101cf09760f187dcd", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872143, "uuid": "6340d0de-52e2-4a1a-9b47-445633cc8bdb", "comment": "Malware payload (AdaptixC2)", "value": "42f7861818214222efeadb2fc826dda1cdc90050", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774872143, "uuid": "eb5d3a4c-285b-4b5a-88bb-0418c55a2304", "comment": "Malware payload (AdaptixC2)", "value": "cd577b79d0057772fa302b52ae793d5d23d8344be169b4d03c6615965607404df236661de125062df536af72efdadf67", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872143, "uuid": "cab0b113-609f-453d-86b0-f74f82a72e36", "value": "T18A0483499B32309EC15BD2B402E7D6F126A17CA873B45E2E51F26DB7BE32E50031E6D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872143, "uuid": "064e7a6e-5d63-45b1-8663-1f00e2e9b796", "value": "d2210feb0438c0ce89b5579ef75ae4d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872143, "uuid": "cf7855cc-0411-40cd-a349-384a13acd319", "value": "3072:9bkjf6Aks2ivjl1klV+yv/DxKagfsYZo07TtVhPvLZeufm9ivFXXU9l:VEblK+S0a2s8o07TtVhPvLZeufm9+XXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774872143, "uuid": "03113f65-f254-4292-b94f-4930f803460c", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774872143, "uuid": "61675d35-2833-41be-a54d-e0ea00fd1464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774872143, "uuid": "73eff3b3-d4d3-40df-9df0-4428038f199b", "value": "7290353a3bc2b18e9ea574d3294b09e28edaa6b038285bb101cf09760f187dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2807c4dc-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774909013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909013, "uuid": "899d88f5-b272-4fe8-a7a0-7032ffa64613", "comment": "Malware payload (SalatStealer)", "value": "4f439541434d87d568401f6d7aa5b704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909013, "uuid": "593b7b67-4d74-4165-8b94-3d5188e0c78b", "comment": "Malware payload (SalatStealer)", "value": "72cc4362b7b6555efc9f0ae1a51724bbab72a19a1d707b43833b3ef68db9d001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909013, "uuid": "4202e34b-f53a-4485-ad50-a938e1cf6f02", "comment": "Malware payload (SalatStealer)", "value": "56bb6f4a8f90c57fd684bd802ae09e93beb8ba12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909013, "uuid": "71d7628a-502b-41ab-80cc-873198afeade", "comment": "Malware payload (SalatStealer)", "value": "286885be9797b42a2d173587d01aa6a3ad4ff337431a7cea1b9d9174b6433d02acd0d1019a6dfcb7426264ab4ba7405b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909013, "uuid": "7001ac72-45f8-44cc-b705-33d9764567f9", "value": "T15CD6331567A404E7DD79C23C48B2429CEB21BCA80BA1E6DF13F4A3A63E173E15D36785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909013, "uuid": "0b2d522b-17ca-443a-a350-e50e60673f49", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909013, "uuid": "24277d89-222f-4f26-a170-696df24d6992", "value": "393216:FuZD/CqJSfO3GH6Yk4dQusl/Iwd/CAHns9r:QFEUGHf7dQuyx/ls9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909013, "uuid": "b0aa047c-4768-4af1-813a-b6f6c0a02a61", "value": 13268808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909013, "uuid": "c336f0b4-2ced-4886-9d6e-00333dfd8275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909013, "uuid": "60a891af-0bd6-4024-850c-5450c795b53f", "value": "winx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bd1a62-2c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774870973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870973, "uuid": "55750205-1843-4b4f-8f8d-8d25b7f0d416", "comment": "Malware payload", "value": "188d8592f393ce45f7273102f02efee1", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870973, "uuid": "effc8c19-0853-437e-8dcf-1dfcd720465e", "comment": "Malware payload", "value": "7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870973, "uuid": "8b56a42b-e246-4f4e-bf6d-0bbafb36b613", "comment": "Malware payload", "value": "59d1537bd095fb01617da08cf4bd89f72e158f9b", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870973, "uuid": "f636b513-ed15-45e3-95a1-34cc235c5911", "comment": "Malware payload", "value": "86fe2623d11363c2385cc7ba9768e18f4cbba3e068f1b38f93e2fe976efb35b4d348d77d61fd707435505632e274e607", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870973, "uuid": "ed96b121-e52a-4d61-b9be-ad2bb2d8ed60", "value": "T1E1B5AE219A8C9182CA7BB777DDE1BD0655188109F63EFC1A364400353B72BE89FE53DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870973, "uuid": "ac77444d-2b14-4412-b4e1-4b8dae2bb30a", "value": "24576:rX5s7IIJ0BemXNXI9fXxovWLZg21bRecJykl3dpblLn7STR7mhiY6Dp90u2xkm9h:1+IIJ0rI9/evW5D5Ct6bYsustS1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870973, "uuid": "7cd7f5e4-c6b7-4173-ac8f-d3368b85c2ef", "value": 2316358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870973, "uuid": "eea60194-4c13-4059-9352-33e20fe2c252", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870973, "uuid": "f9ebfbac-03e1-47c0-a55c-42ffdffa7a6f", "value": "telnyx-4.87.1-py3-none-any.whl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6255db8-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909251, "uuid": "84d27ec3-c87d-440f-a383-87f8ce5ecbc8", "comment": "Malware payload (Mirai)", "value": "44a3b3361f31279f94e3aa9c90197baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909251, "uuid": "33c8bd98-9855-4568-b0f6-fa8c92e30bea", "comment": "Malware payload (Mirai)", "value": "74806f3ee8e62782fa25026c63473ef2b8f029c359d2a27e450b2c298a1a85aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909251, "uuid": "59a8109e-d9c0-4c41-bf6e-703fe157b9d3", "comment": "Malware payload (Mirai)", "value": "ff55636b45d5fa6176625abecd85dba772a66a46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909251, "uuid": "310331b7-a6e8-4f47-b371-af9a2e66d7ed", "comment": "Malware payload (Mirai)", "value": "ec8d5b7fb8206276bd5e609cb4ec61de228e9ebc999917c49d622179b7136d39fac1d3413b59a0a4a2304d85c8b1e060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909251, "uuid": "0edc956c-b228-47f5-bdf8-1465220a69b5", "value": "T195D3C021E4045CD5EC2119B038BA9A7C0351EE7407DA9583FEFEE59B9477EC838AD2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909251, "uuid": "221c8ab6-f24f-4ecc-a665-0e8b3192827a", "value": "3072:OQphriPmiEV0VUmZwKtH/WUo/I40RImC70ddqdfV:OQptiEyVfZwKt/wVdmC70KRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909251, "uuid": "089a922f-d6ae-4c8d-983f-063ae06fef6e", "value": 131676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909251, "uuid": "a9c8cf20-5015-48bd-b907-a44825bcdde2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909251, "uuid": "592ad3f7-a1bd-4d6c-93f2-4b4f98b59ee8", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782fb63a-2c76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774902275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902275, "uuid": "fa57533c-778f-485e-be86-77de11036d42", "comment": "Malware payload", "value": "811dee42a9119079859466fd5ab08b52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902275, "uuid": "11a7bcfc-6701-4f2d-bda6-92ccba36bc3b", "comment": "Malware payload", "value": "74aea14bcdd934fdc17eca1f8572ca3b2c22bde5c322ad0f64706cbf91862b41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902275, "uuid": "8426fbe2-f026-49ab-94fc-ad92938326b3", "comment": "Malware payload", "value": "6b90ab37f5b9cdda40e8452350a520efe3fdfa5d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902275, "uuid": "e718cdd8-7795-4b94-9d67-e4672a9222a7", "comment": "Malware payload", "value": "efdf2e00278e94b6dcfe2eed2c112a4a68109fc4117688354f9f05572b8af567de8bf52200c89d72fbdb9fb5b7213897", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902275, "uuid": "a6fc0eab-765b-4b36-b809-6db387f4e1a1", "value": "T1A52723E131614059E4819CB1C48C896E6EF29FA309C02B5D77BCE52FF1EE18165A7B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902275, "uuid": "1300b927-1434-4500-9623-04af67cff0ab", "value": "1cd069a1d0a6220306935daaf0c539a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902275, "uuid": "efc00773-7edf-4a0c-99f2-c43c777461e0", "value": "393216:SA68yVTXHUdoeGtVcRjLfNMqi58pSihP7QwHXOaCJoRcOzZOTB9zL/2PrE:r5WTX0dHEVWRi58pSCQwHXOaLcKcTBRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774902275, "uuid": "3ae5106f-cb81-4fd9-8be8-be4732d8c891", "value": 20809744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774902275, "uuid": "7cb6d908-5462-4212-a02d-86a8f8096bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902275, "uuid": "17a451d9-ca05-432e-a947-21f686235317", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d1506d-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853977, "uuid": "026824a3-a6a3-420c-96e7-fb2161180068", "comment": "Malware payload (Mirai)", "value": "be3354d3957dfdfc3ddca5cb5925f90d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853977, "uuid": "cacba735-018a-46d8-a6f7-e35c4191231f", "comment": "Malware payload (Mirai)", "value": "76169f5a5e8d1eb4cf7e79f3bbc422b0d8f870da1530212ef4c3d88f232d9362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853977, "uuid": "702f86b6-1d4d-4da5-b979-ed8b697907a3", "comment": "Malware payload (Mirai)", "value": "6dc45f3dbf864595780a4f0b77529d260a0763bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853977, "uuid": "3e5c439e-4d03-4296-a486-7b4449b56a0f", "comment": "Malware payload (Mirai)", "value": "4bd5bdf29560f695da7ba73de050eb25a614430f25abae468187b28a20b5d2f6d5d73675b6abf86f2fa69da2198eeaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853977, "uuid": "f9015adb-7247-4cbf-90ce-bf4beb34863b", "value": "T14ED36CC4E64FD0F6E91211352176B7269A72FD3A113EDE83C3A89B62AC939C0D61735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853977, "uuid": "d3b6e633-1880-4c26-845e-b25c5c1c6ecb", "value": "3072:SS3mvDmaFrp0nvT6jr9abt5O0Ju/LmQt:V3mbmaIhykCLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853977, "uuid": "32017735-d13f-49c6-836a-a8770f21438b", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853977, "uuid": "2c63606d-9815-422f-9583-6f437dde3860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853977, "uuid": "739d9db8-6ee9-4761-b5a2-09509f178b50", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f52ccb5-2c45-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774881162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881162, "uuid": "05ce1fcc-bc28-4dd8-a5d3-c4b9ee72eb76", "comment": "Malware payload (ACRStealer)", "value": "536a2835b96bbd2df6a9e2dde0a75148", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881162, "uuid": "e44a9c3e-563e-452b-a723-2d77e93b6249", "comment": "Malware payload (ACRStealer)", "value": "76232b1d67fea296f43b015207b6e1ccb1748cca1fc2b9a0224cbf33c542fb1a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881162, "uuid": "255d7c2c-fb78-43f3-9ea9-3f07c97bac8d", "comment": "Malware payload (ACRStealer)", "value": "ee6cf3a6bc90c50a97982fe896ecea5799c056f4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881162, "uuid": "1179edfd-167d-4325-bad5-dd1ff75df0e6", "comment": "Malware payload (ACRStealer)", "value": "876eddae34cec98f800f928ea2ad0ff4bc2b90d8e5a54363bd751ff37585542553743ec706192cf09cabf15a6552ca9a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881162, "uuid": "b8d2e3a1-acc8-4fbd-b6ae-1a509dece5b8", "value": "T12C365B4BFCB248E5C4A9813485778206FA717C851F3133DB2AA1B7A91F367E01E76B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881162, "uuid": "ef00f5b1-a78d-45a8-9a1d-05eda1b434ec", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881162, "uuid": "b8a13276-e617-4e35-ba7c-9f6e5d8bdcdc", "value": "49152:sxZ3iJoNf4pLw0BM4t/MbGfQX1A4FsmQlajnhu7TeQclF1dpcw:sxLC9wx4Hb4Fnhu772", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774881162, "uuid": "07278d1b-bcc8-4929-890b-672b01524884", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774881162, "uuid": "86f06e54-c17d-4258-969a-1658f3a76382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881162, "uuid": "e3c75500-66fb-44c6-9683-3e2d0153b5a5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.95915183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b5f8c6-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774854033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854033, "uuid": "0cc37c22-04fd-4bba-8651-09d8d9913d67", "comment": "Malware payload (CountLoader)", "value": "e66838092ffd582e953d6bef923cc247", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854033, "uuid": "402b16f8-5a03-42b2-bbd7-40d3f4d429ab", "comment": "Malware payload (CountLoader)", "value": "763fe8a8b5fefde08676ba0a7cbface16d0df54b42ab847945df00d1e2ebea5a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854033, "uuid": "7736fae1-99de-438f-a349-e4c2a8ff776a", "comment": "Malware payload (CountLoader)", "value": "b51d5d41b0522ea9b7da71a193646ecb003a4ab9", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854033, "uuid": "1788e1b6-a007-4995-8fcb-e3f8229a78c5", "comment": "Malware payload (CountLoader)", "value": "691caa08eb501b225f415b25068bfa97b8e362c9e7c7d81fafb6b4ab4fce0b7fad703752f67ed9a7f42ff66ef8fbc1b3", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854033, "uuid": "24281bd4-2fb3-459e-93de-eb3fd3c7a4b2", "value": "T134D3DCD889DAC8A88B1F3568161F6C479A8DD523121DE880BBDDDF853F269F031BD6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854033, "uuid": "208b4afc-7e1b-420f-a902-8d1f39ca6536", "value": "1536:oL3iuKBqtUTr/8jPT9LQedADdAa0g8EIy3TN:oL3VGf8jPT9LQ0yDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774854033, "uuid": "04a248b6-5cd4-4a6c-944d-916d0eaaf10d", "value": 138405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774854033, "uuid": "0f801692-f62c-452a-81d7-8c471c6b7b76", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854033, "uuid": "a082346d-32e1-4792-a11a-f15de32ef73d", "value": "Research_Config_New_2895.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcec9bf5-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853911, "uuid": "a5133d20-28dc-4f3f-b1e7-6d0c6487c53d", "comment": "Malware payload (Mirai)", "value": "dc3a2f67b736b6767207ed3318752a8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853911, "uuid": "e2cfc306-ad92-436f-8258-bd18bc3a4c2f", "comment": "Malware payload (Mirai)", "value": "78b1f087230ead241657141b363d532ed48e35cab865bf5e27ef4f761ddd476c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853911, "uuid": "d5b8f9f9-76a1-4d29-9689-7d0746c00d29", "comment": "Malware payload (Mirai)", "value": "852c1b61398e2bf888586832af7d7d47b6b3b091", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853911, "uuid": "b35fcfb8-8274-4818-b997-599e877a1e0c", "comment": "Malware payload (Mirai)", "value": "9e94331accbb4751b541e76827207c80d05decbe4263738901c8defb542fa462635d660141c4a358f640845849d8b9b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853911, "uuid": "1d0c3596-2210-455b-a681-2ab229f9e4da", "value": "T19843F11EC4982C9CE9A8C13C2DED774D1DB0E00AEBDA5A948745164EC943EFAFA64DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853911, "uuid": "6403cd46-1467-4510-94a2-083158ca7a68", "value": "1536:fGIsYa2RmMEH6D1IqZdHXXCbgOg5R/GQRZN+nouy8KyZ:fGIK95q2qZRXog5R/GcZNeoutp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853911, "uuid": "4b6dea30-4cbe-4c6e-90f9-0c2912577120", "value": 57248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853911, "uuid": "dcdd2d90-d82d-482b-abb2-ef3f1822238b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853911, "uuid": "ebf8b43f-2d63-41c5-ae8f-f78ccc640b24", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf485d94-2be0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774837970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774837970, "uuid": "a6c952ca-d630-42ff-ab25-a64bcbdf5a59", "comment": "Malware payload", "value": "70db7b3876f7d7853718b7d39936b434", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774837970, "uuid": "0d20b5d9-74aa-4dd7-a282-d859c1fbba15", "comment": "Malware payload", "value": "7971da4b5b58fc85a6fb0917d7cf5b439e120486ddeb34c54fc772d86b7dea57", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774837970, "uuid": "fe758b09-abd1-4f69-b91f-8fd12c11a0d6", "comment": "Malware payload", "value": "bc471bc0934a19bedf3b0952f9b097766d7147ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774837970, "uuid": "587e076d-cf31-41b7-808e-4c48333ba31c", "comment": "Malware payload", "value": "9b93f9c4f127ed0beafc48b7abb15fab74f681058e941d2b05eb0ebb1fef08d5d8b65e8162a4ba6049fcbb2449def3b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774837970, "uuid": "825dea21-350f-410b-be94-0bd294d269ce", "value": "T192D3C49433FC6B05F7BFABB5AAB021508B36FD725E11D64D0C8561CC2A32B949A15B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774837970, "uuid": "ffea2559-3363-4d0d-8cbd-07d8e19b6113", "value": "3072:hjMI9v4UpqVr14qqnMXuJy9b7eslDY+fV:Rfi4LnMb9biyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774837970, "uuid": "c549d4ba-dcb5-4511-9414-b03122b0dd8d", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774837970, "uuid": "97ae28d5-b47f-4fde-a5ee-369983704827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774837970, "uuid": "42db1ec2-1118-401e-bcc0-8e868a69919a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ced4a45-2c1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774863870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863870, "uuid": "4b1f6994-fa2f-4547-a844-ca3befa4f3fd", "comment": "Malware payload", "value": "d8e8ad2e18791920529155f835e9ae47", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863870, "uuid": "25c37e33-68fe-4ff5-b16d-df5da585c6e9", "comment": "Malware payload", "value": "7a21f1709697d28a96628482001aa4f6bd36621d137ea15b2a6b9448c8993f8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863870, "uuid": "910ae2fd-525e-412b-b2c0-b2ca99c84619", "comment": "Malware payload", "value": "8da16dea0898055078decc9c7f5dd5230846af75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774863870, "uuid": "68ab96c8-ba0d-41a7-bdc9-5d7582f64f26", "comment": "Malware payload", "value": "927af12c98cf2fea1b269084921d0d88feb1eab8061edf750a571533e97f72759fbcced930586ed2ba3c5ffb63b9f37b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863870, "uuid": "c6d361ad-b7e0-4f37-9019-52c693f6088a", "value": "T10E039815369FC70871620A8946AF03740B9F799E1FBF4189818DEE8D4FE35168C9B7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863870, "uuid": "0bf55eee-b443-4b6e-8e7e-c7c3377499f8", "value": "384:92hIXlf+K8KaRaVMDYc3JnQwq8PETncN70nCK5OzG:92hIXlf+Kd5VM9ZQwq8Z70nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774863870, "uuid": "c36373a5-e8c6-45e4-9069-18ffadad7157", "value": 40564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774863870, "uuid": "bff86986-9a84-4004-9a48-d240d660f949", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774863870, "uuid": "f8e68010-21f8-4bcb-a126-d6a95f3ef2e8", "value": "T200511200882150081-8210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7958a0-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868136, "uuid": "d41ceef5-2f77-446c-a477-be8f4b7f6104", "comment": "Malware payload", "value": "94cae9293362c15b76f12099b5a44c54", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868136, "uuid": "898cda66-bf16-464e-8fc2-1aa421af7f8b", "comment": "Malware payload", "value": "7adee043ce348ca26ee587f6f7ebc258924e70d848fe1e0cb7ec7e084977d990", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868136, "uuid": "18bb4274-7ca0-40d9-974f-65d0e201d226", "comment": "Malware payload", "value": "e7d0638bffaddc54e74bc91349622dcb11c386ef", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868136, "uuid": "307fd642-132c-4d36-8822-9efc36006008", "comment": "Malware payload", "value": "cfc0841cf2a8ff3c5f8a07dd4e0a146ebdff9d25a392d2252074257f853aed55e65225ca6daad9b5dc020fea6bf7f69a", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868136, "uuid": "8a2526d0-0693-4153-b7da-f4cc33fc2875", "value": "T1CB75AF41FBC241E2E9C7063112AA67375F3967244728DDF3D2902969D9307D2AB3E3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868136, "uuid": "95343abf-8d24-4139-9805-8516b6e4fc4f", "value": "307a50c0e3f8e86d7bc40aad78cf15ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868136, "uuid": "80fae826-ee8e-49e0-98f2-1ef26e34835f", "value": "49152:WCfkRlgKfp2ERMt3ZrEJaKKwXeGLpgRy+:Xf2lg0VRMphEJaKKwXeipgRy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868136, "uuid": "0ba045af-4633-46df-a56a-e30d50fb47cb", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868136, "uuid": "a668625e-91bd-4de0-876b-f9152e57ee31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868136, "uuid": "6661e4e7-40df-4782-a993-ec79cb129314", "value": "RuntimeHost (13).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef0622b-2c7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774906125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774906125, "uuid": "1c6c8cee-9235-4b43-b7eb-948fc8982238", "comment": "Malware payload", "value": "8aa0eb08769f05bcbb00dc1500e71db9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774906125, "uuid": "1ca0151d-d12b-4714-b169-bc095ec9a87a", "comment": "Malware payload", "value": "7b316fc790e70e41b0c4a84021aaf6616826e0f9d8e1b114290ae9c797653999", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774906125, "uuid": "00d58171-3cb7-4b63-ba10-9e034d8ee11b", "comment": "Malware payload", "value": "8f440edc89fdf8bff419139811ac11f8cb62e714", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774906125, "uuid": "ce81d7e2-f47e-4188-bdab-e27ed1cfba97", "comment": "Malware payload", "value": "7b4e19e6e7816ba87da432297fe38e5dc3cd88151c0c9bb290421ed31a5523e63c0d7a854c71db60a7b83b19dc2793f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774906125, "uuid": "6d87132e-dd14-41db-9e65-7b0d124d1712", "value": "T12296337E73609E47DAE8DA75C9A3B5180FD9F44F76B3CB8AB855C1A21C027439E062C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774906125, "uuid": "9dd697e4-19e8-4af7-8ec3-3e53abee12c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774906125, "uuid": "c4b4636f-12e8-43ed-bc50-cbb1e1ec8698", "value": "196608:uTkUsm/Zn1zmTUJsAj5lp7hfA63JRkOB+znGD8FehAfZ:uT5Zn1p75H7hxRk4uHFHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774906125, "uuid": "e2bf8aa7-5c2f-41a7-9ffe-ed8435d23b6b", "value": 8828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774906125, "uuid": "e2f57cad-d34e-4680-9dec-ed76a265ebbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774906125, "uuid": "0771cf03-92a0-44ae-8688-986ebee2432d", "value": "aclservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b61c278-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830582, "uuid": "88adb801-5e9e-4cbb-9c64-4c400bb56c2c", "comment": "Malware payload (Mirai)", "value": "f6ceaca4d5e2c8598b954bc508fd82fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830582, "uuid": "7afde3aa-8782-45b4-b1fd-9fa721e47b54", "comment": "Malware payload (Mirai)", "value": "7b8b09f7203db6810dc8379aa18a0d01d29b132437c7c6a722d3dbbe7fb2573f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830582, "uuid": "a86fe3cd-e1dc-4b66-a7f9-59aec9409b05", "comment": "Malware payload (Mirai)", "value": "c1a1fa2d3592ead95221dc545c5b304879cea076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830582, "uuid": "69213196-cee9-4730-af74-0467770792d1", "comment": "Malware payload (Mirai)", "value": "83c1b1b0359dc27376de190851f22be8517d0e73e0c60248a4aaf42283eb11a81f0762655efde0d60a86c580e8bd0b49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830582, "uuid": "69a094a6-9937-4629-97d8-f6bd0682d8ed", "value": "T139934B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830582, "uuid": "e4c8f746-018a-4c82-8b30-b8c7cf2a688b", "value": "1536:tOd4vdGhFbQFFKyELib8jPWL4nteyXffdqs8amv92w:tOd4vOFkvYzjPi4nNPb492w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830582, "uuid": "4a99b2fe-8e7c-40eb-a311-14cdba30db65", "value": 92256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830582, "uuid": "8430e703-e708-4af8-a67b-1aff4fc06528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830582, "uuid": "76a7393d-ae5d-46b4-bee1-441b4f55e4e4", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8d64bf-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868056, "uuid": "4ca8df64-14fe-4bbe-9475-29a8fb70b091", "comment": "Malware payload", "value": "cafab8c9c2db570fbd6551715e7e688b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868056, "uuid": "53c12080-cb17-492f-afff-e3c9c527b57d", "comment": "Malware payload", "value": "7baec10572549525371602d096866b664b63f9bd0d8b15a21a0e68bda1d76432", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868056, "uuid": "37043c30-b256-47f3-a30b-0a8a249370c7", "comment": "Malware payload", "value": "769df84a8b4c7c06023b0fd590b41f4df36e733c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868056, "uuid": "a3d6d869-f69f-4c9b-8e45-066b9c648a60", "comment": "Malware payload", "value": "8bf2fdf7d116975b55e51c3e04784f4e64ed8ebdce5addc2a89c619f1d2a338529dae955d209762bcd3ba962832d27ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868056, "uuid": "c0fd3984-a1a0-4bdf-8173-3a0fed5faf51", "value": "T1C384594693EA5609F5F30B88BE7A50604EB7BE5A1D39C46C11A9140E1AF3D48CCB67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868056, "uuid": "81db562e-e397-404d-b3cf-4e093574cef7", "value": "6144:R95QZcAgdVxrVWabutvawaZOdDkh4Q2P/R9/jjrDrzopV8VbxRrBbIQFo5rV8LT:R8HgdbrVxEJHdDO4/nT/LUpV8VbBra5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868056, "uuid": "1c4a3a8e-3a81-44e7-b231-72b2a722225a", "value": 377198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868056, "uuid": "7b2c8bd2-2c83-4765-92da-4ad4040048a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868056, "uuid": "108128c8-5215-4d6f-b939-9211cb4ec58e", "value": "fedex_tax_bill_document_receipt_payment_30_03_2026_000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0232832a-2c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774904225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904225, "uuid": "eb80b404-fad9-4ab4-859c-2b3c924a4882", "comment": "Malware payload", "value": "b2923cee4b88e1d655d1f8a637d3c509", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904225, "uuid": "0d1ec1ce-041b-472f-8839-2035c9c844ec", "comment": "Malware payload", "value": "7da3d9319d214efb80bac3bf34e59088e56dc878e98eb9e5eb378f90ea83bcdc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904225, "uuid": "8dce9e55-79f4-4cb2-b586-be95982029ca", "comment": "Malware payload", "value": "f77a8e932554e8ee6422394fff82d04b840b43a4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904225, "uuid": "dfe7337d-9d4f-424c-89f8-a147434173dd", "comment": "Malware payload", "value": "659e5450b1ac30eb340d0863acb6303a205ccd3ea71dab2c0a680d5b97cc3613e285e5f477d41031a7b2f3585df794f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904225, "uuid": "1f42c302-6ba0-4e73-9c1f-0cabbb58e2a4", "value": "T1A531083265A68829D823FCF018DA8A4588DDB77FD32BEC020660D2F95D2755FE522877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904225, "uuid": "4db7b8d1-3e7b-4a0d-814c-bd86a20cab5f", "value": "48:9pCr7GI6baey2Np7UtCnnxNf1Wbvl12RFd+f8nyn:s7B6uhGtnPkb30X+S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774904225, "uuid": "6c1b28f8-321e-4c8a-abc5-d8dbc6761408", "value": 1735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774904225, "uuid": "b83ffee7-dfc4-49b2-bcd3-84f188898de1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904225, "uuid": "bf68960f-0d67-44df-a169-567bbc037034", "value": "\u514d\u8cbbTV~\u63a5\u53e3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eaa680-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909256, "uuid": "f77a12bb-78a5-4afe-92b7-fcbedfe408e2", "comment": "Malware payload (Mirai)", "value": "04d8546c5e9cbae820094218053e65e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909256, "uuid": "51084cd3-f375-4138-960e-59209fb34e8a", "comment": "Malware payload (Mirai)", "value": "7ea944b1daa39ff521bc62cbf2a7b1aaab9a586e49e28d50331bc95d4c3fb2e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909256, "uuid": "9948b90f-7b81-4540-9722-5b07400d4526", "comment": "Malware payload (Mirai)", "value": "e039b1ce591922a3929e16454d9fc2b7c5150ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909256, "uuid": "d13d0317-8d71-4502-8125-88b1dfdcc9b7", "comment": "Malware payload (Mirai)", "value": "fe5ecbc2b765e66ee3d9cd2858af0a20457a49e41c238e28e2bdd5fb8c2ceee5d3effb687bb814fb2e56e4f977b0d5ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909256, "uuid": "ff0ca0fe-34d8-439a-8b53-6bd85b05d952", "value": "T1B6B3E084B5009F46C42761FC72860E40A3B36EBE4B9A66069173F6746DB8DEC3F079E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909256, "uuid": "835bacd0-3154-4862-b3ca-51f9c7b2d68b", "value": "3072:773tFOiRV6I+Sz9l82HXtGYqT+375hy53qSh5lswuPS:773OcVTTzHHXt++r538HswwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909256, "uuid": "e1d95694-5ad4-4f91-9548-5d7825670005", "value": 115896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909256, "uuid": "be3e6383-2a19-44ce-a3a1-ee14f99f1ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909256, "uuid": "920e7252-1c94-412c-8a72-f16a9cc03e92", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abb9849-2c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774887918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887918, "uuid": "9f1a02c9-6823-4a6a-993d-a38ee72abc6f", "comment": "Malware payload (Formbook)", "value": "f977966d04b863a3ebf07e9331d2f0d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887918, "uuid": "8b5aadc6-7cd5-4428-951c-7234e59cbb7c", "comment": "Malware payload (Formbook)", "value": "8166707195ef31d1677a854603752163bbd98ce64515c7404ad698dca2147aab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887918, "uuid": "958dfcf2-d81a-462b-94da-c7a0d6cd7edd", "comment": "Malware payload (Formbook)", "value": "9a938fee46dbd86cacac2c129a06a2539bf84870", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887918, "uuid": "f8e5cb3e-cc86-4521-887d-547d80770a31", "comment": "Malware payload (Formbook)", "value": "8fe66d0017f784f6cf608622f18ac6126b6a7ca7fa25400e9a8171618fd5926f2d145b718b17898c7d911d5b533573d7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887918, "uuid": "2d4d5029-5df8-44aa-a242-8f1e406fd7d9", "value": "T1B935338ACEBAFD84CE773A4B1032991CED69DE3ECAF8E291542D6A15DD06739012D434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887918, "uuid": "52a34fee-60f7-4eae-a8a2-d29e2abdce2a", "value": "24576:/FKx56o5Ln8PM7myfhh/5rI6ZS3pSsWEOMYg8BXe6nqIcMi:No5r8I5vO2MJ8de8q5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887918, "uuid": "79f75bf6-0802-40b8-919c-4dfbc20f85f2", "value": 1117801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887918, "uuid": "7b3cdf52-135e-436d-b420-960312c3a78f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887918, "uuid": "8d0ea6b8-28b1-4db5-90f8-59c05c3d0e39", "value": "Purchase order PO_NO9105626.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d411401-2be6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774840410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774840410, "uuid": "779b6c6e-6688-4959-88aa-c96afb0dd9de", "comment": "Malware payload (Mirai)", "value": "9b1d5321a68813717fcbcd78d0cd9250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774840410, "uuid": "11bd7213-e416-4722-8c7d-cd32af97d055", "comment": "Malware payload (Mirai)", "value": "81675467497da5d00b688b689c44d40650efb034d2a3e5346a85204695c17b9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774840410, "uuid": "a4e67e13-5a8d-42d2-ad04-cb2f0ab37f7f", "comment": "Malware payload (Mirai)", "value": "51f1d3431991cdb75f8b2a12d05dd2687fa52513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774840410, "uuid": "c4acc5e0-a7c0-4d1c-90a1-cee22e9897a9", "comment": "Malware payload (Mirai)", "value": "dc283730fce44294db1008e0010a20cfbca69c3a10ffe1f8210745a9be67e74157cfd46a5fa471599f243fe46010cf3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774840410, "uuid": "761ca27d-e5f3-4d20-870d-f2e21171002c", "value": "T1CB068D42AA1C382FF4082EFFC90B8F1796395B655953262FE32A74505E323B53957E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774840410, "uuid": "0401085f-1937-45e7-abf3-9e963924dd00", "value": "98304:UQi7cnw/9HwBSTKsXHrQfMJZ+qfQUsDQMGMKKpOAUk:UQi7cs9HwBSTrXZJZ+qfQPM9MKEOAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774840410, "uuid": "f10b69ed-0387-48f1-96f1-957561cba73b", "value": 3795340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774840410, "uuid": "dfa37c4a-fdc9-4810-9f7b-2178d7a20efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774840410, "uuid": "fc22e259-acf8-455c-b047-93e91dcfc974", "value": "wlan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f171bbcd-2c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774886158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886158, "uuid": "7da93a6a-d378-4787-9628-080a98cbc184", "comment": "Malware payload (Phorpiex)", "value": "2ac3deb99004097537876427aa64f475", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886158, "uuid": "0ed6dcf1-0c35-4088-982b-3fd53983c4c4", "comment": "Malware payload (Phorpiex)", "value": "825c433a93885727599aa9ce2d1b92074bfb4b12cdb390588cfccce36079c581", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886158, "uuid": "891366c9-2c8b-4b78-a1f3-05c8f37d87a1", "comment": "Malware payload (Phorpiex)", "value": "c6c98e58dbeca62400aa17f9387acb3486971a6f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886158, "uuid": "c7124c6f-77c9-4a09-bf2f-beb3c1805575", "comment": "Malware payload (Phorpiex)", "value": "d1eebaa6c0c7e421806c28afa86bd82f484350ee3267f8b3c568de272de8840ace3782f5ac55456ab4f9cc75ee72e8e4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886158, "uuid": "0c167469-5487-4f8b-b4cd-4c22ff50ce59", "value": "T1B0824B0FB8424326E0D110B59A62567BD979947673D824EBF7904EEE0A687D1FC3324F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886158, "uuid": "8ff0e605-5f27-41d6-b3d4-632e4ce5c2ff", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886158, "uuid": "1f2b07e6-12df-46a1-b53c-e01b3a291ac8", "value": "384:QI0V5tLwHkvB07rfbdAhZ+Rhav8U9cqS:OUY07rf5AnMha0UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774886158, "uuid": "b8b7a10e-6ba9-4f84-9c3c-05999c18244e", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774886158, "uuid": "019b9644-0953-4b18-bef0-d99b11dd92fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886158, "uuid": "9fec95da-8af3-4004-b294-136195b310fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d7b86-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830543, "uuid": "c4031179-81c3-460d-a417-2a2ad978aea0", "comment": "Malware payload (Mirai)", "value": "e91adfbd04b437ad47a06e0456fd6b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830543, "uuid": "5f2d6b0a-3c61-4283-996d-1ee72c928f68", "comment": "Malware payload (Mirai)", "value": "855b9097543e9278ccb7fbaaa7c9f6b683284c07720a1d3d1313c7d035058696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830543, "uuid": "6aae63b9-0198-4c0e-b179-c734b9103eac", "comment": "Malware payload (Mirai)", "value": "f03231c52db60fb3add020254e1ce17566712962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830543, "uuid": "82218aea-feda-4bf6-ad2c-6165017cb3c6", "comment": "Malware payload (Mirai)", "value": "f8d1c432db693b201b755d973284cfd93824aa307c6a740b6f2b2b241d1e95e43ebf8297797cc7264cf2554e4ed27184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830543, "uuid": "83edca59-b392-4e33-93a9-a23bdbc98bad", "value": "T1B703E0D6F4F75144E93E543C08BBF52118324261693809E6EC882673B74FAE5A27CDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830543, "uuid": "c9579fc4-5666-487d-a3cc-5dc93ecd1c9e", "value": "768:B2xIg7G1/o/nvlTd++o8mhbuj68W4QDc8+iCMevlKnbcuyD7UHQRj9:EKL1A/NTdxqhbL81mc86MeAnouy8HyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830543, "uuid": "6b7efff0-6b6a-4333-bf08-877f5df7dd31", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830543, "uuid": "593ec22a-8583-4093-9862-d744600f3dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830543, "uuid": "9e65ece4-dd19-487a-8487-e8d72937dd38", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e1090d-2c7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774904493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904493, "uuid": "a52d4dd0-2030-467e-bff1-d00e44f5a803", "comment": "Malware payload", "value": "e74adbfe2cb3aacb188352d31c9af863", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904493, "uuid": "010b9a30-709b-4216-8888-8cc33f3a63f5", "comment": "Malware payload", "value": "864eedb88690d3a8479f9deb175e8cd8762b73459c5944684cc05055d14fde27", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904493, "uuid": "9a19c25b-a002-40be-86ec-ccb5f55c1a81", "comment": "Malware payload", "value": "cc26a04117ed5432381dc32b1bcf10a344b18847", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774904493, "uuid": "0281d5ba-208c-4e14-a0da-2d998310c55c", "comment": "Malware payload", "value": "89cc00e74bb155cf21c53ac770020f51ede0eed56e5bef13bbcaf39092dce1404b41272d512a296424f48fa9dca79ae6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904493, "uuid": "b7a2356e-fabb-4278-bdba-0731ecf51791", "value": "T13C41236781ADD207D6F3F050DB2B0955357B51CE7B039B4266EADC9C410E72A845E5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904493, "uuid": "1d9c4e2a-0d49-46e5-a948-bfdaa6f387e4", "value": "48:+3CngkA6vTEL+TFiNnupfn3XnuZQRTrJDRIMnutT+:+Sn5XEL+TIoBOZsr1ynJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774904493, "uuid": "5fbd4d57-3def-4055-bc21-d53845fc6342", "value": 1963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774904493, "uuid": "021db8d2-f395-43e1-8a01-2802313e497b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774904493, "uuid": "4f159fa9-da6b-4b2b-8ed5-5c9e1a3c587b", "value": "IMG-01252610-W0W63-CAM087IMG.jpeg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640f0a3b-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853279, "uuid": "2b03a67b-96b9-4200-b433-60b3835ec45e", "comment": "Malware payload", "value": "8a2ff621a292a38b5b1701ccbc7cd164", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853279, "uuid": "5557815d-450f-4fe9-a856-d86d33cd9517", "comment": "Malware payload", "value": "88c83809a130c5451a0fce79a59b74f3d44a729575b13cb5ed58b163b8f4f148", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853279, "uuid": "01caed8c-fa40-4a7c-adcb-2e41a5aa7561", "comment": "Malware payload", "value": "e47ed932f00116a4b5825cae45e18b64337db8e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853279, "uuid": "f18ae379-00a2-4758-b74b-4a207ad94772", "comment": "Malware payload", "value": "6051f242699a11b54382fac13a0b377e1a77fa792d492159e66e129b81231c260114fc8f7b5c6f827403941f5a7758ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853279, "uuid": "af598b3f-00a3-4612-98d2-d52c9c75737b", "value": "T11274590753EA4108F1F34F98AE7A40618E77BE961D79C46C06AE244D1AF3E5888B57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853279, "uuid": "42dd8ab2-195d-42d2-a2bf-cce4808519d8", "value": "6144:RACFvLZjtKEZcsPJssR+iZH3mM6lg1aDBsPJlH7ceoqRbdqMl8aQeP0LUzr2e:2CFqESsPJkiZH3m9lQaVsPJZ7HRbdLOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853279, "uuid": "704eb84d-0c0f-48a0-84cf-ff883ba60362", "value": 344568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853279, "uuid": "353f7f68-b488-47c4-b101-3d91bb6b5416", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853279, "uuid": "dc853154-064d-4437-987c-f3daf11c5296", "value": "PO#7392997 Wolter Asia.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e18faa-2c45-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774881196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881196, "uuid": "afdd330b-be29-4601-928a-43f77c760c69", "comment": "Malware payload (Mirai)", "value": "1a725ad78c1770cae5ffe7c87438881e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881196, "uuid": "a1a18ed8-1abf-4c10-b2aa-4af632daf040", "comment": "Malware payload (Mirai)", "value": "8a3d935bce0cf761a0950cc83cc80df7017a438487d08a2947e0d21718dc0a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881196, "uuid": "3e0ecd30-7ed5-4f36-8659-6cd7cd0bf1fa", "comment": "Malware payload (Mirai)", "value": "5349b072f1365a888c1376863a04d873dc2d3536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881196, "uuid": "e2855b12-fcce-473f-80a6-8b364f0d1518", "comment": "Malware payload (Mirai)", "value": "d6b3a4f72b40c30f417fbf05380c5c6a187755bfb80d8970b9b842c4ce11bb7055bf8c01ac6d27737231edb197aecee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881196, "uuid": "f1fb19d0-a25b-4d6a-b5a0-8e6a408f02fa", "value": "T120932951FC829613C6D512BBFA6E428D3B2613E8D2EA7203DD215F2077C785B0D7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881196, "uuid": "9079c28d-d418-40ed-a779-9110351bf714", "value": "1536:0s4pE2pQvF2zBQjD10ZVHxk6lMawZDouRMpqOlY8OXYjvkDDK9fvRp:p4pE2/UyZViIMaorRMpZpcqRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774881196, "uuid": "24cdc653-b2a1-4768-8ac9-eea358b53eed", "value": 95824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774881196, "uuid": "7cd8a645-4be2-4402-8781-25739aa594e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881196, "uuid": "ed4c814c-2057-4c8f-b6ab-0072358442f9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cca4a81-2c87-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774909638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909638, "uuid": "eb1abd24-62bf-47e8-9a6a-f29d17e10a7b", "comment": "Malware payload (OffLoader)", "value": "c77e78da19a7322ed5c197779a638002", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909638, "uuid": "a8297689-b7c3-4fb9-9163-0e328a892fa4", "comment": "Malware payload (OffLoader)", "value": "8bfb283f8c52d7ff452c20957aaf939de6235b138771415cafc75851bc08ed7d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909638, "uuid": "6a9b77f1-9a71-490a-8c0f-2f15fe6288c1", "comment": "Malware payload (OffLoader)", "value": "603dbe7c87e1f36628f8ebe232822eded37f972c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909638, "uuid": "9110bc54-5d26-446c-91a8-2990e78be85f", "comment": "Malware payload (OffLoader)", "value": "00371c1dc259bea2d6fe206f49365ee6cd4c1ebf9c009b56fa58467ed06fd9db2c553baa7d253768b995d6e0080951cc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909638, "uuid": "a4e9f75d-c615-42b6-ae74-fda8bd169ce9", "value": "T101460233B24A633EE07E163B59B6A1605D3B7A21A51F8C5696E44C4CDF7E0A01E3F613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909638, "uuid": "beef1b2a-a868-4c99-8504-9628b4aaecad", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909638, "uuid": "329ff5c4-5d2b-464f-aaca-2f23a8184dad", "value": "98304:oN66UEKTfxPWCIYlzi5hxZWPjUvTYZveJl3JcZitqXsPC:MUEKjxPWCIWzirbWPjuTsGJl3MXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909638, "uuid": "58606886-5c25-4e63-b62a-78591f01d81e", "value": 5763462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909638, "uuid": "f887ae74-f78f-4dd6-8803-54c820c15377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909638, "uuid": "a942a31d-8a06-4548-ac99-4ebc65a9da00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1627acb-2c3c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774877461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877461, "uuid": "0ac43bd4-cca6-4644-bd78-32252b15608b", "comment": "Malware payload", "value": "81bb013dea083e6c875d09a93c83300a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877461, "uuid": "da3e11a9-3520-4352-95b9-f3ad3cd84fe8", "comment": "Malware payload", "value": "8f96d6b95c3d6ca268ad06cc8edcb42dae0d16a0c34830e47db93022c796ec2c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877461, "uuid": "822e1cf9-d758-4945-8f58-3afb1bb8e6cd", "comment": "Malware payload", "value": "c1185c381fb5251df4317bf8abc8142b45676ebc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877461, "uuid": "10fb80b7-1c46-480f-af20-46a1b89a2971", "comment": "Malware payload", "value": "f61d200975063a772832aa0518aa9c91ae673dd29f804cafaae44c1fc550799b64782a7f16127b9885284369991d9ec4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877461, "uuid": "0a069fae-23fb-477f-bde3-e1be045b9892", "value": "T1406733A3CC068B5BED7EE43587184A3E9A563F355B134C27B668F90252FB6E433B9005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877461, "uuid": "bf531924-6809-4699-95f9-fd1c80dc6190", "value": "786432:yWifETiEmVLgMh9K2WaT5XWHqBFvAi9EglfFax9LMjqy4Fz:ybfEGEGMMygdWuFvAiug6x94jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774877461, "uuid": "fc12b933-e158-44d9-b4ee-07ecb2909eab", "value": 31002624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774877461, "uuid": "9e893eec-bd9d-4167-b7ee-3dc577f3da97", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877461, "uuid": "97186c00-1361-414a-a12e-830a582780f9", "value": "HypE IDOL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d72f28b-2c35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874179, "uuid": "b64c46f7-b3d5-43fd-9b9b-05fdb162dddf", "comment": "Malware payload", "value": "e7b5d9134497bd1cbf6c0f67c4a3fd75", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "sysmon-py", "colour": "#F1C6C8", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874179, "uuid": "f1d1503c-c6ba-4376-8351-85d339df6a87", "comment": "Malware payload", "value": "90a89e189e15a620beaa7bc8240925f9efb02ed71fff9771f9828b448eb5932c", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "sysmon-py", "colour": "#F1C6C8", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874179, "uuid": "a840c8e2-40fa-49c2-bbbd-fdd6257f0998", "comment": "Malware payload", "value": "1bed88104a16293dd80c2217b910c3023944cd35", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "sysmon-py", "colour": "#F1C6C8", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874179, "uuid": "96dc2910-a820-460c-ad57-0a98c6456c75", "comment": "Malware payload", "value": "a0d8ac6c99066541701ba092c0cbce3117cfe8b6f7a2880eb11e4dd4c203775ab8cbc08561715683031d339ff61002ca", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "sysmon-py", "colour": "#F1C6C8", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874179, "uuid": "a38b423f-aedf-424b-80f7-38894bab99ec", "value": "T10301D397560BF130D466CF3419272C62A60445C85024BAA5C0BE60D12EDD154FD66E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874179, "uuid": "50cc3460-ff75-46e5-b1fb-9b6f3e2bb369", "value": "12:5jglwFZ2+gxi8N6Ji0V0ve0pqK8R5kltv1jLfqsmmu1FF8Av6Y3lVaytaiX:9gcZ2+l7P0xM5e1OsCHu70n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874179, "uuid": "3738efd3-4c78-4d56-8ab2-1860995f935f", "value": 670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874179, "uuid": "19b4b815-e213-4d1f-ac7f-bafc34fa2ede", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874179, "uuid": "ee8df6f2-8152-432e-bd48-35e2d698a12d", "value": "sysmon.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc68ef5-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "0a227bc9-19ac-47e0-9249-3703e9ba7fd3", "comment": "Malware payload (Mirai)", "value": "430828b54454f3d559e9495e4c406b36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "1f55d4a7-b8c2-4dc7-bdf7-9e0779e0a92c", "comment": "Malware payload (Mirai)", "value": "9235accd29bcbfe4b8025dffa72efa87762e11fb303d779420ddfb53039c7d7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "85af73b8-3a0d-4305-99a7-8cd6bac064c3", "comment": "Malware payload (Mirai)", "value": "e30dce60e13fdd791bd407a1b0b9731b4ad8197b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853913, "uuid": "fe97fe29-ab95-44f0-9907-a22f66059882", "comment": "Malware payload (Mirai)", "value": "44951cf88d0b98eb297061de4f644ee72308e5f93856afd03916b56de732e781aca1d3e0906182bff54ffd0ebafee67b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "51a3ca6c-e758-435f-851b-7cfd42c5cf24", "value": "T1067302ADF62927E4C5610E30A1CC36616D2EF5801329CE4D53299CF8EF0D9B7A2690B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "7eb5ff7f-be5b-4bc0-9755-df192661bb91", "value": "1536:qiNnqKxdbnutez1ehkEwkfR0GyV96XNTrloRCRz8UH:ZNqinuuehrw00Dudfzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853913, "uuid": "414e24ce-51b2-450e-97c2-b220ff1e7a52", "value": 76060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853913, "uuid": "f607c665-ac9b-4ad5-9f8c-996e51741ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853913, "uuid": "5f4de0d3-4fc1-403b-a16b-44c5cb855900", "value": "kurayami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6be6f9f-2c21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774865927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865927, "uuid": "42c613a2-6421-4042-9790-0c32b292172d", "comment": "Malware payload", "value": "991102f546909e703f3918bab4158575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865927, "uuid": "a0e860e8-2da6-4dd7-83ea-8fc77a138a2a", "comment": "Malware payload", "value": "930084fcddfa8cf8a0db97413e824e5ef0b818ddc0b2af0db298563615bafb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865927, "uuid": "f0dccb92-d21b-4b4f-baa0-ef183722f4d9", "comment": "Malware payload", "value": "bb277aa2826ea7b70bfa6306d4b0c4fd82655d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865927, "uuid": "992f8c9d-e7b5-4d7c-b0f8-d7ca3d2661ae", "comment": "Malware payload", "value": "bb4947438cd1601fb1b13da4bbdfcb897e5cc47f898bce7eb6f1c53c79c6ec299669a4a99880fc50b5490b737dcfb9da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865927, "uuid": "b9e05334-0901-42f0-b8f9-6d344b606e9b", "value": "T1C8267C9E7A7E0399D4BBC1B4A6B38197E5317C019B705ACB2384535C2A731F09DEB2D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865927, "uuid": "6bb049d7-a331-4652-8623-a8626c4f1322", "value": "726ca573e92cd3f2777a240240e4c934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865927, "uuid": "55517f1c-7b5d-471d-845f-7ab9d406e892", "value": "49152:q65oSpQzhrXJv+ppEEUb7jN8Gtu8ZnPFHz6Jz6Jsv6tWKFdu9CzPTvG7spHFhh6f:x5gVBVPFHzVJsv6tWKFdu9Czij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774865927, "uuid": "71ca0806-c75c-4b9e-8fa0-92b50d9a1ece", "value": 4452864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774865927, "uuid": "89b74219-6a23-4cda-bfae-73878badc6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865927, "uuid": "1d5d9ed7-9b0f-408e-b2e1-3857390cff9e", "value": "2 0 2 6 \u5e74 \u7b2c \u4e8c \u5b63 \u5ea6 \u8fdd \u89c4 \u5185 \u804c \u4eba \u5458 \u540d \u5355 \u4fe1 \u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c2a0f1-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1774861462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861462, "uuid": "7b05b3bb-b845-4e36-8704-90926f8ab48e", "comment": "Malware payload (MassLogger)", "value": "0ebdd63c874cc6c13ab2a8bd7eba97e7", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861462, "uuid": "091c06ad-ef66-4ff9-8ad7-8ecb46942109", "comment": "Malware payload (MassLogger)", "value": "93a67a53a98614a82e490d9eb3ae12b988213168ef0b37a09216fc7c46d4aa52", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861462, "uuid": "b1638041-b263-4b7d-aad7-1546f73211d9", "comment": "Malware payload (MassLogger)", "value": "d4c78a694ff64f04cf5dfc21843f4c05775fe365", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861462, "uuid": "ff3e8577-2d43-4477-9290-66343c2626ef", "comment": "Malware payload (MassLogger)", "value": "71248bdb4ea2535240c1a00e8cb7e2413fbf83d7a58ead5abba2258c681745ac9c8d36c11cb0f2e73e8290af8d46aade", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861462, "uuid": "8ae5b71a-5770-4737-967d-af9921f51869", "value": "T14683F6CC79CB35E2420562772E5BE189F96E4C52A08CC098DFC97A6CB458B17CA7DC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861462, "uuid": "8ba5fb6a-bd4d-4572-8231-681101a906ba", "value": "1536:mXC/KoGwM2F8oUsOhVY82hvjBfyeaZjIAuJneAJnxahflnnSGP9HHWgWNCdq:U1b5lVUvBy9knbJnxuflSSsYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861462, "uuid": "19e4f6be-adca-47d9-a1f7-80d7711a98b7", "value": 86262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861462, "uuid": "1e29366c-80dc-4b2f-995b-9a1748cec1fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861462, "uuid": "7bf90134-d705-4455-99f9-b08aa0e4093a", "value": "PO VSSF-AZIZI-WCS-27-03-03.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2df7ec9-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853894, "uuid": "dade9fb4-2d3f-4788-a3a9-ce1fcb1cc646", "comment": "Malware payload (Mirai)", "value": "d6dbe7b93f46c49850270d91582ca3e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853894, "uuid": "45701ad0-89ac-4f76-95ae-9255d39ee7ae", "comment": "Malware payload (Mirai)", "value": "93d7a9c209ac7237b01b19faa467ffdee41d1b4392ee84c007457302be44f390", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853894, "uuid": "a5ced88e-b87d-488a-a819-7bee73ab3d82", "comment": "Malware payload (Mirai)", "value": "b49a020534190f23f8404b8430a51c699a5b6a82", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853894, "uuid": "62a5ac93-ed33-422c-9cc0-a4461b4f2eb3", "comment": "Malware payload (Mirai)", "value": "7e7950030797af05f67c0c023efeace1adc3f30ab5a1771f1d57e541e3590a268ae26d45ab64e6922b9d88c7f570e9b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853894, "uuid": "1ac61317-44f1-4755-bf0a-c927511279b5", "value": "T1EF342348D6F4C267C53418BC9C7C82FD1B124E2937FB80E35E13F9ABA645A351C6897A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853894, "uuid": "5d68b4e9-6563-44dd-b026-6d46c2aaf263", "value": "6144:zJ3dOqy+6QLf0bru4b1wl0P7LzbyLtjRJDrV9E4P:z1xy+6QLfY92WP7LzGLt1JDJ9Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853894, "uuid": "2ee404be-3f84-4340-be6c-9fbbcdacd5a5", "value": 252792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853894, "uuid": "7a745b27-d05b-4cd4-ad05-fe931f8497cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853894, "uuid": "b72cb69d-5b62-4009-bd53-ada497bf88ce", "value": "kurayami.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d749c894-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853902, "uuid": "f639bbf9-93a9-4dc2-832c-6fb6713b6749", "comment": "Malware payload (Mirai)", "value": "c079bab5df368be0312e26771bcff92c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853902, "uuid": "eaa255eb-387c-48d3-a749-c26611639687", "comment": "Malware payload (Mirai)", "value": "93da1b21340a94e2ae7e298b9129697b90972ac017ecad792cbbf64ed15952b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853902, "uuid": "ef621a2d-f466-49e9-842c-32b8ed83ebe9", "comment": "Malware payload (Mirai)", "value": "39cc90d6dcb0cedc5e28ea892d019361de35f69a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853902, "uuid": "3590ac40-8ab6-4a29-853b-b4667255b864", "comment": "Malware payload (Mirai)", "value": "ff4356fb69b2e802ecd9e78df2483eb7ac41d73af599c60281367311de8d268a757fa74f042d555e23d752ee78d376db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853902, "uuid": "01c578ff-fecf-4bb2-92b0-06df193a9e25", "value": "T170830200D25188A3E29224B4E5EFCE49D4EB71BC74DD06F3539A844F68799507EE638F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853902, "uuid": "bd549fde-765c-4e3e-98b2-ebff3ce017b9", "value": "1536:nQOafW5DLJTcMf8sHNxU6mjJO1otXO40f20opRXVAJIoFJ44jbLyxETXHUo7YkUG:nQsRJTkMUFj1M400yJIoAUbLgKHUo7Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853902, "uuid": "a30d1963-6003-47af-b4c1-45a0e84c8620", "value": 88304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853902, "uuid": "fc24bbdf-5c78-493e-b8b7-876c3b44e600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853902, "uuid": "5cb70853-9e60-4a25-907a-31f1dd1d088c", "value": "kurayami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed04e4d-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830534, "uuid": "b38e7894-497d-48f1-9e43-3e9d6ba6802e", "comment": "Malware payload (Mirai)", "value": "d6d16dc885702929a2200fc0876d9ec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830534, "uuid": "57ee403a-c7bf-4631-8a57-ebcf33bb95e0", "comment": "Malware payload (Mirai)", "value": "955dc8ad10b0a0785e2efe1327cd4bbd9fee4176e82537c3366ee04911785aa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830534, "uuid": "2d83b5fe-ba62-466b-88e1-39887b705776", "comment": "Malware payload (Mirai)", "value": "99174f5ebc75ad0a0b76b66a8fdfd08c9af7a8b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830534, "uuid": "2baddad4-f04d-4058-bd52-c3f5c42abd3b", "comment": "Malware payload (Mirai)", "value": "40b2f5413782c4701f68043156bb3660bac2d281518b234c7e16325b6dfd9ff7f5301d7d6103bbaee4a1e8aaf61ff3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830534, "uuid": "a1475f43-cbb5-418e-8a22-a73853fbda56", "value": "T12B13E1AF689DC1F9D8FE137029521B89BEBD9867560652BB01C83C7F19BB0CA1D70B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830534, "uuid": "e14230a0-4485-4f75-84a2-e75d49b730b9", "value": "768:nxhhZn/MZT5l2bqkFvuXaHPSTxO1AJTisIUD2ESspa6TC89QYNK6Bx05o:xhXMZT5r6vmWPSiwTisIUDtY61Q7+Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830534, "uuid": "ad25884c-f59c-4054-b4ee-e30939ad343e", "value": 42036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830534, "uuid": "cb3f9202-2006-4ad0-a065-86e372c0702b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830534, "uuid": "b99d3d86-26b3-40e1-aa07-a6ff488a4a02", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73450810-2c11-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774858888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858888, "uuid": "a45f6da4-3da5-4a5c-901d-4499e3711b18", "comment": "Malware payload (njrat)", "value": "200ac578ead2386d09000483528c7984", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858888, "uuid": "5d8b4115-4f30-4c3e-9d2c-abab17e48a23", "comment": "Malware payload (njrat)", "value": "959cceef4f8294a4b950aa279840954d3568fb196736defd74a844897d15676a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858888, "uuid": "b6ad6b74-39f9-4761-9568-0f8dd1144099", "comment": "Malware payload (njrat)", "value": "048b9079badcbe9c9cd6941b721f324839d54099", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858888, "uuid": "a3dbb4b8-eba5-4f58-adc3-70793a32d1f9", "comment": "Malware payload (njrat)", "value": "842eee00205a73ef44bb3eb6f4b87f9897663750e77f781b0b581f4fe2f981b76db27a78d0db0902aefcd6b84cbdaac8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858888, "uuid": "6898fec3-9b42-4366-9625-21b0163e0439", "value": "T17B05121773A430F2E5BB8176C525470AE7B6783047206AEF569443B82F273D4AF3AB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858888, "uuid": "6b867f43-a74a-4e22-abd1-ef3951adf32c", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858888, "uuid": "8b52833b-3bef-4244-bdaa-7971c0234c78", "value": "24576:/eJH6hpy/rUFYnj7GxL+7PzgJ6HulTQQGBBYCKa/5:VhpVF3xL+LzgJ6HulTQDBqCKA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774858888, "uuid": "6518ba12-08d3-4389-81b9-2700855bd485", "value": 813874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774858888, "uuid": "4f9c99ca-630a-4bc7-a3dc-28ed65d11188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858888, "uuid": "a7aec6cf-df47-4128-9994-eed316de8893", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64891465-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830517, "uuid": "565a0670-825d-42bc-9366-20f93ca6d5b3", "comment": "Malware payload (Mirai)", "value": "23ff7f6d28bbfcb654e867a730a95aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830517, "uuid": "e34cc80e-cd56-4546-9da5-84059b60cbff", "comment": "Malware payload (Mirai)", "value": "95b5c0afbdea19f217e1d7d1c6ed85fda40d07e0ae90e089b5d872310b465ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830517, "uuid": "0cae40f0-d5bd-43be-b276-3dea3203bd2d", "comment": "Malware payload (Mirai)", "value": "3f1d7ea73cc50153f364c8ed9d5fda5acc7cd147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830517, "uuid": "b62fdb02-9837-4daf-b562-3d7c9a825700", "comment": "Malware payload (Mirai)", "value": "90bfb538e28865d4a067939561eb0d612afbab508aa603a7e12a9fdea604e5fe23c025b8c75830bf02292bafb199aeeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830517, "uuid": "db24978c-bf3b-495e-8f85-2340f5f042c6", "value": "T120B2E054B9A3B572C271B53381AC4285B2D6077CF5B733630520577E399D04A2BBC98E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830517, "uuid": "231e46ff-593a-4161-b646-a2be80eeaa1f", "value": "768:O3E/rkitIElffwEsXz6GdSsrrYs3UozMf9v:GEwqIETsXe6SsrrNzA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830517, "uuid": "d349017a-71cf-435f-87c3-0465be8043fb", "value": 25112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830517, "uuid": "3e6906e8-23c4-48e2-9c8f-7cbe276f407e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830517, "uuid": "89a7dfe4-9fd7-4c7c-b3f2-83733f7134f2", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4e8d2d-2c54-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774887785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887785, "uuid": "ee2120bf-b879-4dbd-99d5-a2707b3ee457", "comment": "Malware payload (QuasarRAT)", "value": "6690bc7cb87f250560075c79b4423e4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887785, "uuid": "7f345fc2-de00-4c55-8b05-29000111aa32", "comment": "Malware payload (QuasarRAT)", "value": "96cae9b475acfad02e5ebfcf3238974ec7ea01b4bb9046a1d69fa459616f2682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887785, "uuid": "e4d789a1-da4a-4436-a4e8-708f98010287", "comment": "Malware payload (QuasarRAT)", "value": "ad4c855d547bce8aadf2e428f7febabadf57bc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887785, "uuid": "c8032ade-20eb-41cb-850d-80a16bd0253f", "comment": "Malware payload (QuasarRAT)", "value": "3e42cec011c8b8823d8d0730365cdde15b12c013f6405937d99118d734d7ed61e9fefd342c8162a675b21200b9cce175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887785, "uuid": "cbc848e8-960e-4c0c-9d05-248499d1e281", "value": "T148E56B1477F85F23D1AAE276D5F044166BF0FC1AB3A3E71B2582677A2C43B6088417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887785, "uuid": "9d52f852-e189-41cf-b1d0-2f3dd33d312c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887785, "uuid": "aeb5c829-8f53-4019-bc6a-577f67fe43d4", "value": "98304:8DIXIQF4xDqkexsqlE8ih9d6W3rYz3XKpk:6QF4UW3ro6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887785, "uuid": "6a304977-9e52-4f08-a0c6-38a19e94e2bf", "value": 3265024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887785, "uuid": "1b5f3d05-945a-4080-a7ae-82c9e6ac241d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887785, "uuid": "371112c0-db32-4235-8f38-2cd6bee1d7cf", "value": "hazfozuk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cbb1a6-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912423, "uuid": "8f1984e1-c663-48a1-a228-d8b863e836aa", "comment": "Malware payload (Mirai)", "value": "d2e25717d806f1a9b96c403ad7ab57bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912423, "uuid": "f4cf2768-8a8b-434e-bf4a-fc9a3cf72a8c", "comment": "Malware payload (Mirai)", "value": "96f0ddb6fbf3fc415f57ddb5bcd0b815e0d7b40b9106003bcbb899d129035bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912423, "uuid": "d775e24c-b9dc-4852-9124-d854740aed98", "comment": "Malware payload (Mirai)", "value": "2e619cc82e994973756531c7a0299ae3856cfb5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912423, "uuid": "de0148f3-9599-4e6b-a78f-5dcfa4d0f762", "comment": "Malware payload (Mirai)", "value": "aaa9c8b007ff29949faae4aac9bf5e916c1dd58f89669f8934cabd3e92df43a18506d347c6ff15848edd06f151fa1205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912423, "uuid": "b53b74cf-b5d8-41a7-91c3-9afd514e9ca0", "value": "T137330B997C828D2AC5D0127BBB7F02E9331563A8D2CB7313D8249B587E8B51E4F67781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912423, "uuid": "ea65246c-c9f5-449a-b9a5-e80c82c5264c", "value": "768:8PyY3WsXLb1uGyxC3pXJyTt39Sb9QuB5tdM4OzJWzRTW3t3lViKcPQshCLMNm+k:8KY31LQxCIB29FBZqzJqW4bhCLMk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912423, "uuid": "116765b7-4603-4a9a-bded-240a91be051d", "value": 50287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912423, "uuid": "e800c4e6-9f74-4f4c-b899-eade15a383c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912423, "uuid": "9c05a0e8-3e4d-4df0-8207-8e03383bf558", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf80ecf-2c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774871870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871870, "uuid": "b3f1a68f-82cf-4d1e-a923-34ac75ec180a", "comment": "Malware payload (AdaptixC2)", "value": "4001effe497b7a601648ce251379fe58", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871870, "uuid": "4e939406-80b7-45ef-b8b9-74cb1de893d2", "comment": "Malware payload (AdaptixC2)", "value": "9735ef85e58a4ef2f8bd6afa76eb6abf532e9aa9186c0f6b4b47ba47f7be1c5f", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871870, "uuid": "d0ad52ba-9131-4ee5-a724-10909971fbb4", "comment": "Malware payload (AdaptixC2)", "value": "41da1139be0f13c7dd3ccaa970226827294d279a", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871870, "uuid": "7901e67b-edb2-491e-83e6-aea46fb8ea8b", "comment": "Malware payload (AdaptixC2)", "value": "aca182f4732b4b2abb53e8a01e07ace6190560c42e4c8c9131f88fc8ae94762feb5ad12e94088c9980eeefc76959e889", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "hangup-wav", "colour": "#C3B2F1", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871870, "uuid": "8113aa28-7ae7-41e2-a79d-34e8f0aeeb64", "value": "T1CAA4235BC039A439CABB007F9B6E8495A3DC9118F6F666008E9E92DD77768C10137ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871870, "uuid": "f9838164-2ada-4038-a0a6-bfa548dafee7", "value": "6144:pA/xwEnGD/XtrhVjcvW1Q68upgGDAUwYoioCBocS+rAKNV4wdsUIWXsnrKA13ex1:YBcVjc/YpvsDTNCBof+08AD1u1+TXoCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774871870, "uuid": "ee1d44d8-5b9a-4c80-9ed8-1fc9c069792a", "value": 491197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774871870, "uuid": "5fc8b83a-137e-4140-92cb-2984ac01322c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871870, "uuid": "db303d97-6987-433d-8e61-82cbb1768cd1", "value": "9735ef85e58a4ef2f8bd6afa76eb6abf532e9aa9186c0f6b4b47ba47f7be1c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27685ed5-2c59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774889685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889685, "uuid": "d06eabb7-26fe-4a93-b1be-e787ae386264", "comment": "Malware payload", "value": "d8e566e0d9235f653a6aadaf8361407b", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889685, "uuid": "c2ef8d68-e5be-4208-9bff-e8bf9c0db052", "comment": "Malware payload", "value": "9a18cb756f9cf875597f0bc40198e7a5f53fffb96280db6023281477d8c3d8ff", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889685, "uuid": "ca6969c4-97cd-406c-8405-c649d9d02c74", "comment": "Malware payload", "value": "7ca7d28ecd9b4800b644e7077daa848c4d7d78cc", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889685, "uuid": "dbdefcf5-bbc3-4059-931d-e5c403698d1a", "comment": "Malware payload", "value": "ef0071d5949e5a11c80a2cf13a891b3221316072f9605e439984f3d7d8a53b3ad8c6c0967e532614fc9b6c0b843e8998", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889685, "uuid": "ed8ef451-2f59-43ec-a963-26c6e26244c3", "value": "T1EF815D5D07E610A4C4A4C7740D632F3A65D71928E84A15DE56F604372E8ADC98DC7B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889685, "uuid": "92fbd7be-1703-4374-a5ea-d4ac8ccfd631", "value": "48:995Ua0x9zviWAJL7840ajxRkOXkgucfUDsagh7sw2MH/Fx9Fyewr4zLpA5u/:75vSxviWUD0A0gvQyKMHv9FPwr4JA5u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889685, "uuid": "b2cf81dc-667a-4167-81bb-b89e6fce758f", "value": 3866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889685, "uuid": "21010f50-adc9-4c71-8014-3fe1c00b819e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889685, "uuid": "f4bd458e-93b3-4463-a04d-62f5a352b5ad", "value": "3bd4a7631503c431a462abf97825294fb166856fcf67680e0c7a46840953bc72.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b98db6-2c4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774884157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884157, "uuid": "8bd1534f-26f3-44cb-9f93-3903c1addc37", "comment": "Malware payload", "value": "d01237cf9da9441bcc4bbe9eb5f74990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884157, "uuid": "c75d8129-2474-432a-ac3d-69216ac47b31", "comment": "Malware payload", "value": "9af7541070c25f79e2366e02f5ea1adc762e51f01ba9821261242e166ab46dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884157, "uuid": "18bf892e-842b-4cb6-a7d1-074386ba0fbf", "comment": "Malware payload", "value": "806190397cd96c0a24da0a767e4ff780cd8e7994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884157, "uuid": "a247a867-9c75-44d0-b340-8853ef0966fb", "comment": "Malware payload", "value": "bcece5c456fee5016bc3a51ef8b1ae92db86104fbc88b841e2197ae966cb7bf8a55f72f8f9ec2744626c9cf8feee97de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884157, "uuid": "c531d514-a553-49d0-aec1-2c781387667e", "value": "T1F406E011E3E805A8E477D738CA669333CA70B9665770E54F0A99D3052F73A929F3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884157, "uuid": "a7fcc5be-d2ef-4955-8224-90cc43754e97", "value": "5e9cba005df82d2eefe491cecb0e42ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884157, "uuid": "24246e5e-dca0-42f8-aa53-225ca715feca", "value": "49152:dH8hq4WpVOOISRYqI0n+L0MPSb24B/Ap1UeWP5/VukpJkr33IjnnLmS9KEd6f7OR:DK0mW+Sz+8tCcZJac067/G/Kt71lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774884157, "uuid": "95b6a323-83ba-47ef-8a09-6f168b7f4573", "value": 3898880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774884157, "uuid": "237cfd88-7cd7-4eb6-a3bc-7981d079bc8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884157, "uuid": "24bd61f1-d910-4394-9c7f-6d362f5afa27", "value": "9af7541070c25f79e2366e02f5ea1adc762e51f01ba9821261242e166ab46dcc(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30aa8de-2c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774898562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898562, "uuid": "1b1aad6b-a460-498c-9206-635e6cd79882", "comment": "Malware payload (ACRStealer)", "value": "015c9a66117a97ba89c2b4216feff817", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898562, "uuid": "d6084c21-dc61-4f72-83f9-7f8ac38f42a9", "comment": "Malware payload (ACRStealer)", "value": "9b545f2972a9962e46f3cd9f44931e267780211b04fd871a2907edda042f69af", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898562, "uuid": "abd3329b-8155-4c19-a7ca-3a0fa721f67b", "comment": "Malware payload (ACRStealer)", "value": "8a62d60dc5568a63afa148c62e7c4c82671e7ff7", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898562, "uuid": "901fe0b1-7e08-433d-9696-41b9a70d3d7f", "comment": "Malware payload (ACRStealer)", "value": "ae4385d861500199a7b815943a983c58bc1d0b2ebc04db8c47d5656a19bb4cd2761fb0f23073cf9a4d572f307a4cda81", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898562, "uuid": "509a1655-1eaf-4022-b927-5fc31ad038f3", "value": "T1A9364B4BBCB118E4C5AA813085674716FB717C841F3163DB2AB1B7A91F32BE05EB6724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898562, "uuid": "c87dae08-d080-4090-9a73-b5f1c68aeb00", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898562, "uuid": "acf25831-a637-4615-8432-4b86a382ad52", "value": "49152:8fbGdAj+XswiM3h02XX43kj1oN9+eTVKXnexfjgxZ81lLyjdjNkOxYUPQclSBhpc:8fQvL3q0XWY12sOLxOXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774898562, "uuid": "a84c9571-c5c6-45cf-91af-5adcc7037626", "value": 4938240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774898562, "uuid": "d6f1e8ea-b372-47f9-a802-c248331ae375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898562, "uuid": "29c224c2-1679-4550-a80c-805c3a920f0c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.82898554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4d17cd-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830526, "uuid": "4ba36844-df1f-45ea-89ac-4e69d5c9d14c", "comment": "Malware payload (Mirai)", "value": "2bd7e64561a4e475cc88c9c1a736d454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830526, "uuid": "40210704-09b7-422b-9a5c-1b9b9e7e5c9c", "comment": "Malware payload (Mirai)", "value": "9ba6aa186362628c27376cf42e8a6cdbb1b614910e05c87104c77bfa5413bbb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830526, "uuid": "188ac0be-1690-4822-a410-d94955819844", "comment": "Malware payload (Mirai)", "value": "34619a94edd9152980ee492d0bdacd9a5949a9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830526, "uuid": "be32d89b-f041-41a9-9ddc-cb3d9e37f2fd", "comment": "Malware payload (Mirai)", "value": "d3b83726a1addd8c43c04e060d1f071b2048a6937010e14788a7006807c87823180c577e2c037c6716ac75e89389c5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830526, "uuid": "c03059a7-8ae6-4a9b-944e-4253d2eeef7a", "value": "T13A13F258140AE474DFABC0360B251BF43C7387932111FE49386CEA4EEE76D657903BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830526, "uuid": "45c21263-61bb-488f-83ef-5e6bc4d5693e", "value": "768:ILD0tMrtiEwV0QKQipwBiozrx3DCCiwrlwl0LLplcF5QMJgGlzDpbuR1J9B:IEmti5+QZmxoZGCV+l0vOdVJuvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830526, "uuid": "81531a41-a342-46b3-97ce-ca23b283d863", "value": 43232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830526, "uuid": "022cbadc-456f-46f0-a020-d4bd2e85c215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830526, "uuid": "122a3644-47c2-4163-8929-700f370d5845", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d415c38-2c50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774885909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774885909, "uuid": "79fec70d-65fe-45ad-9015-e23ce0fde55d", "comment": "Malware payload", "value": "f8f0158ba2c904585534c547f3c0a05b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774885909, "uuid": "0c1805dc-c347-491d-9931-0435d4847e0f", "comment": "Malware payload", "value": "9c4315dad05f9f70982630ff023a6073d6badaed840130ce1342ca9ebf3bb5d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774885909, "uuid": "cd4e52ac-f89f-4243-9597-363fc70cc36a", "comment": "Malware payload", "value": "35bc6632f6efbe414519e115c0c748312855b43d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774885909, "uuid": "ec51c4c9-4f16-454e-b321-8238dcb28cec", "comment": "Malware payload", "value": "219c5f4fd1d0b66817be1f44a5477b20c887c17decd9bce148fc9b9958ff14a8fcb9c4476ed4adf71d9bd0bbad97de1d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774885909, "uuid": "e461a770-25ee-4cb2-a42a-9f4bf220c96c", "value": "T149D5D08ABB48662FC87611330DEA927126578D578E8397437844376C7CB76E80F5ABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774885909, "uuid": "da253516-8935-4ead-9008-e63ee82de5e8", "value": "49152:Qsa2GUFx9RbvQn1Zjl0mgW2y3KfzCgmMQ5o6C7C4VSyYlyYc7:QzSxjmbjZ2y3KLCgmMQ5oZ+4Gtc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774885909, "uuid": "ac3db24c-9dba-4061-9854-a5822018be42", "value": 3003191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774885909, "uuid": "16903dba-0c74-4e2b-8670-c710c9a8ba76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774885909, "uuid": "29c43838-4c24-43ef-a4cf-f366395483c3", "value": "9c4315dad05f9f70982630ff023a6073d6badaed840130ce1342ca9ebf3bb5d1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ba4f5a-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909249, "uuid": "fc225ed4-696e-45ee-9ab1-e692ac2d513e", "comment": "Malware payload (Mirai)", "value": "d6adbfe938c9a6020c71cf69462cfe0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909249, "uuid": "664028f7-7c1f-4539-b4aa-f2cbeb24703c", "comment": "Malware payload (Mirai)", "value": "9c53a3f18389aad2cbaf55d552c776bfdf8c383c3c9e01af03f1e723cb3b1d11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909249, "uuid": "595912b9-90c0-4a97-b26c-e7bc0c380b8f", "comment": "Malware payload (Mirai)", "value": "0f85f31520ac63d47fc2a080734bfc3fb9851d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909249, "uuid": "09c1edd4-5f02-4ecd-a33e-60826a11b97b", "comment": "Malware payload (Mirai)", "value": "3d5e0515e40db80466f78cbc6d1e1a307ad2707d48ceddede401ef20eaec869603079fb1178d3db1a0446587194e548a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909249, "uuid": "00d21786-70cb-4446-a914-07f0a2d945f1", "value": "T15C249320FE0663B1CC720A3857962E5A6E7704599FEB2A316D1F533DDE628509B30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909249, "uuid": "24418ed8-e3cc-4d76-a7f2-a6c280f09142", "value": "3072:MExgslSQ1LVQhd1ZhsC8wnKtDMXYv+K0jUD18RTZzUKp:MEx6apQ13D8WYv+xjUsNAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909249, "uuid": "2a0fe171-0355-44b4-89fd-d990d15b36ee", "value": 217716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909249, "uuid": "f2ca28ac-62f5-4a52-b15d-a7a4d90dec66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909249, "uuid": "2dbf4136-7169-42d6-a825-0b538c8df1ce", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1b94c5-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853960, "uuid": "b3a41718-535e-48ec-9d9c-967f5be80589", "comment": "Malware payload (Mirai)", "value": "922821c9bea36648c1b20986a4accadc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853960, "uuid": "f38b76b6-17bf-4b2b-aae4-62d3e4246289", "comment": "Malware payload (Mirai)", "value": "9c9d3cfb28e71b2f71412a8bfe32d4fc7124abf6662b450cf85329e51c676942", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853960, "uuid": "60cbe472-0b4c-4ca1-885c-8fbf79146e50", "comment": "Malware payload (Mirai)", "value": "e21653cda563e58cdab37833a17cf0eed18dc497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853960, "uuid": "b2a11679-a8aa-490f-b560-0c80601b26da", "comment": "Malware payload (Mirai)", "value": "23b3c1c48e96bd2e63f3ff03ef86e3271fa19c3411b374f551d164e7ca3a03d87576d134e69a0fd4bdee486e6d2620d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853960, "uuid": "34140335-67d9-4bd6-934d-2a175d9dfc49", "value": "T155E3398CF58FC1F6DA0788308066F7BFCB31A4254076D68EEF95AF35DA275829216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853960, "uuid": "23a4d6cb-16ba-460c-95af-8a26aa32d639", "value": "3072:Tr+UdlptN9Xr4QfJThvz4y6wSPd+qMgXR8/OA+:eUdlp/9MSThrSl2OA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853960, "uuid": "867fff52-3d75-4ee0-8653-c2e6ce0ab735", "value": 151084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853960, "uuid": "3164c039-9da2-4f68-ad71-4ba295aabe42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853960, "uuid": "855e06b5-bdf5-446d-98f1-3eafc31b75f7", "value": "kurayami.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db126977-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853908, "uuid": "bc8aec1c-207a-457a-b5f4-380c1ae551a8", "comment": "Malware payload (Mirai)", "value": "f7ef9310134781354214038184b27164", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853908, "uuid": "899737ce-cea3-407e-a9ea-888f8a4a06e7", "comment": "Malware payload (Mirai)", "value": "9e7cc1831e5868453091082155ef59935f54edcb988d5533221e6a7d42c28c8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853908, "uuid": "d07e03be-dff9-472b-a8b3-60ab8c1ec07a", "comment": "Malware payload (Mirai)", "value": "730aadcf9b6ff21bcc8783e83e6d994d9e1cb761", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853908, "uuid": "3451c5a5-c326-4506-ab9a-018f1d82b4a9", "comment": "Malware payload (Mirai)", "value": "123a7f060550e708154121bdf75a5b4dc6e073632bef48a194a27c65edefbe91358e3de1c6eb7c6a8c81026006b562b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853908, "uuid": "c0e8e194-2061-4d0c-b998-14c07aaf37f0", "value": "T1457302BD070048DEDD50AFF746AA4B621F800DB910868E40E6E6E6A21ED756435D3EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853908, "uuid": "64b8c7bf-d0dd-4060-9979-caa5b74c4df8", "value": "1536:w0B3b87urwemjU1Fh+V3z6HdTSPzy4JTJeSesSg0uqzg13gVJuo:wwweV+VGHdTyf3esTqTVQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853908, "uuid": "c022c2f8-4d37-48f0-af17-b34f9b3e3a2d", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853908, "uuid": "c7b6ae72-9a84-48fc-ac8d-4793c8dc4691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853908, "uuid": "b4f5154c-7728-4e04-ac16-aa963bceec72", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4cfa2c-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774853719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853719, "uuid": "5530e1a7-1c40-4689-92c4-d80f5d8df209", "comment": "Malware payload (Hajime)", "value": "d6da2e2d4911a5470759b27dcb5b98f5", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853719, "uuid": "90a78101-5cac-4d59-8b6b-d32755fac961", "comment": "Malware payload (Hajime)", "value": "9e9f35c6f25de8af36179c4679225864de31a6bc38429531a641abbef82edf61", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853719, "uuid": "46d1c1d7-5b00-473c-9938-838e902b2692", "comment": "Malware payload (Hajime)", "value": "b87c0ed29e584cc94e63addfbb6ef3c95e6fae0d", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853719, "uuid": "4fb775f7-f1a8-465c-b28e-9e485aae3253", "comment": "Malware payload (Hajime)", "value": "8e831f64aaa4be17b3b42d04657e8d1d95a4366b9bc74a4015a00e744366be1cb346aeec8c5f4c16766ea2d5f068f632", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853719, "uuid": "8faf653b-2c75-4479-b677-c58c7a2443a4", "value": "T1EC7302E01BB5178C1236E8383BDD306E9128723A329A39646D97518EF917703B673DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853719, "uuid": "36c1d1b5-4581-450c-b3ad-b29ea122f704", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBx:8D+CAXFYQChaAUk5ljnQss/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853719, "uuid": "dd8c7054-9d81-4a4b-ab7c-c0c75002f4ca", "value": 76584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853719, "uuid": "481db987-0c26-45ca-82bf-a188d2b7f7c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853719, "uuid": "826c8e73-131e-4723-8641-32254037eaea", "value": "mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7dcbd7-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774883766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883766, "uuid": "75c84925-dbbe-423c-8750-2395b05a2a06", "comment": "Malware payload (RemcosRAT)", "value": "4a52f85959f8a893123e23b86cab2fc4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883766, "uuid": "c2b53486-1144-4940-a9cf-754b1e798824", "comment": "Malware payload (RemcosRAT)", "value": "9efe4963f077696de97b18cff579bc0a7a317d7d533f92b014e47914d09cd3bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883766, "uuid": "c6be6d52-13f4-429b-b31d-b778d2df4ae2", "comment": "Malware payload (RemcosRAT)", "value": "6cd033d10ca61381a5e824ece9009ea39c5bd6f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883766, "uuid": "7f51a76b-cbe4-4f65-9089-3f2e9befc63f", "comment": "Malware payload (RemcosRAT)", "value": "e0c85277600d4935d99fb1634aa2529b6208d984cb3a689d2f9cc5aac10082fdff98ee6c06c0db80313897de29eaabed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883766, "uuid": "ddc05b64-1e40-4825-b322-ddccb35eca4d", "value": "T19A15AE017C80D032DB9A20715E3EFBBD5A6DA8300B6875DB67D839BA9F605C16F32647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883766, "uuid": "5fe04e5c-88a4-482d-8e82-4fd8d871de2a", "value": "b492aabfbf2837593f4568452d907063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883766, "uuid": "4d1bad40-3756-4989-b3b9-d59536e12709", "value": "24576:fb96nL0NOPKiOaW9H72rBWYBn/yOgL9SG3L35:z96nL0NOPKiOaW9H72rBTn/yOgEW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883766, "uuid": "9d856871-bc42-490d-9870-1d6899ba67b2", "value": 940344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883766, "uuid": "3ee6c7cf-91b7-4421-a734-2b1ee88ab0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883766, "uuid": "57745e4f-3633-4d56-98ac-e1f5cc87afe1", "value": "9efe4963f077696de97b18cff579bc0a7a317d7d533f92b014e47914d09cd3bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b509e1d-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912428, "uuid": "d1357ae2-2e70-4db0-a772-128c896cbc08", "comment": "Malware payload (Mirai)", "value": "1e7b96e195f4f109bf1f14b468a67606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912428, "uuid": "fc93aa0e-c3f2-43c7-87f2-cc2735a0528d", "comment": "Malware payload (Mirai)", "value": "9f231e84ed3e25365ba6b42ef20deaa1321331954228b8928910a874b38f6296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912428, "uuid": "e968f09e-d543-49e2-af5d-727402ec2a81", "comment": "Malware payload (Mirai)", "value": "4050de6ca06b5e6b771dc8daec0a2b9ddd3c5c7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912428, "uuid": "5f89485d-436a-4beb-b877-d6a15535e053", "comment": "Malware payload (Mirai)", "value": "c60197df9c58234d1d1bc7c3b970ba7c368f8b5c96477a5ee6d210b12b65f8052b8415025db9fc5025fe540ab3b769f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912428, "uuid": "465320fe-0c1e-4c79-a323-0a6925e87300", "value": "T191331AB51516F2ACE9E22038F40720F529530A1C3ADCE2D3B0934575FFB9B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912428, "uuid": "f8f8c3c7-2334-43ec-8923-84d93848227e", "value": "768:AKEClhMqB0yBuKw3GoACzQyZRt9kASxE6TlI0n1Oww41:AKd0vZ2oR9Dt9kXu2/L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912428, "uuid": "cb3c43d3-c864-41ee-a717-677f5c93faf9", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912428, "uuid": "a5d5e73b-3bb5-424f-802e-866196d36edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912428, "uuid": "7cd8468b-de6e-4620-8744-5357ad162242", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb1fed4-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830584, "uuid": "f38ea807-0673-4386-860e-a7281075f1db", "comment": "Malware payload (Mirai)", "value": "c6a1d123017f9f47d63dd30969e1d83e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830584, "uuid": "6566adba-7703-4483-9e3b-ef08ba07ab09", "comment": "Malware payload (Mirai)", "value": "9f56a4e0f25b41d8c7f20b09c10e4b297511bc1040ecaa412dac620f8af663eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830584, "uuid": "84f7f297-e065-45d9-91ed-19245d4522c5", "comment": "Malware payload (Mirai)", "value": "57c1207f511f51b86254bed37cc65f98f4dfa0e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830584, "uuid": "3e4c9743-ca33-4650-a8e7-d77000349946", "comment": "Malware payload (Mirai)", "value": "a59b22e5410294ee9c0c53935c2810e7dd54133895b303c9fd77a8660462b99267bc1cdbe28af0a363c9ef09dcf23467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830584, "uuid": "a8ecc93d-417f-49e5-a0d2-85b40a5794d2", "value": "T1BE833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D8AE262D09ED01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830584, "uuid": "fb70c69a-ea27-402b-aad8-095320d6b3b1", "value": "1536:MqbN7IdAcsgxY+miqBNakCkj6Rv3U8GbdGrAyvQOol:TN74Acsgx8iNkCdRvAbdGrXQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830584, "uuid": "043fb965-f783-4092-950d-631a8d40b286", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830584, "uuid": "6bf95a8c-09fd-48a7-98bc-67a2b4e44b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830584, "uuid": "dbe193af-43dc-45e1-ade9-1fe2f3d9413d", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba45fe22-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909258, "uuid": "323d85af-8eb7-4df8-8972-71054b04b110", "comment": "Malware payload (Mirai)", "value": "0a2e13dfd195f2b41851de5b21eb56fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909258, "uuid": "8bb2df8d-9c54-4d93-b4e4-e439a5a5ebea", "comment": "Malware payload (Mirai)", "value": "a011da91831c93332a0ca9049c36a52e8a15bc19d69b48a1c4ae663e7d1bd52a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909258, "uuid": "a192a51c-d07b-48ae-a804-47954238403f", "comment": "Malware payload (Mirai)", "value": "8696f4fd28c1e3dcf607287f72c21165e7521e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909258, "uuid": "54388b59-92f0-4373-b2c0-58b4d4710ba6", "comment": "Malware payload (Mirai)", "value": "c19fb030e330a51d7c4df7371850c33935baf7955b8713c6586d13af5d3e67a3ebbd4857a00a37956b594c05eae0ec6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909258, "uuid": "5a4b4e14-7e1c-49bb-99ef-524b0bf955d1", "value": "T16973028B91759F6ADE911BBCC4E7C6F623D14916CD48B2CA0147708757E6073CD8A8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909258, "uuid": "506aebc6-4253-4b6d-88b2-51f9a51b9bff", "value": "1536:b0NaXrj4q4aD+ziFpYkjkzgs7SX6AeFWsPSUt0KllIxftt8fM8orG:bUwUqCz+2BA4EUt7IZQSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909258, "uuid": "2705f7d1-08b3-47f0-bca7-be733f5c3913", "value": 79548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909258, "uuid": "8d2607e9-4b7d-456b-b788-5b457460c0c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909258, "uuid": "6f7a9456-005c-445c-a7a0-5b016cc430a1", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f865be-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774853635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853635, "uuid": "e8d0098e-9223-4401-b930-64db500e5a6e", "comment": "Malware payload (AgentTesla)", "value": "7cc2b6e96ca83a1bfb1bdd9591527e83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853635, "uuid": "ca9ba1d9-74ab-46c7-b15c-435fd4ff95db", "comment": "Malware payload (AgentTesla)", "value": "a082e8c86a206f9e660c51c356fcf7804b0bac08951a7c55e06f13f5ae3cf1ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853635, "uuid": "02e9e516-9aa1-4619-8979-b3f67f3d62e5", "comment": "Malware payload (AgentTesla)", "value": "519ea1946a575e1a1c0b27256d2410fc3334a240", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853635, "uuid": "5f1a0b09-1f18-44c1-8a02-d1a5dc79745b", "comment": "Malware payload (AgentTesla)", "value": "267d485c1e35dbf83f0f43c4d945b0127486b414874d6467310e4274950b58cf14eff96c00ef9435b95c5c5896247004", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853635, "uuid": "3e618734-7950-4463-86c5-797e7781b497", "value": "T13E35AE0273D2C062FFAB92334F56F6115BBC6A260123A61F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853635, "uuid": "10a2f88d-1f65-47cb-ba47-e74f9519c731", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853635, "uuid": "d78450e4-9657-43d7-ba46-a8d3903a8e10", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMT5EEb3lG7eZN9M:uPVt/LZeJbInQRaMT5EELlGqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853635, "uuid": "f459755f-f923-46f2-8178-eab5f3061cb7", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853635, "uuid": "4a92bdf5-84da-4c22-9d32-9b9d9abf47cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853635, "uuid": "f2a366e1-93b1-402b-b09f-a27e1224cb84", "value": "SWIFT COPY 006554662536373737373752222PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b313581b-2c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774871450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871450, "uuid": "821d818b-b185-4b47-92fa-a942dd67328c", "comment": "Malware payload (AdaptixC2)", "value": "ae22964bf1b4d4eabc15d44dd1d3b629", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871450, "uuid": "9a417067-e57c-4882-afc2-d2649075f94c", "comment": "Malware payload (AdaptixC2)", "value": "a0a8857e8a65c05778cf6068ad4c05ec9b6808990ae1427e932d2989754c59a4", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871450, "uuid": "00308b21-da81-4927-b934-9a2b1ad231dd", "comment": "Malware payload (AdaptixC2)", "value": "8a7e83c1a0fd9917857a7f687cf029670b405c70", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871450, "uuid": "50a48b73-6898-4972-a437-5dd488ac34ff", "comment": "Malware payload (AdaptixC2)", "value": "4c319bb87c4d0379249158c6440569dab7fc13cf7fe93422156e9dbbadf351769a17ad770bbb2b12a1979a07f46c96ac", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871450, "uuid": "76ca95cb-931c-426a-b01b-3b76c6c5efae", "value": "T13814D055A76328ACC913913486A2EA71B5607CF075B4EC7F17A4EA373D32E408B1D7E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871450, "uuid": "f9cfe5c9-018d-4374-80a3-0ee25e4b0585", "value": "d2210feb0438c0ce89b5579ef75ae4d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871450, "uuid": "cbba58c6-94c2-45f0-a107-41e1fa673669", "value": "3072:L0kjfPltxWivjnXkfGwULn0/lUtIluxz48kvUKGY8egQqYDE729SxaBiJNTDE:4EFnAGwUj6q9xzfYAQQqQxk4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774871450, "uuid": "590b7876-f68e-4291-90d0-faac80c57a2b", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774871450, "uuid": "3c352652-5c6c-4246-88d0-a4abfa7a5d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871450, "uuid": "14c240c4-3f60-48d7-86ef-115c30906143", "value": "a0a8857e8a65c05778cf6068ad4c05ec9b6808990ae1427e932d2989754c59a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fb1a8c-2c2b-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1774869865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774869865, "uuid": "675e9f2a-a49f-4c55-b97c-84c5335e10c9", "comment": "Malware payload (CryptOne)", "value": "47ee7706c45da3aa574cd4c904a98735", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774869865, "uuid": "ff0245e1-a8cc-4bd2-be7a-6a9feaf19da9", "comment": "Malware payload (CryptOne)", "value": "a14c14f00c09d47c7d8d74d6c3f718c4fd74d0812ca39cd10860d402885a61e4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774869865, "uuid": "6c0040b7-8655-49fa-ad5c-54d84750d49d", "comment": "Malware payload (CryptOne)", "value": "8c7bb86faebd4952cfd8df4dc94310a03a2d4090", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774869865, "uuid": "74eef6d4-69ab-4a88-af01-389a7c4d7c30", "comment": "Malware payload (CryptOne)", "value": "b0a3b6136bfcf2c7f01267b09db37da484b3463d91cecccf3f388207fa2080f44e7ec401ec67a3504107156101c70fea", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774869865, "uuid": "43c5242b-1580-44be-8bee-ba7b553bb772", "value": "T12F956C06BCE108F9D06A633288B766A17770FC690B3223D72E50B67C3EB6AE55C75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774869865, "uuid": "a4ba3389-e60a-4fec-948a-a3c298c5f93b", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774869865, "uuid": "1bc77e7a-cb95-459d-b8b1-7a4d50124f12", "value": "49152:03mxDfoxPmMMCXMbZi5Gl0QRQEuk5zWSf:03Mr6mZbZi5GRQEz5zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774869865, "uuid": "88dc4506-b3ec-4784-81c8-1b0c6b443b83", "value": 2060416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774869865, "uuid": "0b1cfa67-8e12-4f7a-a5ea-3dcb6f8defbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774869865, "uuid": "2ac71e23-6ee5-4a5a-ac08-3f4677c1d400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50efff32-2c5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774891902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891902, "uuid": "3782c501-d417-4307-92e3-c8f90e0cf44a", "comment": "Malware payload", "value": "da75e70d6a8c5bf45500fca5a3302d6f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891902, "uuid": "d0111239-9344-4669-951f-f32e1eaa2ead", "comment": "Malware payload", "value": "a188646a1676d1fd8e569011be0379008c104868c35859dee600436d2498cd16", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891902, "uuid": "983c4d97-178a-4a56-98d8-73606c9878fa", "comment": "Malware payload", "value": "020efbbc51724f1899f8b79506cb429d36df6c9f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891902, "uuid": "d95e863a-8b7d-4c7e-9e8b-8e51b35dbf43", "comment": "Malware payload", "value": "d1a8dc8b0203e160896d6a5f8b836c2980ad84cd8fe7747049c7107918585c7acf5597308dddd8f44fb87d660021cf2d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891902, "uuid": "59ff2105-4cfd-4a21-91f6-6c29b6f87678", "value": "T11031490D4FC41624E3B28936787BE30188247891ED43EE2D12D160982966611FA7AEAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891902, "uuid": "adb9a00c-2b2c-4989-93cd-d9805bc167c3", "value": "12:8x0C3pQVe/4VGK0JMnOV+fIlVlDmo0I6DmNRcf/iB7+lbYZJl:8xFpQQ7K8V+fk4o0CmQabq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891902, "uuid": "c91ca8b8-4819-468a-8e08-503d05a4f52e", "value": 1565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891902, "uuid": "b08274b6-4d01-4a1f-9338-6499a4f019c6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891902, "uuid": "249a6991-9251-4134-8ae3-8668181ac4a6", "value": "live.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18f8984-2c2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774871904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871904, "uuid": "3df3c103-1a46-48c8-99a6-b7e6be289420", "comment": "Malware payload", "value": "c1a5eb47ad290d6aee542bfa4575fc3a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871904, "uuid": "f57ff871-390f-430d-a24d-908334457d6e", "comment": "Malware payload", "value": "a18e913a028c0710f740b99fd751b93f8e79f562650826d41ad368c021921d71", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871904, "uuid": "afeaaeff-ec64-4914-bcf1-0284f572826f", "comment": "Malware payload", "value": "cc95b4c9e08e4ee51ce43e678fc4ec0a7f57d500", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871904, "uuid": "94e7680d-17a4-4935-91ad-0d8343d5b659", "comment": "Malware payload", "value": "3c237f49004547f2a7f891e03df832dacd9c30f348b1e0eda1422c1b09065aaf73d3b80c212a43e3490106db003c3956", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871904, "uuid": "56033803-9f92-425e-84e9-5bc172f14344", "value": "T13341FE2C638D63A2E3F64A33569DB324CB62BC07ED929F5B15D4168D6C12B00B634E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871904, "uuid": "e2ff3b43-cf57-4612-981a-de8623308c56", "value": "24:8EGFMSEzogW1P8wJB3U/+/F1mhWtR5l4o0F1EC5gqyDOF1tlB5Cv/MRht1d/5zm:8LrEZW13JhjghjoSl5gqyDq1/Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774871904, "uuid": "14180c00-73ec-4ddc-88ab-9990c46b4397", "value": 2358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774871904, "uuid": "2d6b14f0-7aab-4880-8299-91d5fec94c07", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871904, "uuid": "dfcd51b0-32e6-456c-a13a-b03d87969d5a", "value": "PO Order Number 83629344.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d6b737-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853116, "uuid": "efd856a1-8dd9-4372-ac18-ab284f999e2b", "comment": "Malware payload", "value": "0c773663797c3c50156701b1b14e9797", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853116, "uuid": "e565c09f-8370-47bb-a5ad-acc8f030a077", "comment": "Malware payload", "value": "a1ffc0aa933aa4afcdc46631badaf3407ccb211aed6b3d5064f46b5c192a315e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853116, "uuid": "4dcf71d6-e32a-4df1-8ecf-d945b85c8d75", "comment": "Malware payload", "value": "be743ec1d28b774b2f1587b289cf7ebb245cf585", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853116, "uuid": "f79c3d3c-1020-46ff-b302-128d0f254385", "comment": "Malware payload", "value": "118d1e710a6083415ff0aee849420730ef31669e04bcbade3ac66239605cc1afc73732af3fc8eb46740e5041b8e2f4a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853116, "uuid": "fb82e3ee-17c8-4594-b485-ba0a001ee43f", "value": "T14C85808FAC961CF2B143022A2D7E9D1118DB618F9107D6FDF90293C6A062B171D5ADFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853116, "uuid": "b3c9163c-fb30-42b0-922c-7a06adb82c4e", "value": "384:BVxLD+cGFIH8DHMIAZttjEKLc75MEBiIkkZXRPq/G1N3b0yW4RM3:EDnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853116, "uuid": "88f685b8-0410-40f0-97e8-6b0ffedc21df", "value": 1758118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853116, "uuid": "524e4885-23f9-47e9-9ab7-4f7a14b34d00", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853116, "uuid": "fc51cb63-c37d-47a2-bebf-4495d1c0e0fc", "value": "payment receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b755be4-2bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774849265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849265, "uuid": "d5abc93d-f880-44a9-aa82-4b88ca24a73c", "comment": "Malware payload (NetSupport)", "value": "d30d82140b4fd8e62e6aef6a02b83f6a", "object_relation": "md5", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849265, "uuid": "0c000b6c-8cdb-48cc-bbad-c3336ffd7311", "comment": "Malware payload (NetSupport)", "value": "a241d95bfbd5998e27297059dc219826aca22c638862dd86d63f68ef33ed1cc6", "object_relation": "sha256", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849265, "uuid": "e613670e-fa3e-450f-b1fb-7191ffd5ffdf", "comment": "Malware payload (NetSupport)", "value": "bf6a14c81604ceece516a828ad5f15f624fd6183", "object_relation": "sha1", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849265, "uuid": "00668763-0b37-4507-ae68-91db04e2ea7a", "comment": "Malware payload (NetSupport)", "value": "1f354acf4c0cc931e3779bb2ad947b9b076969e24a26499208f232d9d8215c581ab9d98265e731ba8f8007bf155d7fe9", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849265, "uuid": "9b2b2d22-2210-4b60-b27e-d791cf2d0e05", "value": "T128C08CF7C69320BEAA290C12EEE23A34E8CC082C62619A4331E40017C42C2B8D355C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849265, "uuid": "a7dc5a64-b7a9-4e7d-9f38-609504b9112f", "value": "3:VSJJFILqyB7tYMfJGdXJHJAFBALTBdgkh4k5kLVfQIZpVWZildgkh4k5kLVfQIZH:s8t7tYMfJYZHrLTZH6LKIZp8ZiFH6LKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774849265, "uuid": "68212e28-bffb-4150-8e61-4c07b4beaef8", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774849265, "uuid": "431577ce-4564-4b6f-ba4d-2d001b3969c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849265, "uuid": "469587be-0706-46da-afae-69ea5d1e6019", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9d6c77-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774891765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891765, "uuid": "234856a0-bf50-45e7-b907-c8d741cb4c1c", "comment": "Malware payload", "value": "ac8d29578466761e30f32eedd2b80739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891765, "uuid": "ba1fd952-dee9-4e35-88d1-f00935207bf3", "comment": "Malware payload", "value": "a2b1bbcb751968a7d851e85184b1a4496a69f81f82f7a88f8b68fdd3842de8f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891765, "uuid": "300ff3c8-b9f7-4737-8f0f-0bb687eb6664", "comment": "Malware payload", "value": "133762df7b6f949e5ec6fcabc6a884e855708068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891765, "uuid": "612bbb24-e82d-44c7-8ad1-d647db43d36f", "comment": "Malware payload", "value": "f604a5bdfb85547a062c9bfa2d48c2b827770db39b932e7d1231536d7e3725308cb57eb36ff011bee949adbfcbf76ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891765, "uuid": "641a77a6-47fb-471f-9a44-caf7b97986c5", "value": "T155C3275777E630F8E1B7C23984718A01DB72B8725B619BDF47A00A561F236D09D39F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891765, "uuid": "46108f24-d47a-4e40-bd9f-00ff8f020bfe", "value": "bc279eb04aec5b16c27ee3edddbc40d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891765, "uuid": "753ec491-a251-4073-afab-cc256c9b87a4", "value": "3072:3TZowN0squoqUQmfcXu0/aKJDFYpccU8abB3:3VJquoqbu0SjG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891765, "uuid": "2c39f29a-baf8-4b93-9143-0a0efd8e2029", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891765, "uuid": "be6ee258-eb56-4bf4-8618-ba0c0186eec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891765, "uuid": "cf194941-847d-4d6a-b160-66cc5967131e", "value": "ac8d29578466761e30f32eedd2b80739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c411ab1-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774880002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774880002, "uuid": "b3abd146-744f-43c3-806b-f90b5f567aad", "comment": "Malware payload (SalatStealer)", "value": "302e25a1cf3f06a0ac3fdc3221a22bf0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774880002, "uuid": "41c43415-db53-4b52-995e-989bdf5418ec", "comment": "Malware payload (SalatStealer)", "value": "a38855faacdedfd1f5db37de625aa64b6d02bab6d018ddb46389023ffd13cc53", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774880002, "uuid": "7a69a74d-7d4b-4c0e-9a21-2924cdecd7cf", "comment": "Malware payload (SalatStealer)", "value": "6ed75719031ec20ddc1e6cda0d8b398f6950148a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774880002, "uuid": "90bd324f-af7a-4a7e-ba10-be0c307782aa", "comment": "Malware payload (SalatStealer)", "value": "8287af07fe1d25d462e98e35138c9f91ab60e687a5ff4580cf98b4449e059f12a7bae2575d5a811740d74b859e186552", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774880002, "uuid": "d03f5805-fd43-495e-a930-af7f1083331a", "value": "T1C406330436C587B2FC6F5BB05829D3DE9E3CAA184B23CADB96C43D655735AE0C631E24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774880002, "uuid": "0491d96c-1e8d-442c-b4a6-ced29f644b99", "value": "e5a756687447219913f2dd99559c0754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774880002, "uuid": "90dd0964-53d3-4b4e-af15-dc0944dcb43b", "value": "98304:wALUy218xFvTIXhRu07vhiXiR2728fA/15OdtB8S:waF21jXhR9iiA728s15OdtB8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774880002, "uuid": "686c3434-902d-4202-adef-0cdd644264ee", "value": 3806208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774880002, "uuid": "dbeea1ea-6fb1-4cad-8762-df872427004a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774880002, "uuid": "377071b5-8aa2-434a-b7c9-26181c463230", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec7fc9b-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909266, "uuid": "578e23e5-621b-49b1-bc36-23c8d7400563", "comment": "Malware payload (Mirai)", "value": "115a1957e6a38534a64463596bca205c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909266, "uuid": "28e5ce7d-ca81-4372-a35c-3c55f5d85211", "comment": "Malware payload (Mirai)", "value": "a3f96aaf0ed4a834d463244e3c3131bd13e7366a2f5bac5303547d46b6912547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909266, "uuid": "4fe967b7-a6fd-4d84-b91f-603e36ab3787", "comment": "Malware payload (Mirai)", "value": "8270cabe31ed9fe21818a5072ea0e07d5635de8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909266, "uuid": "dc0bbb89-3840-4b2a-be4f-99913750fc27", "comment": "Malware payload (Mirai)", "value": "ab3fa049e5776bdf210091532637bf1cb4e9dc967bb28d968456bf6db07daebfb727666aab837334b662f372a1a68a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909266, "uuid": "44c02dae-d2f0-43d3-afbe-6d399403da05", "value": "T1CCD3F184FA236982D5B306BE94C02AC283612D398B971745125AF774387CDFF0FA9ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909266, "uuid": "f74c6fc5-4abb-48ec-8dba-12cf36a4dbdc", "value": "3072:nSeVpBhcDh9jUnnAKJbxHDqW8eSbQJa3WBat87jmMMTnap+:3RzdlIW8eaQJaG7ixTnW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909266, "uuid": "56d4269f-a0e9-4493-adb1-168930328a65", "value": 136024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909266, "uuid": "b66045af-d9e0-4aaf-9996-30baaac1f2dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909266, "uuid": "bae89412-1a7c-4808-9163-f33e850306fa", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59744592-2bd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774833504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774833504, "uuid": "3e0e8342-762e-4982-a1c9-c4de79940b3a", "comment": "Malware payload (Mirai)", "value": "ef6619b92e71b87ba03af799cd07432e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774833504, "uuid": "c4b61619-435a-4aaa-ab67-250dcf697e04", "comment": "Malware payload (Mirai)", "value": "a497cd58c9107b0bf11639ccdf2b12310d6a9aeabb6dadbd1e71eba042f8efea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774833504, "uuid": "a28c996e-da7a-43ab-8bb6-0947d30431bf", "comment": "Malware payload (Mirai)", "value": "9ab5a900963884fff4026c3a0b03312bb23eb92c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774833504, "uuid": "e9c901f7-659b-4965-95c2-855781c8cd0c", "comment": "Malware payload (Mirai)", "value": "14fe05f164183d376100faa1c9079e1ffb1d0d812a38d00d51384df3ca7ea1ae02af78847ab6132073714a1ef05ee514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774833504, "uuid": "3912c2fd-8b6b-4e76-aa06-51cea6dcaca3", "value": "T1BF064A62BC90CA62CBC0A6BAF75E829C73135B75D2DF71068D14473437EB95A0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774833504, "uuid": "c1bd8994-3312-4f64-a869-8d7f038563cf", "value": "49152:Xg6AxAeRbNSlKSCVyc5n0GYbHc5htjJzwkbDZUt33+ByY3qaPH3:Q6ACeRElK9ocBhYKPJzw8qt3Ed3qA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774833504, "uuid": "3c685c56-fdf7-4d9a-a0d9-c6e67a8df0fa", "value": 3994912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774833504, "uuid": "cf936cb3-50b0-4f4d-9761-ccbdece42c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774833504, "uuid": "558b3aba-fb78-4385-8254-84f50ef8e22b", "value": "wlan.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff744bf6-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853969, "uuid": "a0ede386-230b-4fca-bd8f-d9e97c7637e7", "comment": "Malware payload (Mirai)", "value": "41007c5fa4de5dc40a46ecf8f49b766d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853969, "uuid": "3b3541e2-8155-443c-a3a4-d51fd4c3f8ac", "comment": "Malware payload (Mirai)", "value": "a5125ddbd30e58254594f5aaa19b65c60fca2b2f7d78aca013dbb8a6aac8db9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853969, "uuid": "f5b98ab3-f674-4441-83a3-facf6260c0ce", "comment": "Malware payload (Mirai)", "value": "9a12f31240440b9f96ccdaaf2ca2ca5af58e9627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853969, "uuid": "a05d837f-b128-4aa9-b5b7-02b917a9e158", "comment": "Malware payload (Mirai)", "value": "c1a377c89f7334545d6722a370a65d353af4974c4d2fcbd608ea667b99efbcb439ce0958805a90728edef010f41d5b23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853969, "uuid": "55ee4561-db82-41a6-8416-512b6d61ec1d", "value": "T13D044A02735C0907D1532EF1263F6BE193EFD5A124E4FA44650FAA8A9272E72158AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853969, "uuid": "f312c6dc-c793-43f1-bf07-d96b3ac341f4", "value": "1536:hKkbOXrtGh26Ul8riIHoLGqGe7J8GJFAmSxDxfg80/+Mcj+u8fNaMZlSvAUhW4Ml:MJXrwGiipLGqnVjSxdwKjb8EeLUPvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853969, "uuid": "01aed5c7-2f99-41ea-9c67-a1a55cc9a9b1", "value": 184024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853969, "uuid": "90805084-e0e7-4b99-af3e-9965a37b6d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853969, "uuid": "8a6c61b1-92e2-47ce-929e-931f6340c5a1", "value": "kurayami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45f85ee-2c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774879157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879157, "uuid": "b3e8943d-bac3-4c69-adf2-f005043300b7", "comment": "Malware payload", "value": "944e354bb9adea7c11d8b8d68c561b5c", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879157, "uuid": "6b201727-370b-498b-8bdb-a2fa4c7ed8e6", "comment": "Malware payload", "value": "a6cde37cfd8b9621536ba6a9ced64f248978f0793b1a4fe7929cc3e535738d3e", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879157, "uuid": "ca4023a9-ff00-4961-b347-b8088ca4156a", "comment": "Malware payload", "value": "dcc17445457d669ef279c6591748937bd88a0e3e", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879157, "uuid": "03d56e20-47b1-42c3-843c-040fbed82a2a", "comment": "Malware payload", "value": "ce9379a45b1ad9ba26d21fb9a7d616aaf88ec94c1a6cc90361ab538b3719255bf717e911ce42284b5c53805586244f55", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879157, "uuid": "4197a12c-18b4-444b-93cd-2318c12fce13", "value": "T1ABC08CB18204023CCF9ED84AE280FA9A81E76048E2BB36A03C21688E06003299385220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879157, "uuid": "70a8ef40-0133-437a-b414-853e8a0fdc1f", "value": "3:VSJJFIGFGMF17Nf/sWvER6fQw4IqQRwJAFBALTZH9L8cKyOGGiTZH9L8BE:s8GFGMFn3sl6fQARwrLTF9Ozq9eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879157, "uuid": "e7f7f924-e030-4a34-87d1-cb448b6f6b94", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879157, "uuid": "77bd06f9-939a-4cff-9df7-b5757253232d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879157, "uuid": "a1474e4d-bfa6-4900-b93d-1738ddae836c", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79ce4d7-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909254, "uuid": "b7be2ea8-4f0a-489e-b25b-7bbfe356f5a1", "comment": "Malware payload (Mirai)", "value": "4fcf84bd5525a1115090625527533caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909254, "uuid": "b90276a6-8fa7-436f-a2d3-f14305196095", "comment": "Malware payload (Mirai)", "value": "a6cf97062cd502f81661c00b39403b5bd6abefae526aa681ea8a016e3bb02554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909254, "uuid": "bf36be51-235c-447d-a714-1caf2d2300b6", "comment": "Malware payload (Mirai)", "value": "fe41862793c013ad2a2bb08cc7b9d1ffa994817d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909254, "uuid": "00d7a06b-b127-46b7-bb61-b66001ab7330", "comment": "Malware payload (Mirai)", "value": "51f4b6d343bbb4389709b4021f0be13302b0dbc3452caa1779bc04eebd161f810966f17d02dd8b0426bc6e572e7632e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909254, "uuid": "49dd6c93-6adf-4333-b9ad-8036253573bb", "value": "T139146C2BB3C3ACD6D51163309C316362772FD7091518EAFFDA1A3384A9D7B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909254, "uuid": "fb75b1ab-3308-4c62-9d21-bd30300b3f9b", "value": "6144:h+0GlNOm5158aBgmE/YDoIefT5g9Le7IKTt/i:RaBa/YDo/N2e7Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909254, "uuid": "305ef7de-7317-47cd-b2a9-285ae919081d", "value": 197384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909254, "uuid": "a30791d3-7561-4d8c-8e9d-3d289487ad46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909254, "uuid": "0359212b-e7ae-4e84-aae0-74dd4644af52", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fcdfb4-2bd1-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774831453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831453, "uuid": "27180e6d-e21a-4bf1-98a9-dc48b4faecfc", "comment": "Malware payload (ValleyRAT)", "value": "2bbd029b8b529d251d88a4a1c0f54c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831453, "uuid": "a8c35f61-c030-47b2-bea6-6644d7fb6a59", "comment": "Malware payload (ValleyRAT)", "value": "a76879e7320bf59ad2da99d24b0b20a03a1d9807092ab5409e3e514fd549e773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831453, "uuid": "1a56f6b5-212b-4a85-80d8-0a453e0fde89", "comment": "Malware payload (ValleyRAT)", "value": "309ccb21055362296e3c02368e3febea5bccbabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774831453, "uuid": "2164e99f-be24-4603-b959-c0fb337a11cd", "comment": "Malware payload (ValleyRAT)", "value": "ac077390c0e588682ca05a726cfb8b3f454b7875d853bfe94fc9439ac37afbae8c48a4afbf18c2cb03d1ab7158fa5454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831453, "uuid": "24664124-7eda-45f6-b70f-b488bd4f340a", "value": "T1EC279E0972B500A4D0BAC478CE278A07EBB13C491374D7EF659147EA2F27BD2793A752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831453, "uuid": "791788f0-9d6b-4c3f-bce0-6b8ebe539bb8", "value": "67ab4ff710445cde5ab64b57857ed481", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831453, "uuid": "3a694364-bdd1-43f7-af42-3b13a58df17c", "value": "393216:cMCynyRH99YGK9JDte/d55+eh00l2i8A9L5jiExUP4zg2zKyRgc:nFu9DaP4QyRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774831453, "uuid": "c1495a5f-9d18-4c63-a14e-45ea74617812", "value": 21705729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774831453, "uuid": "327899dd-8052-4f7e-8684-a37fdd9fdea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774831453, "uuid": "d627a702-06b0-45de-b739-c5cb3f2b48ed", "value": "69c64a451eef3_doubao2026.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe950fd-2c57-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1774889189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889189, "uuid": "86274a1a-083c-47e2-ac49-aa897bd16d3b", "comment": "Malware payload (Kimsuky)", "value": "3fdce08723365d5c06e1183585164118", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889189, "uuid": "f28473ca-cd86-423e-8c5d-b03d8d62bc37", "comment": "Malware payload (Kimsuky)", "value": "a96a077d02d5fe3524e3416adc88f09f3817099b617e552338f7c736758f242f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889189, "uuid": "44fec77c-ce89-4cee-b028-9cd910df87b3", "comment": "Malware payload (Kimsuky)", "value": "589a5923dfb3ed85301f3ce4a01b4f3351d647dd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889189, "uuid": "fabd3a7e-7fcf-46dc-ad11-fd9bd64abbf8", "comment": "Malware payload (Kimsuky)", "value": "5b454eb0035bb80a0f38e6e88ef8d56b0aef6f5c0440ab76c8b99204396c8c34e303fa6532e7aa46a13aa3cb826a3da6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889189, "uuid": "05b686b5-221d-4987-9557-0d722855087c", "value": "T125B19E083AB0C2527B025D75C2F652FBA4568F0582D2F81682CCD23850AF57F94A27BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889189, "uuid": "bf4cbfe6-ce10-41a5-acc2-97b7a1bdd610", "value": "96:aNEr0lu6K+T75Ur6/w6pqiLROIciH4TcH+chq/ZjYaD4HLiFAk7w5zm2scu:px6K+eArpqiL8Yd3hq/ZjB4HuFAtm2sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889189, "uuid": "8bb398b8-019f-4725-b024-4b4267764272", "value": 5262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889189, "uuid": "84af165a-be57-4698-a343-42ded441bed4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889189, "uuid": "26ca9adb-256a-44f5-9048-eddb321edc00", "value": "PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine (2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7e5f9f-2c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774870956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870956, "uuid": "320e9fe8-88bb-463d-9ce2-ad931eb0e783", "comment": "Malware payload", "value": "9e837f0b9e8037b06256e2ec4291f757", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870956, "uuid": "cb84ec67-940a-4d6a-b03f-82f2bfeb01f1", "comment": "Malware payload", "value": "ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870956, "uuid": "6861f4a2-69e8-49c0-ba44-a8dd6bd6c82a", "comment": "Malware payload", "value": "6e06766423a9c046511fb32b100c4a49adfe6e2b", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870956, "uuid": "00c201f9-a339-4a55-badf-17cbc98fa8e7", "comment": "Malware payload", "value": "738da1b426bfa458fca3c54ebb8a4b65e5b48a06eae2718dd798020a93d84f30a9885d995cb72aab1e97fb22d1caf4ca", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870956, "uuid": "91459879-0636-4791-bcf9-0a6ef95da878", "value": "T1FB74BF4BDB0DAD71977662BF9053AB4324351463C638E12CFD2E62606FB3344B5E0A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870956, "uuid": "d742cd75-8b53-4b68-b1f6-6da5aa2d8cb7", "value": "3072:5NgKC9pJ0ueaIs840OgsY4QL0CjlJQ7lZ0eZNEEVk0wtzP44vi0RXzH0mV:HgZ9pDeam+gsg7jlJmtZNfUtzPBDXz5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870956, "uuid": "6ededb22-637a-43fe-ad7e-74e8561f54a5", "value": 351121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870956, "uuid": "6aef148f-be6c-47a3-b55e-aa9dd843bcf8", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870956, "uuid": "e152490c-40d1-4bde-b6c0-f0230ebabec0", "value": "v4.87.2_client.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa15366-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912426, "uuid": "c9b33c06-fce3-4dac-bdb0-d3d1551ef124", "comment": "Malware payload (Mirai)", "value": "931aab889cdb941e01dfa8259df1baa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912426, "uuid": "4f8c6fa9-82c9-4e68-b9dd-bc80b1287388", "comment": "Malware payload (Mirai)", "value": "ab6132b08cb8dd8ffcfbe47b39f44029d8cb3fa99d84c05e75b17338fee51357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912426, "uuid": "fcdbe74c-26f9-4ce7-8840-7ba96eae53fb", "comment": "Malware payload (Mirai)", "value": "6ca5be6733e2c14563852a13f8d04370aded061c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912426, "uuid": "9e2aa2ef-fcf7-49e0-8bd6-6fb2a8a75a8a", "comment": "Malware payload (Mirai)", "value": "120c38b71fe18fcb421c59db837ce044313cf86ce4aa50073e50bca0f0ff1d6116a59f51bc2cad8db891c6730ae12b57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912426, "uuid": "82727899-4d45-4bcf-82d1-c603e6da92ed", "value": "T1AF133AC19643D1F2EC5212F5247B67624F76E4368A7DFA92DBA92631FC02B10820B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912426, "uuid": "189b9fd3-2d3b-4011-a7a5-6c1357723acc", "value": "768:QQaiSup66OkEgy5oD5YQuLKbvOTtndwQo9dsZkI/4b+Gd7nX:QQaiSuptOkEX6D5YQ1bvytne9dsZmb+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912426, "uuid": "cf5a252f-d804-45f0-a398-b5c1f5988191", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912426, "uuid": "5771cb69-9732-4100-ac78-0204e007e14a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912426, "uuid": "92402110-7191-4977-80f2-35f9c4384c83", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b68e75-2c08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774855137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855137, "uuid": "fd9b1f89-e436-4ee7-a20c-e71f4abff904", "comment": "Malware payload", "value": "85472dce2bf3e791404ce8058292707d", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lofty", "colour": "#FB2F67", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855137, "uuid": "81ecbc8d-4658-457c-b07f-23d7a29d47d0", "comment": "Malware payload", "value": "abe40b94157ba52d6f3c588b22f745954f1bb80188cb912b14457a998407eac1", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lofty", "colour": "#FB2F67", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855137, "uuid": "6f389bbf-2953-436d-bbe9-54bf7c58b2d1", "comment": "Malware payload", "value": "3d78ddefc48bf40518e4775780b92057e8616d1d", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lofty", "colour": "#FB2F67", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855137, "uuid": "3f8001ca-f4a9-47bc-a533-135bd6508239", "comment": "Malware payload", "value": "1fb057d56b02c7c204e05cd2c9ed14c701fb82abefa76934f9ca7c5d709e51d4c163f313ae72efc3ae8835fcd18286e5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lofty", "colour": "#FB2F67", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855137, "uuid": "2a391ec6-9069-4db9-a8a7-2623ed907845", "value": "T10E746D2AB555157AE1ABC478C9534802EB73BC854772E7DF17908AB20F27AD0AF3DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855137, "uuid": "aa946243-ac67-4d42-b73e-9484856125b0", "value": "f178e0a0afbf6406dd47755ef363ece6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855137, "uuid": "c358b097-3f17-4fb1-80f8-2b4ad1e8e506", "value": "6144:Npt2WMlzdaBNgnMEofk59d31ZvSkhUyLqUArXU1jI3:zt2taBN4M5kbxvSke07ArXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855137, "uuid": "2cc00da6-bc90-4487-949c-57c6ba99b618", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855137, "uuid": "d1a3d802-7461-401e-a4f1-bd3cd6694041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855137, "uuid": "4ef54900-5719-487b-9aa8-efb47a57d640", "value": "abe40b94157ba52d6f3c588b22f745954f1bb80188cb912b14457a998407eac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c86dede-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830530, "uuid": "7b4c011b-dcd8-467e-9e02-51977a575875", "comment": "Malware payload (Mirai)", "value": "188de38c6e2c5aa95fd76eb86cfb0bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830530, "uuid": "a036aad8-ed39-4b9a-b5a0-8a8a906c26ac", "comment": "Malware payload (Mirai)", "value": "ac6fd224364aeabcdda478aa1ac9098955bf22d0c9f58bee9238f116b6734ee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830530, "uuid": "c9cb21d5-cdca-4f11-bf66-6ed657206a22", "comment": "Malware payload (Mirai)", "value": "f4767d06f0e12ffb8c9bb86d076ea2fe69cb7a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830530, "uuid": "f1d3d362-bf77-4858-85c7-ec0678d3805a", "comment": "Malware payload (Mirai)", "value": "f6b1f3f31758f15b7141cc9ace66b957d9d29535f860bef32173a338d94979da1147f1d1a2ebd6a680812f0e3bbaa7c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830530, "uuid": "920ef36e-5309-437e-bca5-c886ae267bdd", "value": "T175C3AE97F78B24A1C86246F007C76B8E3E6362019E6BE9E76C1E753B19390DF19063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830530, "uuid": "37be9807-a88f-45c6-84e1-0610b3ffd6b5", "value": "1536:H6189r2mIHgqH8INWZzEB4Z+LaLWqhIij5AKBMeFCjxZJOug9P/LWA:a1ur2nj7wzEqZ+Leth5AdeFCcug9Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830530, "uuid": "8f37fffb-0f73-4693-8eb0-d56cc9e52405", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830530, "uuid": "d81dabfc-ce73-4b90-a3b7-de86f38eba4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830530, "uuid": "48fca5f2-7afb-49a2-adc8-7a5ae9398f93", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159ed682-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912418, "uuid": "a58e13b7-725a-42bd-861b-3c5b2d6d9c94", "comment": "Malware payload (Mirai)", "value": "a63e6e67382746d11807656c980c510f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912418, "uuid": "8b2d73fe-65d1-4658-8f95-8f1c21ea27ac", "comment": "Malware payload (Mirai)", "value": "af13b739773d218822065ab005d7eb7a7ff013b40c498dddc072dad0951f4793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912418, "uuid": "aa0d280f-8b37-42fb-a39b-6a07f32d0cab", "comment": "Malware payload (Mirai)", "value": "edb4771ac4122be4b5643e12800e0b1bb5f11c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912418, "uuid": "5968401d-f7ac-4a3b-8d69-16aaa6be9691", "comment": "Malware payload (Mirai)", "value": "4ac28e86627d8360dac44819b800bce55002d19fccc9d8280a1c28d2eed6ccccd6b588b48e45a155b6d9ab9b9bbc120e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912418, "uuid": "c8edc0e6-966b-4c64-a326-8f37799397e1", "value": "T1BD233A035492C0FDC955C230AB3FA636C922F47E123AE59D73E0BD227E4AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912418, "uuid": "8c96e92b-a2cc-412c-9af4-17e124a78898", "value": "768:FkrR8ysZAY+OGZZRY4JfyPtsIDKvv8RrACGyjltp4B6gC:6d8y2+OOOZQq8CGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912418, "uuid": "dceee471-f667-4d6e-9587-9f04e07cbb7b", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912418, "uuid": "2b1a5e4f-6104-4cff-aa51-6863e74c2f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912418, "uuid": "732c698f-2435-48f8-b078-6c4edbad0f0a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4465fef0-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774861386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861386, "uuid": "a82c247b-a824-4391-bcd7-52f606e95248", "comment": "Malware payload", "value": "7531f6ad634c518622e2b5bd518ebfb6", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861386, "uuid": "b22a4912-02fd-45ab-bc10-ba8efb6ab739", "comment": "Malware payload", "value": "af25f41c391b829095850fd1d4f2ca3765c330610d596b0a5a86efbb836d700f", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861386, "uuid": "8f8c3490-ac40-4e64-8d1f-8fd925b7adb9", "comment": "Malware payload", "value": "9de3388ec38690b01dad9ef746a48d138829045e", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861386, "uuid": "71befba3-b22e-46ea-b310-c07c17081e9d", "comment": "Malware payload", "value": "c02466ee6ab7b6842fb90f2394f450c8b0b99a626f1c6d0a3ef4b469056f2390145e62381b8fed04f8729d6285d2257b", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861386, "uuid": "cd68f9ba-eda4-4548-891b-1b53a17e7920", "value": "T11105AF11F9C180B2E5A2003096A99B735E3DB92447149EE7E3D44FB99E301C5EE3E76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861386, "uuid": "bd69ce02-a99c-484f-a871-2adef3cb8ae8", "value": "c46361acbc6129c17dfb2b9feeda77ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861386, "uuid": "9059da1b-fc2b-4cff-afb9-07cab796c051", "value": "24576:Jf0FaZasFcd54GK2z3LMf+Mh0o77viME2:JcaZnFcn4N2TZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861386, "uuid": "36849a05-9bcd-4ec1-825d-1d070cd4cbc7", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861386, "uuid": "28d0ec87-4cbb-432c-a337-91471362621e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861386, "uuid": "8ec8bb62-f693-4f5a-a01f-cef90f993c47", "value": "info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b1abf7-2c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1774884145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884145, "uuid": "4c92c30c-f871-4fc8-97f2-5ad1ff98eed5", "comment": "Malware payload (DCRat)", "value": "acee8d19fe0ab5f3d91ed25d539aaa23", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884145, "uuid": "bdafe006-0e66-4c8f-bf76-1f36c4a242f8", "comment": "Malware payload (DCRat)", "value": "af286b9259c6b1ef24457a9de39fcd9f961f7521d063fbd47135af20a7f601d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884145, "uuid": "1c098dd4-9fa6-407f-b955-a14132b0c260", "comment": "Malware payload (DCRat)", "value": "1847a3ac88e78123e7b065b2e3b9b6f7e67d3243", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774884145, "uuid": "5a30306c-c309-442e-8a49-b14ec45ea2c5", "comment": "Malware payload (DCRat)", "value": "6fb8f08e27a6bf5bbae76a7be99de2a892515db92067825c85754ae6fcf0e2b5262dba9f41905a607a252614ae5e37d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884145, "uuid": "65f8587e-8bfd-45b2-8314-14f6f7842a8f", "value": "T10575122853D95B40F5FE5FB43864905146B5B702EC27CB9DF2C0618C8A77B86E732AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884145, "uuid": "f34a0386-d91a-4cd2-87fd-44fc093dcf5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884145, "uuid": "c65df95f-9c03-454a-94bd-549e8c79197a", "value": "24576:j++JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUUU:C+a5csqCeq08moPajSQY5HYryHACWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774884145, "uuid": "923481b3-107b-466a-a412-6a4ba017d510", "value": 1561088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774884145, "uuid": "235d561b-9ed7-4012-9c0f-bd2d1b3b6414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774884145, "uuid": "a52cf99a-47f6-4f84-9faa-c70d6a54fb1c", "value": "af286b9259c6b1ef24457a9de39fcd9f961f7521d063fbd47135af20a7f601d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bb727a-2c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774879154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879154, "uuid": "9016c522-29bd-4a10-9142-47474156535d", "comment": "Malware payload", "value": "9e577d2d27836aaad8bad4235f6d602c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879154, "uuid": "f3033f19-e284-4823-b586-81aa5e321d21", "comment": "Malware payload", "value": "b0b226b9b3f660672940229c6bbaab38f5939de0c5192471820f1009691051a3", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879154, "uuid": "d28882fd-d40a-40bf-ac88-d75e8b8ad142", "comment": "Malware payload", "value": "68d68f167fb4d46f46e546911435ea3e60558956", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879154, "uuid": "6761f484-269b-439b-b810-ef6dfb57f159", "comment": "Malware payload", "value": "2b11b017794f86bfa9e17daea867c98bd19ea027c7fdedf17ebc12799224a7d43625ac69291dd66827696dee6cc08b74", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879154, "uuid": "686664b8-2767-487a-9c7b-26397e873ec7", "value": "T10B330824B555101E137397FFA772E6C0FA360173AA4242BBF5EC90644FB64249A72EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879154, "uuid": "34c7ab04-5800-4a13-adf9-66264616d101", "value": "768:ANcb2W172Kc0QbVCj1Jb2UyjV16TNAsvQruVQUSAa5jI5Qa7Iez0mBQnX26LLOik:db2i2rAb2F16TNAs7ua7Is0BNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879154, "uuid": "a9a221b3-397b-4034-bbb4-762cc73028c0", "value": 51635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879154, "uuid": "846dc769-b6c5-4174-9cb6-a4aa785ab608", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879154, "uuid": "faf76a1f-78b5-4af0-a81d-f587518cdadd", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e391e718-2c54-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774887853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887853, "uuid": "162edfbd-6bdc-44bf-94fb-162febd2ad40", "comment": "Malware payload (SheetRAT)", "value": "3445608492c21ee8202f32fa058ab09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887853, "uuid": "708c39be-2a7b-4268-a403-3258581513f2", "comment": "Malware payload (SheetRAT)", "value": "b1586fa715a867e6c983818cd9e07fa6123d444a263b410de6fba5e97319fad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887853, "uuid": "98be2c64-9e29-44d7-b1ed-31e563137d61", "comment": "Malware payload (SheetRAT)", "value": "6e4a7be4332ae333a517effa6cac13267dd96564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887853, "uuid": "57e9b23f-a8cb-4b76-8c2e-1168c0b43eb6", "comment": "Malware payload (SheetRAT)", "value": "2da854eeb179880f704b1eecc1038f981b7f531805d3bbffc961520bfa0a51a93f0b36d2a3090de3b6bfce021104d08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887853, "uuid": "b74e347d-4147-48b9-884b-89f2aa21067c", "value": "T15174D50CFE91E805DD1E3D77CFEA10045B7161C22E229286325AAFFD8B5537698E61BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887853, "uuid": "4d16e96a-8570-4263-8dfa-0fc8637e446e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887853, "uuid": "64cda3b7-463e-4027-a6c0-751e651eb2ad", "value": "6144:3xuX+3EDDn+fe6VlWT8b9UBxUK2Wyb69Ah:BuXr3YPVle84UaV9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887853, "uuid": "12536370-ac55-4896-8725-98b891470700", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887853, "uuid": "b2f66d7e-3baa-4181-9391-68c9da06e052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887853, "uuid": "28e2de1c-ea44-4568-82b5-3e6593999d77", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3b5637-2c36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874961, "uuid": "676492f4-1dab-4220-8582-b95393c90c8f", "comment": "Malware payload", "value": "b676c0703f8e4d6a198aa370ca4f5405", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874961, "uuid": "506a24bf-3e1a-49af-bf36-b4cffe06eeb1", "comment": "Malware payload", "value": "b219ce2263c913655269946b884c38ee3dc577a7f1221d4524f2b2bceb1f55ad", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874961, "uuid": "b76b8115-5cd4-4d42-8231-a91ef16e3542", "comment": "Malware payload", "value": "b7d783721c97c92136b71520443e27304fc191a1", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874961, "uuid": "471371e9-51fd-4353-bf72-14025c65d8f6", "comment": "Malware payload", "value": "4e39fec15258f35893243a1975b63d9d2eada87e588f66bd571a6a1892d1385584bac0e4cc2a4c3ea0454d2613734215", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874961, "uuid": "cbcccd74-605e-4d43-9ff1-dd18a8f95eef", "value": "T1CD21CE63ED043596D78290254A34DAF233CA7C1BEA0B88B07EBCD7A81F8E43544F4A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874961, "uuid": "6e277086-445f-4fc1-b3c2-e6a3ee889369", "value": "24:Z9Ggt3hvVJKLvpU8O13aHLf9zYsrpzfKwsrZ4Nxnz:ygSxKOrBKfEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874961, "uuid": "a4ac4cc6-b6e1-41f0-908a-137fb3b1255d", "value": 1170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874961, "uuid": "21d3e098-8782-4113-bae9-89ed5730be4d", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874961, "uuid": "c90bedfe-5935-42d5-aeaf-113ed12042f1", "value": "sysmon (2).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6f7a0d-2c5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774891899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891899, "uuid": "ebb14a0d-4591-4e2e-b817-9c34c1646967", "comment": "Malware payload", "value": "daa31b68aa597dd4938bba8a216614e3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891899, "uuid": "d0f6891c-4da5-4227-b7f5-43c690f6d250", "comment": "Malware payload", "value": "b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891899, "uuid": "6e99daac-3bd1-4df9-aff0-1884d5a102e8", "comment": "Malware payload", "value": "231b63912f9935c9d3927ea6998d89a6ead9aefc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891899, "uuid": "09fd1ca0-e30a-4e87-aa99-eb3888fd0700", "comment": "Malware payload", "value": "cd45c6333136d8de2d9d14bbfa173f4d70c9d434cebfc1fe333294958830953ab40df28a3104ae92aa333d80f6c9c599", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891899, "uuid": "b81db566-bb3c-4567-a0e7-12db28c102f6", "value": "T132317D0C4FD50A14D3738D366457E301C8257422ED43EF2D02D1509C2866511FA3AF6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891899, "uuid": "a309d901-1cd2-4dc8-9213-2400ca6cb794", "value": "12:8x0C3pQVe/4VGXJMn0V+fIlVlDmo0I6DmNJcfh7Ek7+lbYZJl:8xFpQQ7bV+fk4o0Cuh7E+abq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891899, "uuid": "748f0649-7869-4e81-9bd3-24f30d7dc7e5", "value": 1557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891899, "uuid": "05afb2c4-0cd6-46de-9d95-273a95e52d81", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891899, "uuid": "61033459-09b3-40d2-b316-7a031788501e", "value": "uat.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ddc3f0-2c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774860161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860161, "uuid": "6f67f14b-a1b4-4367-b941-5d4407f413ad", "comment": "Malware payload", "value": "c7fe43e149c0f904b05ad0ac250f68bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860161, "uuid": "b4411b49-933f-455c-8ee3-52c637bab822", "comment": "Malware payload", "value": "b38c9f871dc4735320464bb80219372a0ffe2b4f8750942b550576ace9b012b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860161, "uuid": "9824665f-3f83-40d9-b7a0-d3e75684b4d7", "comment": "Malware payload", "value": "c80eff76d3eb42f1a8d561e26e7227c49d411e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860161, "uuid": "62096018-0bb2-40d3-90cb-96f4b53a33b2", "comment": "Malware payload", "value": "717303e45a167762a9c62fb5770ce813af4e4add93865e0d7369503366828b4383b4f4240f17b11267f6f68abefb449d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860161, "uuid": "1d0a0931-e519-47c7-a699-e7b40967c085", "value": "T1FC18332135D7456AE19AD27611CF2823C1DF5E1077D73388E809A2ED7D3BA90EEC8627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860161, "uuid": "667c24f8-d855-4d1e-8bc2-76990ec1b54a", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860161, "uuid": "9151519e-84f2-49b2-ba5f-5508104dc0ea", "value": "1572864:UR41uucWbDGxwdspDI0GnL3jmVOwKo8vj3MKcrbgjgKZwWlDp07UygHrlY/z7qf0:US/bCx6shRGnL3juvIDMDgTlp0Ae/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774860161, "uuid": "53697a56-bf8d-48eb-8d7a-f45ece77b5f4", "value": 91018232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774860161, "uuid": "cc068dac-2e68-470d-b218-92b8aedd6f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860161, "uuid": "c79e79a1-b6f1-4785-acd9-405f3cbe30c8", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4385db30-2be8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774841199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841199, "uuid": "a1963b76-73e9-43e7-bd78-cbbbe966153e", "comment": "Malware payload (Mirai)", "value": "40447ca01059307419342f1f8555adc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841199, "uuid": "104632c5-1304-419c-9ed4-4725c81d9cc7", "comment": "Malware payload (Mirai)", "value": "b399c3bf1089f50229ad2583e6cadf48534614cf7ac8a032aa26bff441978426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841199, "uuid": "ec071d1d-de54-4ee8-8d49-ec22c7aa882d", "comment": "Malware payload (Mirai)", "value": "e17f1e3f308a4ecc7c5e3d8b7251273fe0c1ae64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774841199, "uuid": "c1c4cc48-1242-424e-89b7-7e4d92611297", "comment": "Malware payload (Mirai)", "value": "16a0223bb00d9b88fba25bc851cd08f756eebb4630f61b7a323a5bf3bfaefc085603865c621a27e7a7a6c7a21fdf1c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841199, "uuid": "1ae0b694-0ce8-4265-af02-ee68fda958bd", "value": "T182065A62BC90CA62CBC066BAFB5E829C73135B75D2DF71068D14473436EBD5A0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841199, "uuid": "0a27d7e1-bb80-4dc1-9d6c-4ad51be32ba1", "value": "49152:4TAjIKerSFRL+ICp3RJGtNqJ4s94+8igQmuYUI0qmJ+RY23a4PCy:4TAjherS/+IAKzvskigJKI07uB3azy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774841199, "uuid": "9eaff068-98be-4135-b269-6e83cf6fb9cb", "value": 3999008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774841199, "uuid": "b8cd473e-06b8-49d6-b1ef-25bc48d9de16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774841199, "uuid": "2cabcc98-1df5-4fb0-92ed-85bda0f8e489", "value": "wlan.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1efcf7f-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909244, "uuid": "473d77d1-09b3-4a86-b741-aa0590b83172", "comment": "Malware payload (Mirai)", "value": "f8306de3053b480bddf37f0b5e301a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909244, "uuid": "0a3eecf6-afa2-4f16-807a-c90404f94db7", "comment": "Malware payload (Mirai)", "value": "b632d1b8c1e520bfac47d8bf846df39e23d6deb688ff6e674db6f285d61d9f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909244, "uuid": "85ea5bbd-28c1-4098-a0c0-5140a17c58c5", "comment": "Malware payload (Mirai)", "value": "e2da89dda3d818cd92927b2fbe8844e54de416c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909244, "uuid": "3b955b9a-de09-46f0-9801-284681d9e2ce", "comment": "Malware payload (Mirai)", "value": "0e7ec888bf892efcd9a426b72eb1b641693746ad8d7a6cf957908b2469c342c0646c46fbf003f33f38e112efe2de20b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909244, "uuid": "81ddd5ce-57c5-41c0-a22a-cca506e3d753", "value": "T174D3D031E0056CA0DC111AF438BA8E7C0342FEB406DA5143FABED5AE64B7E9578ED760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909244, "uuid": "d3e2273e-7e7c-4d38-98ab-b0a1e9ad5f09", "value": "3072:pLb2wyexsgFcHyYK5Hncp8kzBGdXnEYCSSyZdV:pLbKyFMyxZncHzQ5EYCFYdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909244, "uuid": "f820bbf5-0cc7-4919-a5e9-aec59291ae82", "value": 131668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909244, "uuid": "accdf915-0a0b-4551-8953-b7dde0105333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909244, "uuid": "a528e54e-0cb9-48ad-a866-8f0900c34535", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293e2761-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1774879809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879809, "uuid": "8be13c36-e604-418c-9d83-92eb6addc64c", "comment": "Malware payload (EternalRocks)", "value": "f2c52db12d345f855ee0725ea3120e72", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879809, "uuid": "825844eb-3d5d-4f75-aa3a-44d92dbd1efa", "comment": "Malware payload (EternalRocks)", "value": "b7e3ad81e77be85e826148eb7e299b7f3b918b6a06c548057a459adbbbf6ad71", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879809, "uuid": "52f445e3-3797-4eb1-a2dc-5c0d1875440d", "comment": "Malware payload (EternalRocks)", "value": "79e6f28540250d1c2267a567c0c89443b176aca7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879809, "uuid": "0ffbbf97-10f3-4abb-ae05-e438bb15d919", "comment": "Malware payload (EternalRocks)", "value": "9c3e3ef566f4a263ec07922f69dc66ecb4b4ea7970b965ee389b54647c624ac87567a806af6f9efb080a869122f56928", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879809, "uuid": "12728d67-846b-46fd-b28b-37205aed8dd0", "value": "T173B63310FF5E5D780B1C9638699F2F2E2ED64E82C04C52D64BE7B4C3669FB11247B8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879809, "uuid": "1ac2e66a-b484-4340-8359-138c2bf3fdff", "value": "49152:Y+lFFwE28PK/bM1hQa8iI1bxd+pddSQRazXh+vZOzRqNr6SHPBUGq8DZKZJ0qiA1:8B6qxik2Ahx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879809, "uuid": "46744ef0-442a-4967-857f-a20e9e82e184", "value": 10886766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879809, "uuid": "8ceec72b-0949-4ecf-a56b-816c76221a23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879809, "uuid": "d0c13010-3e4d-42e2-bc8a-3e2da8710fe7", "value": "beta_evaluation_distribute_v4.4.1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226d42d9-2c42-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774879798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879798, "uuid": "2aff06bc-a619-4804-bc26-565447091008", "comment": "Malware payload (AsyncRAT)", "value": "7e2fe58934874e442cfa183a34ceb24c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879798, "uuid": "57766616-2367-4710-b45a-2601830dfa5f", "comment": "Malware payload (AsyncRAT)", "value": "b7fa1e5cefb7f5ad367271f29bde8558566c17da169b5dac797c79beb3fc4531", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879798, "uuid": "b401f284-a3a9-4c9b-b6ae-7881ed02999a", "comment": "Malware payload (AsyncRAT)", "value": "e69e32522835f37f18095e219385057b6bbdc959", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879798, "uuid": "7911d81d-8754-4322-9740-16806563b54f", "comment": "Malware payload (AsyncRAT)", "value": "c98930f7f1ece18c4fb7361ac583761012ee81d6ce13df6decd6452bd1904ab7e9a3641f25b9cc23fb013cc48bae9cf6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879798, "uuid": "bf2f1086-c0fc-42a4-af59-fb9377e98c3d", "value": "T114737D183BE54119E4FFAFB55CF17123C776F2236807C65F68D906861A23B8A8E412F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879798, "uuid": "0aecef09-5288-419d-987a-7e386cf40508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879798, "uuid": "310f3d27-d97f-4217-9605-30ae3c2e52a4", "value": "1536:/sSLo8byJhYfyM3sLcGhF7G8NM6OUbSkgv2WKsbZInO4XjUaLkYK77:zLZbesB4cGF7DrOUbSkgJKsbZgO4XTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879798, "uuid": "e582f8ba-6dff-4f55-a6a2-5771cedb14ad", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879798, "uuid": "a371c76b-d27d-4b6d-9a70-65e47a94efe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879798, "uuid": "cf7af7ae-ac61-4ecf-a134-11ed76ffe3b6", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30799233-2c4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774883687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883687, "uuid": "80a4e8ee-3072-46ea-bda1-9b67c68ed08c", "comment": "Malware payload", "value": "f977a674f89ff06ec6743af5de164d27", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883687, "uuid": "4e746d66-5868-41f4-8698-955cf0c0dc8d", "comment": "Malware payload", "value": "b89bb816db8bea450d07317c1212e49596c360e97eb2d0cbd37defbaf62e0651", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883687, "uuid": "796274dc-e2b3-46ec-b0c4-3e31ecb0a898", "comment": "Malware payload", "value": "6c63deffe0857fb05326b55dfb5d84479eef59c8", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774883687, "uuid": "64e38654-be10-44d9-8cbd-aab5e37f20a1", "comment": "Malware payload", "value": "7f29517c1d448b469701851d503f1999417af424059c7cf80153d014147b4642a98f15a61f4f0392fda84f36b9fb0a5c", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883687, "uuid": "673b0144-4e40-4a8d-b077-9e9fdf6f6749", "value": "T1F7922B0A73E8C516D9EE9BBE78E201614335F11FA923E7CB1CE848FE2E727140640765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883687, "uuid": "624b3754-83fd-46d6-b42e-821a56147b9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883687, "uuid": "2ab27d08-c2cc-4994-ae4d-614d0d1d7da3", "value": "384:mS4ThIM2ShMmhc0n08B4C5YLksqKZOet2pxTO1YXZkC09suo:m1ThIM2XL0nHB4PqE4TO1V96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774883687, "uuid": "22e6f92f-f544-4a99-9a05-301371b8eb55", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774883687, "uuid": "d0b4e6fb-6898-47b9-a86a-4d7862583308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774883687, "uuid": "5cd49d86-487a-4789-94b0-d96dbe55c6c2", "value": "b89bb816db8bea450d07317c1212e49596c360e97eb2d0cbd37defbaf62e0651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa712279-2c12-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774859410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774859410, "uuid": "9b6cd5af-df62-4441-a0a5-738fcba55473", "comment": "Malware payload (PhantomStealer)", "value": "a0b113b791356f20760b5440c9dccc9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774859410, "uuid": "fbdb52a8-8338-40e3-9b7c-d76e15b584ae", "comment": "Malware payload (PhantomStealer)", "value": "b9de8a6dfc4d7d04b31b9ad025430854e0c68e6bbe2e51b7344128d8f4f492f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774859410, "uuid": "fed83870-3d49-486e-af9b-bc834b1c152f", "comment": "Malware payload (PhantomStealer)", "value": "12930a7964f2de384e96e09177ba0d83b577dbd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774859410, "uuid": "8a195156-7917-4908-b89f-f84b51343331", "comment": "Malware payload (PhantomStealer)", "value": "05b2c97ec0e1a42f9d1a1d09405b20a843e3b8cb1420ee63a7110b06a64aeb68c79a49ebafbbdb7ac117eb9e01a23dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774859410, "uuid": "529afb01-5296-4302-8803-91b6d61a653c", "value": "T11A75E00273C19062FFAB92734F5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774859410, "uuid": "d83b7f6f-81be-4575-bba9-889ebc215997", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774859410, "uuid": "67b56f7f-4f54-4959-ad0d-0b9c36c4c0bb", "value": "49152:lPVt/LZeJbInQRa5RCoJ71m1ah4RVqzvlEOCr7:NTYbInQY/J71m24HgT+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774859410, "uuid": "a280605f-353c-4076-9d78-5514eceebfb2", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774859410, "uuid": "0ac942b5-59d1-4016-8bf2-edb8c338385d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774859410, "uuid": "086cf782-0229-4fed-9455-dba94ca57576", "value": "z1FedexShippingDocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdafbf74-2c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853027, "uuid": "375fe87b-8352-4137-84d1-58bba815acc5", "comment": "Malware payload", "value": "0a4e27352dcc99ef0b9c8a4567ae10ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853027, "uuid": "e88ecfee-f67e-4f81-b04b-dc77bb496e71", "comment": "Malware payload", "value": "ba4523a750e08070207256b70cbb3d096b19f711eab47eace3abf7313b377126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853027, "uuid": "48ce1453-dcc6-4d4c-9410-ab70d6342a0e", "comment": "Malware payload", "value": "cba4bd5e47b24f4745b8eea5e1f92a34d6bb1b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853027, "uuid": "a258c25b-5e76-4e7e-8904-dd3a9514be5d", "comment": "Malware payload", "value": "27501681093b7b0fae365aa211048f1d4a8538410072e6f561bb92e8383477aecc155145565c86707d891eaf33a1471e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853027, "uuid": "ad1c759e-57f9-4e75-a313-3322512abfae", "value": "T16B771256E2F900E8D9BBC0B8C6575517EBB1345517309BEB52A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853027, "uuid": "f6019fe9-0840-4a50-a5d1-146b0d089b4a", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853027, "uuid": "0c276426-40b3-487e-99cb-a4a54f6bd76f", "value": "786432:YgQU6irLfSga75B/pOBkXznA+9Z+4B8lkl/Y:QyPSga7nzA+FBtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853027, "uuid": "c1da56de-a4c0-4cc8-b900-2b786007361e", "value": 35490459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853027, "uuid": "62877c73-4ede-4455-a5d7-018f6a062049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853027, "uuid": "f8376941-4bd3-4e7f-be4e-1554231c9cbb", "value": "0a4e27352dcc99ef0b9c8a4567ae10ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef2b38f-2c61-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774893079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774893079, "uuid": "aaf800ac-728f-40c9-93dd-7cbd3ba18e8d", "comment": "Malware payload (GCleaner)", "value": "2399c789ea3a2255559a1c9ff725e5b1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774893079, "uuid": "93e44080-4551-435f-82c5-64c4bf23b7bf", "comment": "Malware payload (GCleaner)", "value": "ba8906f01e04796f2dd32f436dcc03dbe11b0697f5e7b9c64166f2287e868214", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774893079, "uuid": "6370be6f-6adb-47b9-90c5-3691181b1822", "comment": "Malware payload (GCleaner)", "value": "e57d3883cc1c7a790bc140e9d451dd3a959c26d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774893079, "uuid": "ef7f3152-a70c-4755-8802-4b9306da9396", "comment": "Malware payload (GCleaner)", "value": "b4e8b4e1c74788a31fe1b775a5afb7ce6ad654610fef6eb75c60d1a7f49c36168dae0d94ef7c087978ee2f79b1735efa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774893079, "uuid": "29aec585-dc35-4c71-90bf-290e5fdb659a", "value": "T139F49F21B3A1843FD123FA7C8D1BD26D68267D0069E7B4456AD41FCF6B39272372A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774893079, "uuid": "94aed463-83d2-4dd7-a9cb-665a10c60231", "value": "61f479de9d92a0f2ae61f513ec2db394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774893079, "uuid": "5a5671fd-e21c-46a2-b029-aab45602578a", "value": "12288:UYdx15WnFdqTFS+3NuSXG1KAydNiskfTVbNW7zG6ytTke4Y8JOh:Vf6GTp9ZASNerVbNW7qbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774893079, "uuid": "8f9c0638-a25f-48d7-843c-8e579a245040", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774893079, "uuid": "f184d76d-d679-4aa0-92c7-d29adb1193da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774893079, "uuid": "d4aad34e-a6ed-49bf-98ca-ce8a2b954d3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6ef2e-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774853918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853918, "uuid": "b25396aa-8ccb-4a6f-bb4e-b7f87295e071", "comment": "Malware payload", "value": "8676c65e69b6a98066f2b7ee8e13eb31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853918, "uuid": "5f03af20-e5f9-431f-a295-ac57d19b83b2", "comment": "Malware payload", "value": "bbd2357d982469924c8ac428fee8f1e85f8fa47a2123ed20758b68d11a334d65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853918, "uuid": "105fe9fc-29de-405e-9cce-7c7493e589aa", "comment": "Malware payload", "value": "5e31c51c2be6f39b2b4ef61754f630252643accb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853918, "uuid": "bb6e5417-dc06-4fbd-a01c-a966d573f37f", "comment": "Malware payload", "value": "5f8d97aea135d39d0947207a7b17022ef30077be5e57b4a372d01d1abd8fd9066890834529b8d85b7165d0fda0fa14f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853918, "uuid": "73a19426-ca94-43d8-85df-6ff3d2c6852c", "value": "T14511B4A5B7207A35764F882D777AE9A48B435D2B082D3B87F48DDD245B5C499B240B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853918, "uuid": "c468f6c3-7fe5-4ae9-81f0-74cb221f5e6d", "value": "24:oAuCSLsquiVDNn1eyuCKIquJZp5HpuCSAzcYpuCSAemr:oAu/LnuiVDNFunIdJZpppu/AzJpu/Aea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853918, "uuid": "4a7aaa3e-8f95-4f39-8d09-4dd577e6c1bc", "value": 959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853918, "uuid": "00f79ae1-62f8-4db9-8522-314153506d11", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853918, "uuid": "06fd66ca-a231-4fd1-a3e1-bbc2eb7ccdfa", "value": "bot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070ab2c7-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853982, "uuid": "d0bac700-4618-407a-af11-9bb9edb754b2", "comment": "Malware payload (Mirai)", "value": "70271f03ba3fb8cc6851799402e89fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853982, "uuid": "d3ac8227-978a-4d02-9f33-0e4e981e0af6", "comment": "Malware payload (Mirai)", "value": "bbe444d221c1da5e245be3372bd50494271144c869e4581ef9655a9ca3f56e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853982, "uuid": "ed111755-3fd7-4cae-a69e-f589e2c48503", "comment": "Malware payload (Mirai)", "value": "6736517f9cd4be0e5ebc495ee8a2808e67fd83f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853982, "uuid": "97fb1645-0542-4535-940f-86b7f60bbe16", "comment": "Malware payload (Mirai)", "value": "46dddab7fa9cf4ec19ed8e24df5c6204a2f94e6566748bb20e17d612b013a9f3ff5f3c88518aada78fa4ec338af31432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853982, "uuid": "64e63598-d89e-4aeb-8ad6-2a581d95fe0e", "value": "T15A831B82BCD2951AC6D4277EA62E719D3361A3E0C2CB3513DCA74B15378729B0F27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853982, "uuid": "cf970a5c-0fc6-478b-badd-b2ddef7b2bd0", "value": "1536:K4MlK1EKuGZDErmKuehgWr/iFZkcP92RolA8D/DO27jrYp:K4MlK+KuGKrGWbiFV21ar7jkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853982, "uuid": "a2562d26-eb3d-43a1-9924-0ec451f8df6a", "value": 84440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853982, "uuid": "c791fd60-12d1-4969-9464-be6db008bd0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853982, "uuid": "b3e2405b-122c-40ea-acf4-f795e922b959", "value": "kurayami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95853e84-2c50-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774886004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886004, "uuid": "114c5e0c-ccd1-4c7f-a8e1-bbbc203a61e5", "comment": "Malware payload (Vidar)", "value": "339b3399a97295253de696b1b364f6f5", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886004, "uuid": "98f25529-0eef-45a1-86dd-1b4ef20fb082", "comment": "Malware payload (Vidar)", "value": "bbeac5cab525a496b411f42c7ef95bd5f33241c7f5a22f65b6bad71e96bf5a30", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886004, "uuid": "9a8f6255-b5c6-4a6e-bbfe-6cdeec3f5913", "comment": "Malware payload (Vidar)", "value": "c282d353be089a1f8a80f80072fcc3ab13359aaa", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774886004, "uuid": "2f9768d6-ba3d-4cec-8d2a-eb8f3bdec586", "comment": "Malware payload (Vidar)", "value": "a9df13729485cb20cb53d1275779818e43755f97564333c775f8df72582791a1d7e15266b5da44b7ab6ac566b21959f9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886004, "uuid": "65458715-3f06-4fad-a24c-41a1734fa565", "value": "T15205121BB3B130F5E177937AC4611602F77278614765A6DF1AA483322F233919F3AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886004, "uuid": "f4db57f2-eca9-419e-8b76-7bfba614bb4d", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886004, "uuid": "340e2f8d-f7f5-44b6-8e7a-fe82cb2750e8", "value": "12288:+YeJU5C+i6fz9Np03/EEMCu03caaCOpt3mqMvaAk9HWzKVZuOGTdoBjfO:/eJH6fzSPEOu1/3aaAk9UKCPKLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774886004, "uuid": "8e9097ab-8f48-45c2-9d01-7172da41267f", "value": 815822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774886004, "uuid": "d6f407dc-ac48-4dd6-95bf-cd019db6fe29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774886004, "uuid": "f792bbbe-c0fc-4adb-893e-e3002af106a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ad122f-2c8f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774912843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912843, "uuid": "ee2a2ec1-1f4f-4377-9c1b-57db75f5c7c8", "comment": "Malware payload (njrat)", "value": "b6cd4e4db2bad7fefd0513360d022a26", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912843, "uuid": "b1db8d91-81e1-4885-a47f-29587f26b7e1", "comment": "Malware payload (njrat)", "value": "bd23dea9295ebf3783b8c958723800308f6a77c3e059319af0b9ce0b2f67cb2a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912843, "uuid": "37fa8f20-565f-47a0-9a06-4ba3393728b5", "comment": "Malware payload (njrat)", "value": "73544765195bf3afd2df451ac9ef984a624fa458", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912843, "uuid": "b3e29e49-b866-4575-909c-b4897b2ea840", "comment": "Malware payload (njrat)", "value": "ddeb3cd9aa36610d3092f59888e6ae03ca0cfb3a57ee0d151733d797ee93cf899a38d7c33e94607863b75c942457318e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912843, "uuid": "07090def-07c8-49b0-b222-faf96a29cfbc", "value": "T16745334A1510C260E90B0F30828AD2EBBD3E6E57765A868161DEB7D41DB3B4187EF1F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912843, "uuid": "a210bc5d-b22b-43cb-b7a2-d0ca04334570", "value": "24576:eYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnkvyp:NQSadD+RwsLdaCPNj96gGKbBm1mnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912843, "uuid": "cbe1dc70-a24c-4899-b4e5-ee7587eb33e0", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912843, "uuid": "354342fd-116e-4c86-b063-16d173540beb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912843, "uuid": "84bcd72b-c94f-44f5-b2b6-53beeda845cb", "value": "Setup_MT_V14.6865.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ca1508-2c2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774870172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870172, "uuid": "d873f84d-ca65-4a02-a602-7c1b1d969278", "comment": "Malware payload (Formbook)", "value": "650237b77d6595849eed9e2fb570eb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870172, "uuid": "9fda9d04-cb79-41be-8e6c-253d1cbd39fc", "comment": "Malware payload (Formbook)", "value": "bd73efeddb6769a8b1f068a6f4361f042e838aaaa55cae27bb2f1be4d0f3237d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870172, "uuid": "3c0b3fd4-a142-4cb4-86fd-08de4f6ed05a", "comment": "Malware payload (Formbook)", "value": "637f75b1fa2616b684b7b135eeaecb7501fab999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870172, "uuid": "c3ccd607-5742-426b-95f5-041549cc22a0", "comment": "Malware payload (Formbook)", "value": "7b17198b94b07a02c9aba68c888ad1e7665423277920a86fa8eba971856392cb499274e010f9b77fe0bd16815f1f0ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870172, "uuid": "4ebc7c7b-1f60-41d3-b8b0-a744de80a9c6", "value": "T13A54220760C3005AFB856AF60BE167AFB668D4F30AB6E8DA36553C4749572D9A300F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870172, "uuid": "3226c67b-2289-4803-a88e-f89dc7c3e56a", "value": "6144:T8mR78Gtymrprh9VCbYmDEr0o7cJn66fVlq:TdnhzPm8HcJn6+lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870172, "uuid": "2c904ef3-6e5f-4527-aa68-ee84495da641", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870172, "uuid": "14528270-d35a-4859-9079-82b0c7ebcbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870172, "uuid": "c0b18e16-1ba7-4995-b85f-28abdbb51c28", "value": "bd73efeddb6769a8b1f068a6f4361f042e838aaaa55cae27bb2f1be4d0f3237d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766380b3-2beb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774842572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842572, "uuid": "2f335bc2-ff7d-4dca-a545-63c56e5fdc3c", "comment": "Malware payload (Mirai)", "value": "caab4e806547cebb2977c3ee16f4ed32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842572, "uuid": "e70c5e5e-e23c-425f-b3f1-a28781a09618", "comment": "Malware payload (Mirai)", "value": "be90278372d69bb7e268bba1f8b9b1d1bb596666262d408ef07f995b7f40d75f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842572, "uuid": "aaa83e1a-7ac5-45df-9d88-a00a69cb67d7", "comment": "Malware payload (Mirai)", "value": "c567a6333b050c0cc6961824ec81aee89ceb0695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774842572, "uuid": "a6305210-b594-4fea-bf52-2b6b816ba073", "comment": "Malware payload (Mirai)", "value": "64b2a75ea2315aef9e1e2256d35391ed98eedf00a25659af03643bce0e15a04975d27b2ebbe46570145d504f087aa70a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842572, "uuid": "83688634-e252-4b34-8312-ceffc0e477f3", "value": "T14E167C0373F5457AEAC05A358BFA43533286E6A464D54B228F50CE6FAF22B5328714FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842572, "uuid": "bf231d0e-5deb-4d4d-991e-d0b84ade7ce1", "value": "49152:qXjmYkRIyqTxYSFnJqlsXH79gU6yaoqAPGpy5K:qXjmYkRbwBFasXb9gU69oqLp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774842572, "uuid": "89ef0ca0-e16b-4d50-98e4-06b323c75216", "value": 4336716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774842572, "uuid": "6088a952-87df-4ec9-9fc1-23b7f88f762d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774842572, "uuid": "9bfe7a19-d760-428f-b9b2-9d5c48553cfc", "value": "wlan.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31695ccf-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774861355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861355, "uuid": "ce5972df-3f4b-44c3-80ef-b831c6638bdf", "comment": "Malware payload (GuLoader)", "value": "bebb06ffafb5d0c8bd10ffeb9d0e549e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861355, "uuid": "1909f550-0993-4898-aefb-7f905f69d634", "comment": "Malware payload (GuLoader)", "value": "bfedb58118e4047001ba71faf95380b61c1ea08f9664dbc208a83b24e4d4aff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861355, "uuid": "f62221bc-7c7a-4c32-9ea1-87b931191787", "comment": "Malware payload (GuLoader)", "value": "4b1d1352746393d488d1360748897c03a4e6f43e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861355, "uuid": "24316cef-16a8-4bfc-915f-83ecfd377a44", "comment": "Malware payload (GuLoader)", "value": "7de1d1ef6c0b2d441021ead48ce7b89d097c9d04d07fa05f2015fcbbedad2762feb03955c28e3e9a1ce3a78a68522053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861355, "uuid": "ab35a65e-0589-434e-af69-53787a450ea7", "value": "T1849412527752D007CEB00A30E4E47FBF6AB2BD651926CD431BE47D55BE282E1CE1E282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861355, "uuid": "266e6b68-7d53-46ea-a331-b80ea36b498e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861355, "uuid": "30a5ad5c-e2ad-4f87-8343-11b036ba442b", "value": "6144:jpkXGhw33odnV2estpLo/rvjO2LlpDRJ+ldJIx66TGwmkRS1LE9z2YcVSCdZUwlE:+X33o9VnjRFJ2J+RKyRSOzUqEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861355, "uuid": "26224b72-946b-4b4d-a43a-4c1a528daf36", "value": 422168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861355, "uuid": "7be3440b-d5c2-4e6b-9531-dce752d9891a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861355, "uuid": "c5d68619-f47d-434d-89ba-82931088443e", "value": "Fastelavnsrisets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702469fc-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830536, "uuid": "918fe209-e90d-4105-8536-06e38c58e404", "comment": "Malware payload (Mirai)", "value": "6f7d48b33d0b93cee016f550b7228c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830536, "uuid": "0cea5dd3-1ae3-46da-b9b8-e4a44a95c633", "comment": "Malware payload (Mirai)", "value": "c1f1b6c1164278bc9c5feb1f5d7391efaec91b59e7bce4cb70ae2ef274e8ed0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830536, "uuid": "83425b5a-8420-413f-9ae2-0285708361dd", "comment": "Malware payload (Mirai)", "value": "325f2144791d2bc05fce6ea558c43d97737e5841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830536, "uuid": "22e88e3b-96c2-460f-b27b-db0fa656bffb", "comment": "Malware payload (Mirai)", "value": "9b4444b147f4239881f9c11200e3835d6b75242577da3c6918742d6a775bde919a33c4978f59401eff389da7b36763e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830536, "uuid": "36ce7ea9-bd09-415e-9c22-74117ed36588", "value": "T111935B22B539193BC4E4947722F35326F1F6438A14A88B2E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830536, "uuid": "4184c431-a1f5-4150-a962-ffb9ebc71a4f", "value": "1536:DCTLZ0J9dF+/EqR9oSccUvytX5Ym5ngP5gYtG9J:2yi+ZFaB5YOgA9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830536, "uuid": "a7ccc3bb-b1a8-4087-a435-6ab335c0b523", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830536, "uuid": "8b78d9af-e7fb-4c77-b3af-108103a206a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830536, "uuid": "57a79559-0a2e-4583-9622-d8cde4c25ca9", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0109ac3b-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853972, "uuid": "3f2ec0f3-073e-46ef-965c-4b6460017014", "comment": "Malware payload (Mirai)", "value": "fa8ebfdef2a50b7896cad9f682838b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853972, "uuid": "6578fd5b-20df-4f34-8190-0da0d832aa7f", "comment": "Malware payload (Mirai)", "value": "c23e75a6f0aae9f632968133971fee55d14fc9d2b544ad60c280e91b9309f2c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853972, "uuid": "55340e2a-5654-4055-923a-0740f1b0afc3", "comment": "Malware payload (Mirai)", "value": "ca87c2e21bddef410c85f4dd80bba6fef302604c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853972, "uuid": "7f980902-4bab-4c22-9ad3-064c74e81bad", "comment": "Malware payload (Mirai)", "value": "fd1a02238eb288d975a2a6fc65fd23479d4d0a777443b39cf7966656b8322d5d821335dc86bada9cb0a5b3ff78cb8187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853972, "uuid": "8b67a804-ff36-4119-8609-2cee2c856c5d", "value": "T1B534C70E6F228F7DF7A987344BB79A20975D23D627E1D584D1ACC2105F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853972, "uuid": "99ce6543-cfd8-4262-bc23-b7bb577d4358", "value": "6144:FnhtuaDnTiWF45B22j40Qg1KVCiF/zmYADJk6l2b2Y/tFTDiczFtorIE2klxzbAF:spQXgnqoWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853972, "uuid": "79418ed3-b183-463c-bbab-7e83a64cf041", "value": 238492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853972, "uuid": "8073ae51-af47-4e06-ba11-9ffe2c607c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853972, "uuid": "9af3fc1f-d8cd-44ad-ba2e-79106a85ac10", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166f0ac3-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912419, "uuid": "ea878c35-cd41-448e-bdca-f6ee9fc14380", "comment": "Malware payload (Mirai)", "value": "cbc2cb622969bf5a48fd84fd8372df23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912419, "uuid": "c7fcc478-536a-4f9f-b79b-d53855cb7eb2", "comment": "Malware payload (Mirai)", "value": "c2acf0de72dfd618430422265f411c51618fbeb721cf8460c4cf34e1e3b70077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912419, "uuid": "f617a39e-406b-4379-b6f8-f87e9e8f055f", "comment": "Malware payload (Mirai)", "value": "c501aa21164aa8bd9a83b0202b7f07382b458b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912419, "uuid": "1679e59c-9197-45e4-a2bb-1f055cdaa76d", "comment": "Malware payload (Mirai)", "value": "289e63f6ef91406a9ad895ec22fc9d8532903b3c2b9c34ec484cf3b893d408fd55bb01d6104fe7c90fd4293845e25370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912419, "uuid": "8e8b0353-eee1-413c-a227-fe24584955ff", "value": "T12143F89AF9C28B15C5D412BFFE0E118D3313676CE3DE72139D205B246BCA56B0A7B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912419, "uuid": "58f5ea51-b00b-4b31-8265-bfe1628766a4", "value": "1536:TUnzbXpccgjH/w83UQkDkzwIuiMtnlK1nL:eXOcOf9utnlK1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912419, "uuid": "c616d6d3-b5cd-4b18-b57c-6765f4c79d96", "value": 58744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912419, "uuid": "9e5d7a8d-f583-4292-8c7d-b243c71bb8f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912419, "uuid": "6817b438-f6a2-4c77-951a-a54da4387b3d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053e5701-2c27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868152, "uuid": "43feeda9-54cb-4165-ad85-f50d5812a6d0", "comment": "Malware payload", "value": "175706c685650ee166e2f67510ba4c8e", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868152, "uuid": "9690cc20-a046-4941-8473-b097769cadb5", "comment": "Malware payload", "value": "c50e81a377e8fac1e4e3dcce634868443c60c83dd20a98dc320317603023b17a", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868152, "uuid": "9c8ac426-2e6d-4b85-af09-1e52a12f9c91", "comment": "Malware payload", "value": "6157a2a4aed8bc20cf9bce35f22190f78a8bba61", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868152, "uuid": "40a789ef-765f-4383-8f67-923ac7205300", "comment": "Malware payload", "value": "85bb985ba0a47e95db1594049b8f00e207bdf06ae926c6850ceda99f1c2c4ff62fa411e96c978d9635e1bb1fd356c229", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868152, "uuid": "1d245560-5184-4f80-94d6-0306888c300c", "value": "T1D8F423E469CA1BFDED8C70FE8BA74CD6D653B9FA1E49408138300655CDBA8347AB1709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868152, "uuid": "c84e118a-5399-40cf-84dc-5dab65b4b6d0", "value": "bec9eeadd4e78e2b82a4cb142bb3fe2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868152, "uuid": "7f410ac9-cef5-4453-9fda-d40182bf1360", "value": "24576:ri1ivTLG7iZW7vu/P5ObG+o3XDG/s3urrBF:bvTLm2GWna/97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868152, "uuid": "8fd2e484-2035-44c7-a56f-bf9700513cca", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868152, "uuid": "0f3f5b1f-7ba8-40f3-b0f9-7e9d0892ce2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868152, "uuid": "30565c09-f031-48ce-92b8-29d1637c29cb", "value": "RuntimeHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c2b664-2c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774875904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774875904, "uuid": "f988c081-53ce-4a43-9ade-0a92269c9e3f", "comment": "Malware payload", "value": "590f12f548b26834ab6596c669d9406a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774875904, "uuid": "ef1a9e78-a4d1-45c3-94d4-d862c2a8764b", "comment": "Malware payload", "value": "c6604c47349a12a752c9ce9aa32b14dc3ccca24c4f63882b82c53b027b699f26", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774875904, "uuid": "f3d503d0-1736-437a-897e-f87f0ee4efa4", "comment": "Malware payload", "value": "85c4f76d63015e2cef414cb5505748f72b510b68", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774875904, "uuid": "b6364639-ba4f-41ce-b285-6d1aa68dc5f9", "comment": "Malware payload", "value": "8f102f7bc14ad1a6c3ea42e20dd7d8d59977595c31ed046b9f58abc48ca6fa18b84cec24973066cdfcb1764169fb2bdc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774875904, "uuid": "f73a9ba7-3b32-4c94-a92e-705fb0d32957", "value": "T194F002A7F63706E2F671B370C63218E4D0013E6550735416898194150CF51986DC2D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774875904, "uuid": "99ca6f0d-98b5-4dc0-bae7-e788d6a0387a", "value": "12:5jgbdk3R5p5WCINyxLVY2cPPob/u+KtJ8Z0pNra4ZTgasu4XIUbdkPR5p5WCPaQk:9gZk3R5TjPxRFc3obmntIgsas34UZkPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774875904, "uuid": "c3f3aa69-7f86-41d9-8b1c-58c9b315a535", "value": 620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774875904, "uuid": "68f6c273-f8e5-431a-9e05-b72c224cbbf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774875904, "uuid": "53c2ebb7-a235-42b1-a75a-1d9ebbc90b70", "value": "faktyra-114073.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1409e0c6-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912415, "uuid": "1e549340-ebdd-474a-aac7-605aa5f041d2", "comment": "Malware payload (Mirai)", "value": "314906c525d8185f40a495bb380cba64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912415, "uuid": "999d4127-ab88-44c4-97da-1f024d292f72", "comment": "Malware payload (Mirai)", "value": "c74e8151940f4afed1ac9503af18f0d93d7ea95f41de82e14f948570c5c79947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912415, "uuid": "8843c24a-b866-44f1-983a-6f70d205676d", "comment": "Malware payload (Mirai)", "value": "8db12bb266b82faf31cb92cda3e763fa561ad26b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912415, "uuid": "defc4185-9cf6-484f-91d6-665cf7161263", "comment": "Malware payload (Mirai)", "value": "056529346d59954f517bc72a656c7888ef7f7518bf085c68a3df12a6338a11e56dae5e71a53044e508c86805569da084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912415, "uuid": "123aeda3-9e92-4a57-bc99-bed26165650c", "value": "T1C1131742B3180547D1A36EB0353F07D1E7ABAE8122E4F288760F9B4DC171E779546E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912415, "uuid": "1c757998-1689-4eda-a09c-0c7df36c9993", "value": "768:TKZQBal6xzFogyxBv7M2ccDP1UqIVzFPX4hp/PanpyvsM7fV+GFWcv:TAUFogW57M23DyqaPIhUnYx7fV+WWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912415, "uuid": "0727efa0-3410-4718-bbf5-71213d209ce7", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912415, "uuid": "7b192447-4487-4e19-a86c-a38af104013a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912415, "uuid": "b40d21fd-57c7-42d8-ae1e-aa6743052f9a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f6938f-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867930, "uuid": "a283d54d-b460-4ec1-9d20-be943c93fd33", "comment": "Malware payload", "value": "2baae7bbb987ccc065f09dfe014bc720", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867930, "uuid": "8a4bc47e-b728-4458-8ed0-68db88beccbc", "comment": "Malware payload", "value": "c75e18c53ce8a1613cccc63209ca34d4a0ba1c6a1b664bede595be3cd7bb30c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867930, "uuid": "7d73009d-6736-4f46-8e1a-d8f832b27460", "comment": "Malware payload", "value": "c8292d8865c24fba3b91d246c0083c8dfb290cdd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867930, "uuid": "c8a34fba-2aec-4067-b2fa-8021d2e54420", "comment": "Malware payload", "value": "37d3e326fabde9613cc9d653e55d96135653af442f4aadc5da75153287b2c9313565a22df8e52b6c7143e25f5b34c35f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867930, "uuid": "f506b60f-1510-45a1-8924-de9c58f07c4e", "value": "T1D0B59D06BCD408F9C06AA3328AB756A27770FCA90B3233D72E50B5782F766E55D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867930, "uuid": "6d905ff8-fd19-45d1-8ee1-f768a8754161", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867930, "uuid": "5ec3dd5d-363c-4e8b-accf-cd19b4961fc1", "value": "24576:LeTwiLycdUXZJaq9IpHa0rwlUZ/gwUpnZZqvwaaavQoJsJdWpeavAM9WrtP3mydr:LeTPLy6UXfaqd000/iZZqYrqtQdxsWH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867930, "uuid": "3dbffde1-f06b-435b-ac00-5b7d67611eb7", "value": 2355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867930, "uuid": "33f5cc06-3a0b-4a4d-8cec-81743db38013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867930, "uuid": "4a044ed7-69cb-425a-a8f9-b15d72851785", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e57b536-2c17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774861403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861403, "uuid": "528b94ad-a3e9-4ded-ba24-1d3646aeb220", "comment": "Malware payload", "value": "0e700d2e3656a7b43803d0e2bbb097f6", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861403, "uuid": "e4e357e6-c21c-43f9-933f-34bb75852aa1", "comment": "Malware payload", "value": "c8ad064a42c35e8d271f67dab37d5131f1ff31e673846c50644b10080f76c9fb", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861403, "uuid": "b48032a6-15c3-4de9-bb0f-f84f82779758", "comment": "Malware payload", "value": "5ee0a0e033a636e39c029a6be649ad923577fe7b", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861403, "uuid": "0778afca-0a0b-4a43-96ee-345680f300f1", "comment": "Malware payload", "value": "855972ffe6f997500efde676deb09f71734fb7dc6671287976a5b741855888e39a5208549c3e7ae01ee0f70b0ebc052d", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861403, "uuid": "401f7bb4-ff39-4443-a8e2-30ea4ea5b6d1", "value": "T1E225BF51FFC188F2E692C13051EEAB375E3CA5288725DEC3E3C45A6999201D1673E39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861403, "uuid": "7b552530-6330-470e-b198-45439756cbdb", "value": "57d8142a55119bedcf042524e4de8b36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861403, "uuid": "f10819d6-eabd-44fe-a785-9f032eb1d4e8", "value": "24576:ogxuUvFVXw5DOHQCoby8aV9GG6oQAbfwKmypYpzWkCDV:ogxdFVA5Djw8+Zw6czN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861403, "uuid": "ae07788d-8eb9-483c-b576-41208507df28", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861403, "uuid": "a58d5a2b-7f9d-4487-933c-ce5b732d7649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861403, "uuid": "f5f827fe-1458-45ed-b302-4b7a5338f496", "value": "mozilla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d9d29e-2c03-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1774852980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852980, "uuid": "e4665af1-c24a-4bc1-a2de-e984bd41132e", "comment": "Malware payload (PureHVNC)", "value": "0b5c3cd6bf4d49aa576efc786b65baad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852980, "uuid": "9864d809-c3c6-4b34-a487-437e6fb1c40d", "comment": "Malware payload (PureHVNC)", "value": "c90957ae325f7ecd6d23004503133a029fe0691e0542afb2a2b335c4841622ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852980, "uuid": "713ebc61-0d98-4d17-9fb1-dfacabcc8dc2", "comment": "Malware payload (PureHVNC)", "value": "e8964a5e9c244def6d89601827ecdc93518bbfcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774852980, "uuid": "9af8e7c3-bdc9-4f00-bf51-7d16298130bc", "comment": "Malware payload (PureHVNC)", "value": "e342474cc12fc043429e0b31648f11c43cdff9dfe8811c9ea043cb5c4b6a8b3ea49dd8d070b89efa00f9075c50c45e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852980, "uuid": "9e7ead0a-0325-45a5-beee-cf11cfa8e6b6", "value": "T16FD49D7732425E21D2A84333D1CB4A4193AC978776ABF70E7981339618063EFDE5B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852980, "uuid": "7c0dfeb9-f87f-407e-994e-9556f93331a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852980, "uuid": "eda05c18-0928-45bc-8fb0-628d18db79b3", "value": "12288:YauWebFIi2ti6hsmIVbPXEQChrqK7MjKRbAd9S:WWe62V7FChB0MbcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774852980, "uuid": "ba4fb2e4-96c7-4071-b377-86db3c23368c", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774852980, "uuid": "eace909b-9c15-461c-9495-7ccf1892ada7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774852980, "uuid": "425fb39e-ef08-41f3-9f86-af4b3de7d0a3", "value": "0b5c3cd6bf4d49aa576efc786b65baad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01d1900-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909295, "uuid": "23668b50-f82a-4ee5-b548-b64446d65e84", "comment": "Malware payload (Mirai)", "value": "296cbaa15ea7d1a565b99dab00a3ac15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909295, "uuid": "6889c989-0668-407e-9ff1-951de22c2104", "comment": "Malware payload (Mirai)", "value": "cb7e0a54d9804ad55bf972de0e2dbdf1cacc3575b48726ee5b31073ca018447e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909295, "uuid": "755487ec-9f55-4fec-a118-482d1a6a562d", "comment": "Malware payload (Mirai)", "value": "425ff211e651449e1503aa7b9b8ecbb8438b5fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909295, "uuid": "0de7daf2-b3f9-4a28-bda4-e9cd713614bf", "comment": "Malware payload (Mirai)", "value": "c57f19195d80baf80d3bc5053a06ec413f221dd7ede1921537eb353bd2b7d8add15842043b47f1c78d82eeb15880aaf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909295, "uuid": "15913006-1022-4221-8686-ebdb7dd8df46", "value": "T138C37B42E6A2E0F0E69701B11557E3E68931E6355016CDC6FFA83DB0EC70781AD9BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909295, "uuid": "5d96c67d-fffa-4a7c-b3ad-b6496c88a9a3", "value": "3072:Ypgp+RKrH1wnC/iVrVN9poVoRST/bpcrIAJPQGOt:YGcYrH1wnmiVrA9cr3PQnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909295, "uuid": "bcded3e2-1ac5-4106-b270-f15a99583f7e", "value": 127600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909295, "uuid": "ae69c0ac-c12a-43af-bb98-7cc2547f3ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909295, "uuid": "7a2ed2e2-ffe1-40ba-8870-dedbd0c2d9f0", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bcc572-2c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1774876023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876023, "uuid": "9de9c297-eeb4-4634-9aec-af6a887bf2da", "comment": "Malware payload (Socks5Systemz)", "value": "0ee83b39020c5e53aed456473f77f50f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876023, "uuid": "ab13384a-4e40-4569-aee5-c8e849875e43", "comment": "Malware payload (Socks5Systemz)", "value": "cbc0acf15888581c45998c59c1ab23f0994a0e0af1b85f60db9e2de2b0d86297", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876023, "uuid": "3ff100cb-8863-4a9e-bfa2-939d9c8e839b", "comment": "Malware payload (Socks5Systemz)", "value": "fac680a74e4987b68674ab59d736b57199edae5b", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876023, "uuid": "35411d42-fae5-42c1-abd0-1820ecd31a10", "comment": "Malware payload (Socks5Systemz)", "value": "5abe93395b0b51053a44a3c7954655c6a5f5514ca1fa675f1191719416b8fe782462ce8ecaafa16e572631437e98343c", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876023, "uuid": "8c220152-cb8e-4ddc-8985-b5fad6f923fa", "value": "T1AF063372B8B171B4E173EFF88512C984B31F7856356C7528AF4D618ACEA9DC1E02538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876023, "uuid": "90dfdc92-e6f6-4d04-b1a9-44c86d81ef0f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876023, "uuid": "503ce4a6-13ac-4d90-84c2-1198a9e7564a", "value": "49152:1vZpcqe4W7gz7bMuEXEWFdL4d8NWNySPuR4cjsmC8UnbCYf2y4pwZAnL1RdeiTM3:NcqPMuErrlQFJc4r8UV2y44ALW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774876023, "uuid": "736af59a-5c12-43a5-87c4-a15d0b0fece6", "value": 3840869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774876023, "uuid": "cd1fae9d-aa8e-491e-b467-cdbb9a5c0f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876023, "uuid": "7a748c77-c892-451a-a4aa-ed4dfb6d9aa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93acae0c-2c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774870968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870968, "uuid": "cfd5d040-f3c2-4eca-9a24-6d103379059b", "comment": "Malware payload", "value": "5870a0bf82bbdf2687d8dce89dfa668f", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870968, "uuid": "1e07da33-a100-4f19-bedc-38f94a00a775", "comment": "Malware payload", "value": "cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870968, "uuid": "a39c28ad-6bbe-4acb-8300-ccf46bc43548", "comment": "Malware payload", "value": "4ce6ad55d8912aacc4ae4c572237131d0b7ba4b5", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870968, "uuid": "cea0da15-c66a-400d-91b8-985f9df854f5", "comment": "Malware payload", "value": "f3619a836a65d030e37b808ee3d95d48f53f1cf2eb5a6b4559b793b211aed080b6767ce5bec53b6f1f754aed1e4047d4", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870968, "uuid": "a7be7943-6b0a-4eea-bd7a-6c55062b88f6", "value": "T1E4B5AE219A8C9182CA7BA777DDE1BD0655188109F63EFC1A364400353B73BE89FE53DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870968, "uuid": "898bce27-ef06-403a-ad15-0a40b8a6765c", "value": "24576:raIs7IIJ0BemXNXI9fXxovWLZg21bRecJykl3dpblLn7STR7mhiY6Dp90u2xG/mV:l+IIJ0rI9/evW5D5Ct6bYsu4J2VMSeEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870968, "uuid": "b592a9ef-f40d-4ac0-b3a8-7fa555d38c4c", "value": 2316357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870968, "uuid": "2b0e555b-0b1d-497e-bab3-3f7f02ab113f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870968, "uuid": "af0e7f4a-df10-4ee1-b911-f64d12ece886", "value": "telnyx-4.87.2-py3-none-any.whl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d523a25a-2bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774846167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774846167, "uuid": "a627c1b2-e2fa-47e1-85fa-31c4c1b2fc3c", "comment": "Malware payload (Mirai)", "value": "ef05a8ac8b1848bc7824bfe3db7c6222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774846167, "uuid": "5be5217c-2975-4cbd-a767-5fb14a2f7b89", "comment": "Malware payload (Mirai)", "value": "cd08f3eb5fffff86b21717d458e75b7005331d03849fafe597ced750e3e41b55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774846167, "uuid": "ed66d47d-168d-4015-8e72-ebb352074863", "comment": "Malware payload (Mirai)", "value": "665e7ad1d39012b2c14265da5d344efcada000b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774846167, "uuid": "e74d10af-6037-4399-84e0-e8f04a6e285c", "comment": "Malware payload (Mirai)", "value": "b24f26e724ebcd74f6bfc6f6ce1bc554353c04d600aba14b51781c79ec1ac3c6049729ae7b990afd64f5e65b1889c89a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774846167, "uuid": "de6dc157-1615-47b0-95db-b333f0205efd", "value": "T14E465C1AB6B314ADC15AC430836FDA236D35B85542317D7F2684AE342EB6E705B2EF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774846167, "uuid": "78182676-f678-4456-8a4a-740d9efdcde5", "value": "98304:TIHR0c9dpFdAHb3sxjEV085mLEM+Sx9Wic8Pn6tH3zwyWbVq:8yLMFWic1zkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774846167, "uuid": "316442f1-f6a2-48b5-9cc9-d60103e9b1be", "value": 5669928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774846167, "uuid": "708ba1c1-9ae1-4a86-9129-53237b10de67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774846167, "uuid": "b6f7525b-9e23-43d2-a945-677d6ae28dd8", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7779450-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867995, "uuid": "011a3b2b-9e67-4285-a877-c421249355f9", "comment": "Malware payload", "value": "d924aacd82a549986d9cdf38bdbc20d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867995, "uuid": "c01404aa-9c45-4b1c-b767-6ff741c808e1", "comment": "Malware payload", "value": "cd8df31a2f6ffc80ceb8152c0c0f687b0f0d3e896163163a50cc03808b712efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867995, "uuid": "00323d6d-1bb0-469a-87aa-01c9a28bf3f1", "comment": "Malware payload", "value": "3e5d346e6074f69688da75f45a85a5b4b650d15d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867995, "uuid": "f03bbb73-9c3c-45b4-aece-2f12828f590d", "comment": "Malware payload", "value": "4a8b5211687c59280d9e1c9c464d798cc2fd16254ff31f99ca64514423f54f860740e1e358b90cca004408567ad56b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867995, "uuid": "0e193762-e3d0-4e7d-bca8-63ba5c006a73", "value": "T1A225CF11FEC288F2E5E251B011EADB374D3DA6148726CDDBE3C4196999202D1A73E3DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867995, "uuid": "b95a8945-1ab6-4ed5-83f6-f34de5eaf455", "value": "5623b44e972ab79ee556455533e5ca19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867995, "uuid": "02818d0b-98c6-4773-a13f-cde454b1846c", "value": "24576:mSnsY00w59L17FmAXXJynVtNcZyw0exIvAqOoWX70pyUZ:mSnN1wfB7jQV1wcO5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867995, "uuid": "46d561f4-8dc5-4b8b-a0e5-8d31f2123926", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867995, "uuid": "a58d53ec-2e36-4e60-8da3-be33b9551c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867995, "uuid": "1aa4d930-7233-4c6f-a383-8745e6dfa9fd", "value": "mozilla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bbdef2-2c21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774865846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "43ae718d-ec22-4dc4-b711-9a8495bd7cc8", "comment": "Malware payload", "value": "b72ce4d38baa7da28c9a6cbad150c9dd", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "b34e3a6e-9294-48fd-9598-6d80f5b0aa68", "comment": "Malware payload", "value": "cdc51734d5dc594256d3bd58c0cfb26821b88f9d782cd9d84f73779f7086c83b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "f4a905e1-ae25-4e5a-a7a6-9ccc82f30118", "comment": "Malware payload", "value": "9e7bf441b34edda33f93a63ca9b06555f8559d6e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865846, "uuid": "6c031f27-f953-4000-bef5-b20c81ccc937", "comment": "Malware payload", "value": "28a3606240ae9049d44a66fcbbe5e1bfb53e4ef7b3c55235761df7e1ba2155098684ce53d79df528c67296bb1a8f0106", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "65a60ee2-b519-43a4-9206-a6e9a821754b", "value": "T166C34A57B3A530F8E177C23989A14A15D7B2B8754B60AFEF03A04A551F236D09E3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "6efd8d18-4ad1-422d-b8b1-22a01161511c", "value": "6dc70fc3ef954cb7adeefd73f61b2f91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "0ef4d500-f1e1-43a5-b70b-d69947c09b6a", "value": "3072:PHUtBTUmwEpwkrvoYLfZAMGayjmxxgHCsl+bTji0T:P8dBC9YLfymgHCslAjia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774865846, "uuid": "3bd23cf7-752d-4487-9ee4-8932778d0e48", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774865846, "uuid": "ab72c869-3688-4c51-9b89-7841160413d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865846, "uuid": "46dedd57-fe6f-4a53-9504-9e5f37947397", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29fef59-2c36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874966, "uuid": "04d06880-0844-4aca-ac22-dde96fb52907", "comment": "Malware payload", "value": "6c9da8de6797d4a446d962d5f3f0c22c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874966, "uuid": "695bf70b-1efc-4f2d-b287-e90743e1163d", "comment": "Malware payload", "value": "ce681356c8870af8583ed753fff330e2897f4629c45677f8065649a47b20a111", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874966, "uuid": "a8c6d5f6-333e-4489-8db2-f7a8cf5224da", "comment": "Malware payload", "value": "a151fa88ff7d8f5ae4cb479909d15089aff1c03f", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874966, "uuid": "4501ee0c-2896-405c-8613-9e780ccd96a4", "comment": "Malware payload", "value": "bd539d7751e0f01f5897aa0d94af3dfe4a99d020d3873356205c2920d2c5b08a5da3606506b5302695ced6d9c16cd31e", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874966, "uuid": "35deef41-1a56-42c0-b0be-9683591d1f9a", "value": "T103724CDA7C2A5D11E74B493FB8DEE4811509B95F4002E9B8BAEC97488FCC23CC1756B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874966, "uuid": "222b4da8-41b8-4b98-9a9d-89055210e8be", "value": "384:apdPRnl/QgIFLMWMnyYSBCmdyakISw+8SPBmkpxl0bbZi5:smXMpnyYodyaJSjRBmxRi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874966, "uuid": "fbfd2178-bc55-4b97-a1f7-57bd5266685a", "value": 17281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874966, "uuid": "9dc2a0f2-b152-4093-ade1-005f9dc74738", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874966, "uuid": "5817a6c3-04bc-4f8c-ad20-fe159dd8f111", "value": "ce681356c8870af8583ed753fff330e2897f4629c45677f8065649a47b20a111.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91f7f87-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867998, "uuid": "bd12c52e-c1f2-4ea6-841e-2f4c729ddd27", "comment": "Malware payload", "value": "8015da567600b9d3b6b0d88d0e04cccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867998, "uuid": "0f6b8922-e4a6-4a44-86e9-eb66284dcecb", "comment": "Malware payload", "value": "ceb0531da29f76ad3bc86795f8dac3c5f04de044deb175ba79c850b0d57a8a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867998, "uuid": "f6dc20e6-6034-4fed-b389-f2cc762ce528", "comment": "Malware payload", "value": "5b918628ccd0f73ffd22e72eb59ccf601769720f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867998, "uuid": "c44fb93b-cdc6-463b-a6e8-58119518f209", "comment": "Malware payload", "value": "1b390bef341c1277778ada492c984e8fcc403380c85a10195042376dee4a6cb78228f9272afe9f04700e245deafb55a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867998, "uuid": "d0eba07c-1d94-4fc1-9252-c753290bb911", "value": "T1DFF4BF21FD8180F3F9E2007065B98B735D3DA61497288FD3D3D45AB999201D1AB3E7AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867998, "uuid": "7027e875-badd-4ed7-bee8-6d318cf71ffd", "value": "1e9a1c1d5665656f0fbca49074519ae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867998, "uuid": "e13df527-7328-4076-8391-f52399c0da7f", "value": "12288:BwwB/YuryHqC8a0HS9Y1p57vV/Pl1n2oi29C1Q9rUfTfxHP26WfTzAZ5vfKSgAA+:WY/4K/BHiQ9rUflNgdgItYjKdYeZyBF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867998, "uuid": "bc12beb2-a958-4b30-a255-daec3b75b3ba", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867998, "uuid": "59bef98c-fde6-4e71-9c57-7e3d171a2dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867998, "uuid": "aca94f41-0b4f-4577-8a3a-ee50259f3a1d", "value": "mservice_l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168cd00-2c55-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774887983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887983, "uuid": "e51419b8-d733-43b5-b3d4-109d4de1fe14", "comment": "Malware payload (RustyStealer)", "value": "dfac1c1c051c87bc8283b77ce338fc3a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887983, "uuid": "48b9544b-d658-48c9-9ab6-c0973a691a01", "comment": "Malware payload (RustyStealer)", "value": "ceec4a8c3e789ee5bd081661fa8e74342f8609ffc32d20c3f2626c4d22723989", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887983, "uuid": "5f7b1d18-501b-47e9-b584-ce6df8a098f8", "comment": "Malware payload (RustyStealer)", "value": "b5ebe8932f3b02a81db3556d2faee8d34f2d24fa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774887983, "uuid": "07d72f85-4a63-419f-8b4a-4c8e7b41db54", "comment": "Malware payload (RustyStealer)", "value": "3cb0feba89af808c9ed0ade8edd889f2cfa0c72b2d5dfa4e1dc20c01ead4b1351fcc4c0269535c8a96caa870086dad5e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887983, "uuid": "48486e6e-6ceb-4598-b60a-f2c42a326135", "value": "T14576BFF83154A8BBF67F42FFC6952DDD42763622C78DACCD6064A1C10993A7AFD26408", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887983, "uuid": "c9ac868a-17cc-41fd-8424-5536c7474ad9", "value": "97b14257677d73f33c2831b80cbf76ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887983, "uuid": "733171ab-d97a-41a8-ba7c-6d58a4a34d80", "value": "24576:w6H5eEgeUKbq1SBntjl1UkslSzF56U3CYaa3VpoVTOXSzhO4GDguuTSkmzcbgyHa:w6ZeE4KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774887983, "uuid": "cac29609-81aa-4ed0-b5bb-5c053ddf51df", "value": 7170502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774887983, "uuid": "280c0e38-9893-4f5b-a9fd-27054e295bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774887983, "uuid": "935271af-4ec9-4b25-ab0b-39a6ecae4366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026b65ba-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853974, "uuid": "d211500a-bf57-429c-93f7-30d5630c832a", "comment": "Malware payload (Mirai)", "value": "c903598dd6ee157686eaaafac2a5ff53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853974, "uuid": "d4d97819-b460-4e02-854b-0b8eca25928c", "comment": "Malware payload (Mirai)", "value": "cf962acaa47b10da61f552128ab2158a448200505526f8f7b5225f3bad8ca41c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853974, "uuid": "455f2e22-8083-4476-9b21-8e9c4ee86292", "comment": "Malware payload (Mirai)", "value": "7a6e7b9757bf82db16b0f9871c45479aac68a19c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853974, "uuid": "b53c2cb4-da48-45a1-b5d1-0e3184805282", "comment": "Malware payload (Mirai)", "value": "a2dc3b7dc735ca96e2bd9ac05c1109df2dcc249a1e0af8d4c6dff30a7cc6c92c8cdc75c4c93929b9ce3cc8278b8254dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853974, "uuid": "d33d2d60-f8ab-40c4-9e40-306861bbc53f", "value": "T1CA044A85FCD19A12CAC622BFFB1E528D372653A8D2EE31039D265F21338759B0E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853974, "uuid": "87354a3e-3fa8-4ef9-8be1-b64c79535906", "value": "3072:2+LLSG9fhVfxDIs10UugxkfI5zf4eRC/ExZ/1ltaT2P:2+LLSIfhVf1pegxkwlf4e4/yR1lta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853974, "uuid": "d1a959e4-707b-4cc7-978a-9f7fd160f5ce", "value": 185888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853974, "uuid": "97293f77-8944-4cf5-aa67-cbf3063a17f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853974, "uuid": "7e6e14e2-1f07-4eae-955e-f2955d7ed9c3", "value": "kurayami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66ae756-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853900, "uuid": "c540b300-d752-487d-a04a-fd8afdb3ec80", "comment": "Malware payload (Mirai)", "value": "8aa5bfb0ed7cda49f63516b9657ea248", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853900, "uuid": "fd28cdd7-564e-48ca-8f00-0752358bf2e8", "comment": "Malware payload (Mirai)", "value": "d025eb12dc4be6b1183406858e9e6cc4564788928e678db1b6bb218c70bf8c28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853900, "uuid": "507faa8b-7fbe-4a19-a6e1-0a5504ca48ad", "comment": "Malware payload (Mirai)", "value": "82e6bbc7ad55c67b7e5960c065d8ed85b5a2cf22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853900, "uuid": "2601e504-07af-469a-8d23-2922206dda3e", "comment": "Malware payload (Mirai)", "value": "89f73c62f67c89c69a663fc1b3d4e75e698dbb383358ca8d9d5fd40d15103e47f5041627fcb03a5614844914dd135033", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853900, "uuid": "1a6acfb1-ef90-4b35-a921-6b8d3c485da2", "value": "T11BC1A4861145CF33BE08ED16B9A55D0830D02AF0DC96FF4AD4F755A3FA5DE88A802E27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853900, "uuid": "2d80ef59-a34d-4b2e-a177-5b1fde1fe6e5", "value": "96:475vJGdU+Zu8dJ4JB+fijIRqqJHcZEqqZpZcXHKvJ:ivwdUE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853900, "uuid": "5ea1060f-e1f8-4316-8180-ea0558e721d7", "value": 5730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853900, "uuid": "0cec3478-caa3-45b8-8fd9-d88c50022bd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853900, "uuid": "ce4bd3ab-c441-4e41-8503-5d22858a1eeb", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906c468a-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830590, "uuid": "4516d4bc-d29d-4a93-8b9c-6d2a826bc538", "comment": "Malware payload (Mirai)", "value": "a1b8897742077d405703b4b759c5fc8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830590, "uuid": "9f0706fc-856f-4906-bd54-f9149161ab0e", "comment": "Malware payload (Mirai)", "value": "d05ac7c3b9054b5fccf908d9f97a70bf7da6bb2dce43107f4bee8e3650d96c90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830590, "uuid": "ab6b50e2-c864-4fd3-bb64-62071930b279", "comment": "Malware payload (Mirai)", "value": "f1a54e5211a79a889746cd5d913ee9179b457ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830590, "uuid": "6eaa87aa-b799-43f5-8a71-6ec6c7753e41", "comment": "Malware payload (Mirai)", "value": "e52c12f0aec88a1d7061e81fddf1c2010c6bfa81eb97e7d0fc83212493a670947e99cfb0c93a4b3dd36d617932d6d63c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830590, "uuid": "d2912fbc-e404-4aa9-a2fc-e762c4d3366f", "value": "T1AF8329C1FA8BC0F1D91B89304067F63FDB31E9295061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830590, "uuid": "335d35e4-c60c-4a48-82b8-c4a3808b9788", "value": "1536:iIDwDhVtcU4xiUWaqH3FoweskW5iOKjfTsv4gz9F7vLG:zDWKzQLH3FnzYOKjfTc4gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830590, "uuid": "e19a7e0b-cfb0-4c72-b8f0-3e76b916ef9e", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830590, "uuid": "97500eb9-a3fe-4dd5-a94c-b2ac61a43d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830590, "uuid": "0c2fb63b-57fe-4eee-8b93-76a3e4462580", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e139a7-2c18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774861921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861921, "uuid": "d1c5ecdb-4ace-4d01-8a14-5fe5019d788c", "comment": "Malware payload (Mirai)", "value": "7de814bf9fe3c15f7594559baaed17ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861921, "uuid": "cbbdd0f8-be4a-4933-a072-79be40cfd32c", "comment": "Malware payload (Mirai)", "value": "d22d9a9147b8c5b78a60e0775993ad103b6674d2f8468b5b58fae1b23b1561a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861921, "uuid": "cee5992c-652f-45ac-9fa0-33df89a23d4a", "comment": "Malware payload (Mirai)", "value": "ff5108a433148db17542f258904ee58694e4752e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861921, "uuid": "5c220a25-f414-4218-9911-5560e14b64a3", "comment": "Malware payload (Mirai)", "value": "497436a77a11d7743b6a01bc94738d33a0ce753bb2db8cfa836e0266be5cc6738c2e5a324b24246c61e064576ce71d3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861921, "uuid": "332ad4e9-321c-494e-80c9-bb3f18b9dfff", "value": "T17CA57C87F718693FC87711F2496E523266574C078A839B83AD48361C29BB5D83F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861921, "uuid": "28c9c3e4-f7c2-4490-b301-15c8648093fe", "value": "49152:Vpj2qDqCW+i8gHw03CdaP4gITAFoTwrkp8LC2p:VpurH7CWFoTwrkSeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861921, "uuid": "02dbaeb0-7dbf-4eaf-941d-f1acdd9b7e47", "value": 2080806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861921, "uuid": "e9105784-6105-4714-9c6b-931783011d70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861921, "uuid": "b664534d-547e-4bf5-90ad-d837857331d0", "value": "siliconworks.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d860e6b2-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853904, "uuid": "52f45095-1f2e-4640-9d29-f9581781a11d", "comment": "Malware payload (Mirai)", "value": "b0d59407222c1a462b030a8920518825", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853904, "uuid": "d53a0375-1e81-414d-b723-1aa45dad110a", "comment": "Malware payload (Mirai)", "value": "d2985fa008e8fa04fa8666c2f2fb5d447a9acc1c85b610e57923ab73d411b5d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853904, "uuid": "d332e96c-9ec8-431e-8e88-3a1a6510dacf", "comment": "Malware payload (Mirai)", "value": "b1947ce3dff62dc502ff60dc5caf8f7744227f7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853904, "uuid": "bc2cc74c-39a1-4047-ade5-fcb888555043", "comment": "Malware payload (Mirai)", "value": "8916cdc86d8cb7b82e80c234cab941ec75d0dc2babbf1a327ff994ac9e314dae04fe65d0e73ee4f946a43b9f5148a4bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853904, "uuid": "09676acf-6e6e-4786-b227-2dd9be48e3df", "value": "T1131429CBF801DDBDF80BEA364C531909B170B77214925B372257B967AD3A0E50927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853904, "uuid": "4c573db3-3666-4571-932d-8f6732525d98", "value": "3072:V3D0W6+PRn0wVQUW5SuM+uOT0mhgO7qIpjzJH+1Y+3PTJ9lZ++fFEVNjbihLCXV0:N/LnHfAS2pzJH+1R33W+fpLC7yXE90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853904, "uuid": "6394ecb5-5615-4ada-8973-194222f9e0a4", "value": 200608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853904, "uuid": "266610df-7669-48f9-88d6-c87796690b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853904, "uuid": "fea6ffc9-47cc-4c87-8f4e-e0f6a7f388b0", "value": "kurayami.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41f73a5-2c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774879183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879183, "uuid": "4d71bf8e-4510-455d-9e89-b382b714c46c", "comment": "Malware payload", "value": "d4dfb7d9c735b478f154666dbbca4651", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879183, "uuid": "2e43b589-7041-4ae0-b37d-1b4453796308", "comment": "Malware payload", "value": "d2d4f3c29e7b3d82747203bf108828714613c8762efb9150b8bd13b4b16d560a", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879183, "uuid": "f68b12cd-2e1e-479d-b29e-bc455b6a73eb", "comment": "Malware payload", "value": "10b0e61f4834f60a94d9afb9870aa0226bb6a818", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879183, "uuid": "64b8f6be-e398-4848-9eae-a8a0d17aa77b", "comment": "Malware payload", "value": "f85196987b2065d7da108f935a44fd1499cb4cc5af7efa346a682bca63bf9a0595f54fcf2e6d5450bcde2601f77cdc67", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879183, "uuid": "79f55953-bff2-4dee-84d4-17498abb5ac1", "value": "T18825BF017C81D432D75A21B14ABDBFBD4AAED9300B6419CBA7DC68FA4F706C12B32657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879183, "uuid": "fcb17320-bd94-41ef-bace-ee22759e2b46", "value": "5799f031b5c4ea5a5a51635c0de03869", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879183, "uuid": "fac5c913-9188-4678-a023-bf5834186e55", "value": "24576:+ZwCIFKpLYvFHr8yE7BLOLWp7q+T2zTXi4LCqd6aNp2841i0:qBxLoFHr8yE7BLOLWp7q+T2ze4LCqd6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879183, "uuid": "679790c8-fb37-413f-976d-a0f3addc727e", "value": 1008440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879183, "uuid": "f1ca8034-1d69-4c65-b3d6-3eaa804540a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879183, "uuid": "d86992e0-96a0-4b05-ae90-9be51bd70138", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf5df59-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774891627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891627, "uuid": "43fca177-b382-4a06-a318-c775539363a0", "comment": "Malware payload (AsyncRAT)", "value": "f3821650972b1911cc96ace0c7085854", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891627, "uuid": "cef37053-d371-4f67-99fa-a49cd2448a19", "comment": "Malware payload (AsyncRAT)", "value": "d2dd6ed01c625a5a5a57d326678b57a326b5f7cd4c484931235053c04b3cee54", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891627, "uuid": "6d0260f2-3fb9-4373-ac8f-3acbc036d95c", "comment": "Malware payload (AsyncRAT)", "value": "3ae1bfcab492023ff727af7faf972c24c2abfc17", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891627, "uuid": "cfcad524-c7b7-4bc9-8ccc-f6ddca692c26", "comment": "Malware payload (AsyncRAT)", "value": "e26fe7af471b1d7165b22432625d88b76d314fce996115f6a2470c848c9748e78271494b1f90dbe396bd940d8554e1aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891627, "uuid": "97262589-f79b-4a97-a4da-b8dc5d557a24", "value": "T12082D10D66E4CB46FE09F17A94E66D58D67227F6B28FE8ACFF7D80534C6508110231A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891627, "uuid": "8de0f33b-958e-4bbf-84f8-2c07b30ba566", "value": "384:313cSPJLdjqcyGRNBZ6xpG3f+8tCqjO97Xb+KVM09/rrs9M2Rm:3NXPJLTyCT6nGP+8gqjONVMqsKUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891627, "uuid": "20283fa1-2fd3-4167-8ccb-bab6bf8ea78c", "value": 18107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891627, "uuid": "6404f945-4252-4b85-861d-59268ddd43f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891627, "uuid": "815d2b27-d930-4587-a2d7-c06f10f207a6", "value": "DONTRUNMEBRO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6e9bf8-2c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774871444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871444, "uuid": "c473c2d0-ef67-43f7-9252-f2f04d81660a", "comment": "Malware payload (AdaptixC2)", "value": "13b5e1653b59a749030ddd6e8c5418f4", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871444, "uuid": "c2dad97e-b666-41b2-8456-c6e05538533e", "comment": "Malware payload (AdaptixC2)", "value": "d31afbeed9cfdb323aed6a4d1ae74ddd9d50b25474913d7bef8a3ff3299adff5", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871444, "uuid": "db6bfc8e-f6e0-41b5-ac0b-8e15842cca51", "comment": "Malware payload (AdaptixC2)", "value": "437fa8439bdda1ad0b61b854195a8073d006f4b1", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774871444, "uuid": "1fcf8a71-6044-4e91-9bc1-9cb907bad30b", "comment": "Malware payload (AdaptixC2)", "value": "60551bf84c553d57c69426c7b03e567aef5c0fa9583b67ad66c7a1c8e5246a344830e0634e521013342113dc17358a8d", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871444, "uuid": "7725042a-a08c-4bb7-9494-2f2ab9ac5909", "value": "T13A934136D7B3C4ADC06EC638AB43A4B3B9F07C5D853475194B81A6123B5BD386BBE184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871444, "uuid": "650d05d9-b7c3-4985-8f71-5e0c73bfba23", "value": "1536:JIFq6WWTlqcoRZM2yHxSsUWFUy/29kJSw0o0A2VPoDEanE+6Uh/W6RISC33B9cY/:GT8spf26NI7R2NVEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774871444, "uuid": "f77bf205-23de-4dc3-93c6-a1db5398dbb1", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774871444, "uuid": "3c77eda1-0119-4b05-a6da-4856881f08fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774871444, "uuid": "f13f1d90-6c5a-4547-9d5d-f0ae046be511", "value": "d31afbeed9cfdb323aed6a4d1ae74ddd9d50b25474913d7bef8a3ff3299adff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953a4a11-2c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774903183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903183, "uuid": "0c7244a1-f83f-4b41-a45a-870df5c9bb1a", "comment": "Malware payload", "value": "28e5fc5107699ce290169776596b806e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903183, "uuid": "36e16bac-3ee7-417e-8613-f6b5b14dbb48", "comment": "Malware payload", "value": "d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903183, "uuid": "e24f007b-2f96-4783-876f-8d70a1ea4902", "comment": "Malware payload", "value": "a9b24639f7c1e66d0c2d4555151126402d402ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774903183, "uuid": "ec50c9d8-e160-4289-884a-e3e5ee6d0b75", "comment": "Malware payload", "value": "5c1b66c51f1614d368d99f87a0ab0daf6861e947d8deaae812fd10f7b523ee5c1e0357f8b8659cac6cf5a75cd11aa0f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903183, "uuid": "cf331e67-2889-4bf5-b7ea-9f19f333e878", "value": "T18218333BE18A6579E06E2D363572E210943FBE5169030C1B96FCB04CDF356B11E3EA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903183, "uuid": "2207bffb-7cd4-4e8f-b6ed-0fb8ba4244d4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903183, "uuid": "3fbb00a0-34d7-43f2-a7f1-03ff06d6bddb", "value": "1572864:pW7mT8Psdhx+WQXmyAj+cCWgAv3M5J5ilWJ0bsbvmqEN4BkF1EZDOLLh:AmgsMPXmr+cCWBv3KCdb4p8LLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774903183, "uuid": "64c4e073-f651-4d9e-8f24-e8d90411cac5", "value": 84950424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774903183, "uuid": "4235bf23-d633-4f17-94ff-b712b2298a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774903183, "uuid": "2d616fb4-7020-4d62-8750-a0582ec3fbc6", "value": "Oficio_20392302026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be2360f-2c09-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774855493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855493, "uuid": "4b094b82-6c84-4e4b-9b44-bc5e8615e5f8", "comment": "Malware payload (Mirai)", "value": "6f98eea26df902fcf67626c72d97bde9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855493, "uuid": "0b936e40-6231-425a-b574-18fa909449ad", "comment": "Malware payload (Mirai)", "value": "d4263fcc87ce1de0e75d043f65d29c3e926064e4157e3090dd006f64059c3d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855493, "uuid": "26abfab8-a916-45d8-9b03-14e8bc85ef3e", "comment": "Malware payload (Mirai)", "value": "5b1eabfe69e70439f33e7385f2f5b00689ec3b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855493, "uuid": "fbe7b897-43c4-4735-84fe-c21f7a6272bd", "comment": "Malware payload (Mirai)", "value": "7fd9ac9fe6be1add0f84f7e67d2ff488f9d073944dd8f9bbf15c1c9a06adc6d68107cae7b7c94682d5a5ed39ad77e3c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855493, "uuid": "5453eb4b-2ab2-49d5-bc6d-e942f78bb3ef", "value": "T1E9633B41BC815A17C6D41277FB2E428D772B17A8E2EA3207DD255F2137C782B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855493, "uuid": "cc9abcd4-610a-40fc-824f-aa86e6594a96", "value": "1536:mAygc09zCh6jgG+4sDZgGT97Fy+OSWOXv3esfEnvM:mAyAc62dmGT97FK0gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855493, "uuid": "2243f837-fd49-4db7-89bb-0111e56e13e1", "value": 66876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855493, "uuid": "306a092d-d5d9-4364-9b68-75bb9c38b67c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855493, "uuid": "a0587fc8-2c3d-4ef5-9200-2e45ff84e6f4", "value": "arm4k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd439e6e-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909263, "uuid": "79c31b12-9edb-4a34-8668-a54e22f7577d", "comment": "Malware payload (Mirai)", "value": "3d51a5d76c5253de0fa4ab0a0bc2cd01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909263, "uuid": "dcdebc24-22d6-4225-9c2f-27b393ad1176", "comment": "Malware payload (Mirai)", "value": "d433ee39b09f728862268b5794adc2eda2f0b01b7ec81fff6a5d17370adafcb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909263, "uuid": "f590e36d-a011-47b1-a256-f4be5c137c2b", "comment": "Malware payload (Mirai)", "value": "12ed3ebcdf0b8fe2296993fe52d9f66857a76971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909263, "uuid": "0fdd0dee-4b45-485b-9ea1-37f0838e4c52", "comment": "Malware payload (Mirai)", "value": "b4c489121ec8466ca1fadd732c34bca0c2b79c6604a2a54ec096f9335022327bf07b4ffd461a9e29c9540ac04c5f4b17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909263, "uuid": "639ca58f-2a68-499f-b03b-4c979b8289d9", "value": "T17504292F348191F0F6411B706BCBD3976D790BBF1199909F6B516329B6E0BBBA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909263, "uuid": "fe027b87-cb2b-45e2-9791-216b34e0d8a2", "value": "3072:cwdnh+SR4dS7iUrc8euUaTZYQtmANXe6H1O1N+d8+NNuqCqH55Oui1UXT:cYQSE3lAqQNwj9WNOqH5MJ2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909263, "uuid": "82dca4bf-ca1d-40fc-82fe-821c464b97c5", "value": 189012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909263, "uuid": "91238f22-23de-43b7-9e20-7498dd2db8cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909263, "uuid": "0d025c9f-3c9d-422a-88f2-6cbeec9dcc46", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cca553-2c04-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774853205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853205, "uuid": "15805fb3-2ebe-4534-b6a0-8005669ab5f7", "comment": "Malware payload (Vidar)", "value": "c13bf81fb3dea1cc7fb0a6baa1ff8346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853205, "uuid": "f45a2e4f-343e-4b27-87ff-fe748770ba99", "comment": "Malware payload (Vidar)", "value": "d4ac44b7f6db48eca45b5a6c466d32472bb55d9e90371d801dfb63c75aa61123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853205, "uuid": "56ee6cc2-cc0d-4eb3-9062-fa134f89248a", "comment": "Malware payload (Vidar)", "value": "648d04aa440410aaed2408ea9291dbe670e3ccae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853205, "uuid": "5288142e-c3ba-4f3c-ab71-366834d4355a", "comment": "Malware payload (Vidar)", "value": "433ae1ff87051f652a58f34475b0883d1123670ad304f133b3bd40182908e80e0b0dbcf9a0839f8fdc4e2e20ca8f5b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853205, "uuid": "110d2580-b285-4843-8db3-76ba6cfbf574", "value": "T1F3956C06BCD008F9D06A637289B756A27B71FC690B3263D72A50B67C3FB6AE05C75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853205, "uuid": "8483cebd-d930-4312-8c10-e248497f0870", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853205, "uuid": "30ba1121-c049-462d-a9c6-43885eda3976", "value": "24576:SrYulLf9w1MBIuu16pHxiTxmL6lwYY1TzQPjxki1HiWrtPBzD095j:SrYmLf+1MWuukiE6yYYxQPdJ1HiWL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853205, "uuid": "bfb3b754-3c75-4260-81cf-47a24452b729", "value": 2056832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853205, "uuid": "281e78b1-d842-4914-8bfd-1fbd8073fb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853205, "uuid": "345367e4-d968-4c30-bba2-d973cca8818f", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68021a91-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830522, "uuid": "323af474-393b-414a-bf5e-43dd4d60496c", "comment": "Malware payload (Mirai)", "value": "f9b8515c61dc4db83bd231b47c190c9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830522, "uuid": "f9af46dd-92f8-4bb1-8850-ac773fd5cd74", "comment": "Malware payload (Mirai)", "value": "d4d1ad2082e114d5ea577a5beaf8c45ae32fbc0cc3c1e02d56f66df9fec85f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830522, "uuid": "e013ec9a-7bf7-4d15-aae9-50c553e061e4", "comment": "Malware payload (Mirai)", "value": "c0ceb29f31cd26c3ce88c3fca9b83c35f90b325e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830522, "uuid": "41424dd9-94bc-4d9d-864f-6c90280561e6", "comment": "Malware payload (Mirai)", "value": "5d9a0526b91120c70a09c17eea7ce6618db931064059074727c9c941b6ec30061b8b78cc8e5ce43089e430cf3e36751e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830522, "uuid": "31cc0004-beee-4dac-b302-14fef700d1ff", "value": "T1F303F1ABC2B2CF8FC3D7677008DEB6AE1518C7A6D2B8A5E56540D0771220BF9F1A4740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830522, "uuid": "857e5655-95a6-494e-868f-19f0b9110b18", "value": "768:vp8088gzzBUlHT7NgovQrt9xRxB5fcAgaw/2B1LxBxB/I44VCSDdnbcuyD7UHQR7:vpk5dUlFfQr1PX0Axm2XvTGZnouy8Hy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830522, "uuid": "01fd83ed-64a4-49b4-a54d-f32928597045", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830522, "uuid": "d5185cda-e468-426a-b24b-52181ec386db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830522, "uuid": "3c1730d8-cc55-40ab-8ee3-2e69c48398b5", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e19b671-2c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774876086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876086, "uuid": "8c6fa036-1a54-4824-99c8-213ee4232307", "comment": "Malware payload", "value": "3b7cfef12f71dd63d38dabdd7f08a681", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876086, "uuid": "0e14b1e1-2223-43f9-983a-fb0050b58fab", "comment": "Malware payload", "value": "d6a2869ee450abd15fbd16519d83271f9c60dcba79540675da72726a767f1bc5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876086, "uuid": "7be6bcf3-46b9-4d6e-b476-9e4b5c0c728e", "comment": "Malware payload", "value": "3af74a25ebe01d350c19904830e97877a840d299", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774876086, "uuid": "81e6c878-dbe2-40af-a53e-1fb54d993f15", "comment": "Malware payload", "value": "23a26ffb84a96e42e9d3c685b14c5e1a62f7996f1ea756bdf3a17d95316d77fdcda8b232fed3b833593e0cf36daae6f8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876086, "uuid": "914ddce4-a974-42b2-b7ba-b2b0051cbbc1", "value": "T1E6D5DF89B748A62FC87A15330DEA9232225B4D478E8397437544375C7CB7AE80F5ABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876086, "uuid": "7a182a93-35c0-47fa-8d39-ca7d913472af", "value": "49152:Qmgx2y3KuzCm1qHwZUJchJ6fHXvBrqOfmDP7MOfuQVe7rIU6C+kkC4V2D+KvREvM:42y3KQCmUHwUivIHXvBlfyP7TfuQEXIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774876086, "uuid": "cdcf063d-2dc0-4a4d-ac98-6bbded7ac426", "value": 2908147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774876086, "uuid": "5bb2953d-8f6a-432c-a228-da97f5a16d5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774876086, "uuid": "3bc7ccec-92fd-4913-a60f-c5cc45bcc91b", "value": "d6a2869ee450abd15fbd16519d83271f9c60dcba79540675da72726a767f1bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08650c2-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909242, "uuid": "e3f614fd-3e48-4099-a23b-e6d4401caefe", "comment": "Malware payload (Mirai)", "value": "9101b751ca665cffa1fa614a5df9eec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909242, "uuid": "911bd111-2663-43a2-8e47-6ece25e76860", "comment": "Malware payload (Mirai)", "value": "d897821b96feca88ac6380e1b0711ac5b2aeb1d9855de7bd7dd7c0d15437bec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909242, "uuid": "2b238ff6-e919-4c7d-be2e-15423022c968", "comment": "Malware payload (Mirai)", "value": "f037db4ca9a05a3a2ea56b195c88310376b3fc12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909242, "uuid": "4be653d8-9c6a-4c5d-8d91-40b1a93f0530", "comment": "Malware payload (Mirai)", "value": "1ed3d47a2203dd9476fb1fa8ddab43757b1df3966a3a79264c0a7228b5ef7c5b857af49164cedade9ce9e0255a36c168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909242, "uuid": "b86681a2-53bf-4cb7-92b3-bea8c4e31344", "value": "T116C3A087E550BEBEF4A9593F88438A26A755DF740A831F18A1FCFAD06E3539432C2D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909242, "uuid": "72aaae3a-f46d-450e-b9a4-c44f8d467b28", "value": "1536:S+BHlG15aFCGrdv1TT2zZIea8LxTwHW7mxycLzXPOBecqHYkaY8rSM:PFGLIDXTTcZIDAoRyckectYUSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909242, "uuid": "1e2e65df-4b7e-46bb-802a-0d36a37677ef", "value": 123320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909242, "uuid": "b0cf13ea-6e46-47f9-8dcc-5e8d658a4a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909242, "uuid": "78b22a30-2d51-44e9-a63a-f1627dc53bb0", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82f7565-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774891645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891645, "uuid": "57ab0816-9de0-43c5-b01a-6713e8de5399", "comment": "Malware payload (RemcosRAT)", "value": "8dcca5cca654b28aa52fe532551587d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891645, "uuid": "b3ae87f1-08ac-4274-888a-71292e432b55", "comment": "Malware payload (RemcosRAT)", "value": "d93ae18e31dac16d194321af2c0d7eed0360ab7b5c9960a2b10e1239f303368b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891645, "uuid": "f33b87ab-8db4-49b6-91ee-1598411fd29c", "comment": "Malware payload (RemcosRAT)", "value": "377531bfea8a407359e08893afe6760e8405680b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891645, "uuid": "97c44667-b973-4ce7-99c0-5ce48efc2d94", "comment": "Malware payload (RemcosRAT)", "value": "2b733d9714bfbdc65e64cb2d7beb1d216fe5122371d9e28298e2bfdc8989023e7d85848d2ee7ef197606f800d4729a6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891645, "uuid": "0414058c-4d68-4aea-9947-ef3c0fce0bed", "value": "T128F2D8CD3E8ABAD0575024FF5DABF065F12D4D84719CC094EAC6F89DB829B1AC179838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891645, "uuid": "52e88649-812f-4339-bd39-767c111efd58", "value": "768:AGT59e3aIqVybY01yAQSELRdvKmrBHwpBmfnKP0H:AKIqAbY0YFSEN0mrBQKKP0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891645, "uuid": "8b29a6d5-fcf6-4f84-a137-6b4f85f32a3e", "value": 37271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891645, "uuid": "502d2805-c81d-4aeb-9ffb-a97e47bfbe40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891645, "uuid": "067e1e1a-d6b8-4a16-8b07-0478b8c70968", "value": "crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec547c2-2c18-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774861833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861833, "uuid": "d1ef17b5-cb53-485e-930b-260aa2f1ba3c", "comment": "Malware payload (CoinMiner)", "value": "7c400e5f63c13aa621b8662a965fd2c6", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861833, "uuid": "2363bb70-96aa-4cd1-9a31-972ef0da7932", "comment": "Malware payload (CoinMiner)", "value": "d9bdd75c2f3bdc67d6d44f211b170e3a5a9487719afe7430857178e60b988c2d", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861833, "uuid": "e60e8d15-e1e1-4efc-b0fc-304124dfe116", "comment": "Malware payload (CoinMiner)", "value": "6009b3a5cacfa087eeb6231bc175e769bf427700", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774861833, "uuid": "07cd3556-0f6a-4600-b540-251a9de86284", "comment": "Malware payload (CoinMiner)", "value": "bf79fc7cb1563fd48d37ca1a11b276f56172fd70717c0cd388353b5d4a66d4b3d28220448579ad6278fe92604f5168e5", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861833, "uuid": "03a6dcce-7171-4a35-bcde-e0829b3528a8", "value": "T13BA5335FC1CFBEA5F9E1523EA262F5F08A0D643131C7620C9ADDF49752300A497683AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861833, "uuid": "06be8fd4-7021-4f14-995e-b71a816aa0f0", "value": "ce307283580e985af0c5f28a3faab24b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861833, "uuid": "edab4f75-977c-4a76-90b2-3c7c3b7fcf21", "value": "24576:SG0S9rsVeD38LYQgUyGEvjlky2+dOLMo5pk71/V9UZqqo3roEn/D7INgG4GutTvs:SG0SSoG4jBB/jUZZbHulv+vK2iWb7L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774861833, "uuid": "3e735660-8309-49d9-a6ce-5e2947514e0b", "value": 2179584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774861833, "uuid": "de65497d-9cfa-4a64-b8c0-2ef0584205de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774861833, "uuid": "4e66e704-2910-47e6-a425-869d3e3d5dfc", "value": "mservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df732ae9-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868089, "uuid": "8391af3d-a291-43f8-a884-ad6005bc36a5", "comment": "Malware payload", "value": "94eeb2fa50c3a089591cfe90f73501ed", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868089, "uuid": "f228c1d5-6e65-492a-9126-d9aeba8cfbe8", "comment": "Malware payload", "value": "da14370b1171c104ed98bc9da510182995bc36dd0d18d70113fafde5a5071477", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868089, "uuid": "8715dc50-e520-4d75-bbe5-b2f0bf069c5d", "comment": "Malware payload", "value": "46b255f38abea5ce8dd150f24537e28355f85b84", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868089, "uuid": "62e97cff-29c8-4957-b450-da40be4ad6f6", "comment": "Malware payload", "value": "47abeec62c120dadb2e356b0ac4206ebc7d6e503b913aadbf58ae508dfec4ab324f059225e1a616c92fb42390940d330", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868089, "uuid": "1e0c2b52-138b-4463-beed-326c84719eb3", "value": "T12475BF41FBC241F2E997053550AAAB375F396B244724DDF3D2901D69D8302E2AB3E3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868089, "uuid": "1b7d5ee2-22f6-46d5-b515-1346ecced8c1", "value": "c4554da6420019ceafd876585a80ab36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868089, "uuid": "2aa80060-3990-4b35-a36a-4ce9413a7293", "value": "24576:k1FsI2RkVZTMEdJyjd2CdG/TsoEq4L5gKvFgr9x6n7YlI4hzcpmgMWPiqPs3ZUmk:kbsINGG/TixIg6q03Zh2M6p0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868089, "uuid": "58f5c440-288e-4d0b-933a-c3a4be026993", "value": 1635328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868089, "uuid": "de4785c2-9568-43bd-a7d0-ade93ae8ebbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868089, "uuid": "25203fb3-6049-4680-bbac-ecf8a6cec757", "value": "RuntimeHost (8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107e21e9-2bed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774843260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843260, "uuid": "0f80ec58-e802-4824-83d8-23feae3c6d29", "comment": "Malware payload", "value": "c648dec75136ea17e4a2e07cc72bbc9d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false }, { "name": "Trojan:AndroidOS/SAgnt!MSR", "colour": "#537288", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843260, "uuid": "06fdad4b-7ea4-4a80-aa6f-10895f941858", "comment": "Malware payload", "value": "de5f128ee8537d5bcb1da064cac431b078711c1f23ffc194b3d99af6ad4fd1e2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false }, { "name": "Trojan:AndroidOS/SAgnt!MSR", "colour": "#537288", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843260, "uuid": "e7623b0c-cc3d-4f5e-9ca6-e0834f4b552b", "comment": "Malware payload", "value": "024b0ef5847b1e64bb73d37292ff6f280dab04e1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false }, { "name": "Trojan:AndroidOS/SAgnt!MSR", "colour": "#537288", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774843260, "uuid": "9a43cfd7-f946-488c-a62e-199dd449825c", "comment": "Malware payload", "value": "69cadc6b2a07bc01ceeb75f0fbcf3fe93bb586550d495ba56fca02c89eecfb9a134447796e58aeb0887ddae56f668112", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false }, { "name": "Trojan:AndroidOS/SAgnt!MSR", "colour": "#537288", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843260, "uuid": "43e81d67-0501-404f-964d-eca3503726fb", "value": "T12A17CF14D74E643AEACBF03CEA47059260123C5C5661C89931BBB20EF7B77E267273A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843260, "uuid": "42241263-7871-4309-a06c-121b277a88ef", "value": "196608:MXHbYMuAZImBudGs7zU/7YLbpz8TabVZT79heHjfBdNVyCk3Xv62jmOowdbb2mNk:zFIR/c17DSj5db9k3Xv6AvPtUnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774843260, "uuid": "56472047-2ff8-406c-b12c-2a81615cad99", "value": 19757234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774843260, "uuid": "89bf7ad6-feb1-42a8-ac2c-fea23c9713a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774843260, "uuid": "dd69d884-1577-4bf4-aece-62e1bca07cc7", "value": "wdsj_01485.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5832bb-2c47-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774881990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881990, "uuid": "6c6fb976-6c5a-4770-a2ed-2d41c1790755", "comment": "Malware payload (Smoke Loader)", "value": "956ade42f43e85787bbfcd8246e486e8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881990, "uuid": "04fdda0d-f30c-41df-9b3e-0ba7e0a7393f", "comment": "Malware payload (Smoke Loader)", "value": "decb369af57bda89e618678901c0e82c77ce27ae0cabea5a70c958cd36dd1d57", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881990, "uuid": "ce3d21c2-3d01-4d41-af11-13b2908ca70b", "comment": "Malware payload (Smoke Loader)", "value": "f9487825ec81e43c1d7fb20caac03c79d5a60de0", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774881990, "uuid": "ef0b78ba-3cb5-474d-be2b-422341e38a2b", "comment": "Malware payload (Smoke Loader)", "value": "3d561390a3f05033ebec16c6cb8803226e7d35067d67883325e9f2c59812a321e2d74cacf460456c1901a60a1a216749", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881990, "uuid": "c9ff9e95-8f01-44d3-8d7a-3a31dc9b4f3d", "value": "T1AC654A4B7CD149BAD46A93368CA261817B72F8190B3333D32E50B6783F72BE06975764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881990, "uuid": "0e0d44da-6155-47e6-bcb4-e593fdc2aec7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881990, "uuid": "ac91bcef-3059-455f-9ace-1b35aa6d2a6c", "value": "24576:fBKQTICTU+MjrebZnin6Rgt/af0qG6WcRPF4x:fBlTIKMqocgAf0OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774881990, "uuid": "cc6a17b7-f3e7-4bb7-834f-28f17a4a4ce9", "value": 1419912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774881990, "uuid": "6b653e89-f92a-477d-97c0-268c8df4a93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774881990, "uuid": "6da5c820-c4ab-48be-85e9-44fd7a370513", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a91edc3-2c59-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1774889770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889770, "uuid": "17dfc573-78e8-461a-ae53-88c09dfb8d82", "comment": "Malware payload (Sliver)", "value": "e523349143358df73b0aa18cb6d0c521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889770, "uuid": "33da0fac-a36b-43f3-8116-383ff3834dc8", "comment": "Malware payload (Sliver)", "value": "e05aa5f01ff85f52918e7ba8cd641a47aeb1ab802836a671bb018a542bd0b7ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889770, "uuid": "8dbfefe2-1bdb-4376-b49b-3bba9ae5bd30", "comment": "Malware payload (Sliver)", "value": "97bd1525d5f9cb3852c7f552df10cbc2dafb4348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889770, "uuid": "318a1670-02b3-4e6c-9912-ed9f9b33481b", "comment": "Malware payload (Sliver)", "value": "253bbb16730c14ef9a03ad79ad1d303f31d9f0296aabdc33f6841bd1986b292fc9257495dce619cb606fe8daca82f0d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889770, "uuid": "19a9f660-3886-4575-8a8a-afa1c475d282", "value": "T1EEE62B03E89515D8C4E9D2B489254272F970785D0B7833DB2B65F7B42B32BE0DEBA790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889770, "uuid": "5cd9e664-f3e4-4475-8b80-c605e15c6471", "value": "98304:4jrobB4iRxwmTOXyEtQixs+frIG8wmRyEmTXXh1Bpry3:4jr0PxTG5tQv+8G8wefmrBZy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889770, "uuid": "2d661e1a-3af9-4540-a252-e8d15dcc76d2", "value": 14487552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889770, "uuid": "798e7f46-0439-47ed-ae5d-645827e727f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889770, "uuid": "dd0953ce-9f90-47e8-a35b-c5da18e4f348", "value": "e05aa5f01ff85f52918e7ba8cd641a47aeb1ab802836a671bb018a542bd0b7ef.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44ccb9d-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774912765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912765, "uuid": "09bd040a-8fef-4196-8c3d-c7102982d41c", "comment": "Malware payload", "value": "254c519f7e22846df3cb2a4c90be9340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912765, "uuid": "38e23560-073c-499a-9a0f-10a6026d33b8", "comment": "Malware payload", "value": "e25fa1d0a29eaea8b9a60a2d39c73f147efd544d391a4a4e115df13534226481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912765, "uuid": "8573d051-ba63-4ba0-be55-0bf89e885fe4", "comment": "Malware payload", "value": "aef32996eb0eeb15c7698103cedd2f5c1537f008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912765, "uuid": "6bf59f9f-910f-498f-930f-160685d24eeb", "comment": "Malware payload", "value": "dfd430ef502aee924925d3d68578329a7005632cbd7cd6e6a48056133ef6efd4622611f6b7f0b72065461472aa4a8ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912765, "uuid": "d8fcd0a4-ea10-4fb2-9922-317bddbd4732", "value": "T10993E17291A8C79EDA7FD67076E8D7527D367FE28A70818E2C8412E50F21363976C423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912765, "uuid": "3c37da5f-ae49-4796-bde6-7cef6a94f0fe", "value": "4a6e8d420f7acd5d98f7bfb61b4ca87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912765, "uuid": "ce79511f-de9a-45a2-9743-2888c7e6f1f0", "value": "1536:v6PoP1qYrQxE7nGc7PwiCJGuPDtAQ/q6RAw5/8xUIUWJfOPfVl7io+oY894ffIL1:T50ZaPwiCJztBhv5/Wjt69NpzZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912765, "uuid": "69487b9d-3da8-4b32-8a9d-19d6cd2d6c22", "value": 95200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912765, "uuid": "a95997df-3d7a-468e-8ecc-eb34d3b5d969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912765, "uuid": "56d4724c-63b5-47fe-982f-a27ff2cb0435", "value": "Dienstangebot_E_Alanli_23-03-26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfad779-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912429, "uuid": "87b86a93-207b-4222-b4f9-ac376828996b", "comment": "Malware payload (Mirai)", "value": "020bc0672e2e532bf82d3997ad0a3af0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912429, "uuid": "2c699f0e-9f6c-4b46-94f2-f7e89ca9ac59", "comment": "Malware payload (Mirai)", "value": "e4a6d32addb98d951d353880e05a080fa8cdeda2118b8e7937832fa9417c8e60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912429, "uuid": "3e78e353-9cb6-4343-a0e0-4be6904e7d04", "comment": "Malware payload (Mirai)", "value": "10dd9cf1e4f7c109917a61ff70994eae96e09269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912429, "uuid": "74745b50-37a9-4f90-9503-b13e2ae87937", "comment": "Malware payload (Mirai)", "value": "1260fe20268450ed8973d529ce767fd789e597fbd49d668558385930f044ada6e91d07e3e13b02dd8e5667d036f425aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912429, "uuid": "38c5d6d9-febe-478e-bd60-a15c890c3290", "value": "T1DA53931A2A658FADF76C873487B74E22979933D727E1C644D15CED001FA038DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912429, "uuid": "f6afc31e-3507-4de4-83d6-1acda6e683e6", "value": "1536:9MBsS3xH6nd3uvImjxFM1S6BcLPuOJqf3J3rN:63andevVxFXmOJEZ7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912429, "uuid": "dd6a2fdc-44c5-4f22-88be-a500bf658192", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912429, "uuid": "6e6829ec-5669-4271-ac9f-15bb22c0b37f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912429, "uuid": "b138ae7d-f370-4065-9947-b4fc1a9623dd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb588524-2bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774850016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850016, "uuid": "29897d4b-4717-42aa-8b5a-1b111fe31193", "comment": "Malware payload (Formbook)", "value": "e31bdcf27326df414c107d42d7a6ee00", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850016, "uuid": "18ea3e99-3df7-4828-8ab9-1b65e9c8e3ef", "comment": "Malware payload (Formbook)", "value": "e568bda9bcb69f15cd39108fbd1dff583a26e1a9eb598240abf9c2b14f43d7aa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850016, "uuid": "45f4cfc2-6c7b-4ddc-9466-867451a7c700", "comment": "Malware payload (Formbook)", "value": "f89c514480460bcc2f32bb2d3883016b6eb8a418", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850016, "uuid": "e77b605e-6b0e-4348-8434-74852c61c05b", "comment": "Malware payload (Formbook)", "value": "7b8573a41957e698f572d31ed9578608bb7debb6da50bc7f5a061413f283d805fa9a852259d09c8cdd3de53c4b0913ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850016, "uuid": "ae984be1-dc09-47bc-b96f-3938231f29b3", "value": "T1029502154EC42FB5CFEC561980FE161EA3F05E8E5025B98AEB33BD07BFAB904111B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850016, "uuid": "2ef6bad6-66ab-4d49-9d04-1dc047391201", "value": "24576:8DMN6g8s54MkRfTjNWHGa1tqYvsA83vrcCUgGQG3bsZVRFIvAsRGipX1ueiIa7T:8DUW/ZvQlMkv/RXop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774850016, "uuid": "4e3f10b6-b90b-4040-86b7-e1313194450b", "value": 2028368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774850016, "uuid": "6df6bbf0-75a9-4546-840b-bbd35e21277e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850016, "uuid": "8c5d9376-ceea-47fc-8378-dcd3377c69ee", "value": "TP495909060066.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c96c6f-2c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1774891755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891755, "uuid": "a43365d8-6736-457e-99e9-8a517c3f5127", "comment": "Malware payload (SnappyClient)", "value": "8a598a2521068517f477a19c7d7d3ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891755, "uuid": "d0dec57e-1240-4320-89e3-8f72258f92da", "comment": "Malware payload (SnappyClient)", "value": "e72c98fa431036bbc76060a01631c68db349efeebfe566e08f5e9d3cb163ffc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891755, "uuid": "3306512a-e017-4406-b66f-dddf89efca1b", "comment": "Malware payload (SnappyClient)", "value": "f2f8e98916a6e80794c21209285d58fa9121fdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774891755, "uuid": "73587f70-c8aa-4fe9-9d83-187260ee20e5", "comment": "Malware payload (SnappyClient)", "value": "63d44e08d2f7d20314735a0fd9aa6ff5d78738f269aece4aa080fca99835d01e417c07d00884fc710562d633e3ba90e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891755, "uuid": "40d3b364-3352-478a-9944-eb87e0dbaf05", "value": "T1B126F12974E83729C5B21E389B71CF98B4E5B8057AD6216D7BA41EC44F2BB30387714E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891755, "uuid": "d16f1749-4091-4c1c-b4b5-f827e72dd3ab", "value": "71713e2f4d9b6d74d9b62ced96db4532", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891755, "uuid": "153efa07-6fdc-41a0-a7b7-5a34ae1b8a81", "value": "98304:kkzmxhygTZjXWnc/EDqjhKQ1Agw2DbuyfP:10yMZ4c/EDChhs2Dbuyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774891755, "uuid": "c02d3978-3717-43ba-a216-8e9faec68069", "value": 4764672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774891755, "uuid": "103d9e51-929f-47c0-8f74-7d40d8f894ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774891755, "uuid": "2d6d98fc-c0e2-478f-a9e2-a6c72a1d230e", "value": "8a598a2521068517f477a19c7d7d3ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d769596e-2c08-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774855191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855191, "uuid": "f0f8cbdd-5fbe-4f52-99e0-95edfb910600", "comment": "Malware payload (Mirai)", "value": "4a44b34c67170056d39039d79c97bfae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855191, "uuid": "68094559-3534-4962-9c1a-f68d8d136473", "comment": "Malware payload (Mirai)", "value": "e760a81338d2a7ccaa83a6fcf43f23b05e5c0284410be7d995eed79d43a7065f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855191, "uuid": "7c86956c-2dd9-41a7-8e2c-5572c54c8d5f", "comment": "Malware payload (Mirai)", "value": "49aed310db015c3e0f60526ae1cc9fe75f5b9d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855191, "uuid": "52c280cb-3e0a-4b51-9f9b-edc132b07223", "comment": "Malware payload (Mirai)", "value": "8c179addf5e46483a8c546305e3547056f4f3096afcf85dd49c02b76a5176da29c573ad8fddff9a6068cd873a6c969ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855191, "uuid": "21d90278-9301-472e-809a-344f63a9440f", "value": "T150930846A9429F02D4D621BAFBAF414933137FBCE3F97102C920AF5067C69DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855191, "uuid": "675e8fd2-b338-4258-88aa-f5a457062206", "value": "1536:7InHExxyuXoKfv6AP1wy1pHa08F9SlzDuWTeaNlWSihDn37wY79/nH:xxxpYYv6AP1wy1ha5F9SlzDONDn37wCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855191, "uuid": "f5b86646-4ce3-4ce5-abee-ba937631012f", "value": 89528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855191, "uuid": "411b0dbc-3657-4d2e-91fc-66ec442fc4c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855191, "uuid": "c6996460-7390-458e-ab96-26e4be953d0b", "value": "arm7k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055d9591-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853979, "uuid": "b2d597ab-f9fc-46c3-98cc-b78e5e5564cb", "comment": "Malware payload (Mirai)", "value": "f8103d10be46001dec0aff5187db9299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853979, "uuid": "416ba385-9b6a-47eb-86d8-a342d5a1b9d0", "comment": "Malware payload (Mirai)", "value": "e80e9ba574839296fd62045fa99186dfda70282895d746bdcd805afa043c2cf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853979, "uuid": "132a0d77-9b72-40a9-ab4e-76534d0c7881", "comment": "Malware payload (Mirai)", "value": "30e55f1e10ba463f196b3645e50a9a65d2733188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853979, "uuid": "96bf307d-179d-45f1-9f59-0b4b8cc0be90", "comment": "Malware payload (Mirai)", "value": "1830bad285ed2dc8dc56845d64c0d70ff36caa43d7bbf8d20753358dcb31bbff0e214c20be5c230d9b54481c36d9a21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853979, "uuid": "5955e112-56d1-45d9-822d-a05fa3e6ec27", "value": "T1BA34E70AABA10EFBE8AFCD3705E9170124CC551321B97F367274D914F54B68B8AE3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853979, "uuid": "9daa2ffb-db46-463c-86f6-156fa7a09e3c", "value": "6144:b4HrXbssxRd+m0TpVZSgq4OjEFAjULst:b4H1xIRncEtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853979, "uuid": "d46a7ace-898e-4f18-8acf-e30f6e850d1b", "value": 244124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853979, "uuid": "af50d6a7-fd8e-4749-af0a-1a2db0b3521d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853979, "uuid": "381a54c6-7c39-4c4e-a8c5-2fa0dce848a6", "value": "kurayami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09d8b93-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868118, "uuid": "38815839-f285-48ff-90d5-51ba7c6761ba", "comment": "Malware payload", "value": "35ed3bee3d7e5af15b39ac5d5011e3e4", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868118, "uuid": "f8da7ecd-964d-4446-8812-c0688cdfb393", "comment": "Malware payload", "value": "e84dd033ec9f0cac86976b5d77fc58390aa116ffeb1142bd4440cb19fa79558d", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868118, "uuid": "eee03c37-4c55-48e8-9cdc-64d9b8f496a2", "comment": "Malware payload", "value": "15ec543d2bc0dfaddffe00efa15175528053c954", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868118, "uuid": "27d4efaa-9b3b-4314-b4f7-99099d3fcd8b", "comment": "Malware payload", "value": "a37bbd4265eeca3f82b1d63061860b49ddf7cbf7736c09f9aefbc4083e9400d6b52bf0fa580c941a3d22882fc867920e", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868118, "uuid": "a4b0169e-db78-4687-b6d6-c496b1ccc402", "value": "T13D75BF41FBC241F2E987063550AA673B5F386B254724D9F3D2902D69D8307D2AB3E3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868118, "uuid": "7fd3662e-4628-4eee-8011-ed0365317bc6", "value": "b1261b02d4a2c8e4f9eb10ae02a0508e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868118, "uuid": "54763520-5372-41a2-9b9a-e40b8ae7687e", "value": "24576:Ids6fz/NGWeatHdYr62gs6hgspwqdTT+AJIzCTUrwFVK+q3ZTRv5JrhZm8w6KJaJ:36WS2gsGlnOwKb3Ztzj3SWNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868118, "uuid": "34349003-83c0-4842-a028-9d837a46f839", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868118, "uuid": "351984ac-6bcd-4851-9be5-4fbb7ab4b27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868118, "uuid": "bfd1a447-6ef5-402d-9fe3-5ca31b3ed3e6", "value": "RuntimeHost (11).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6480c481-2c36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774874755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874755, "uuid": "c164367d-1346-4831-9b1a-d26e04376990", "comment": "Malware payload (Mirai)", "value": "bafe25262024e07ea9a663511edee8f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874755, "uuid": "1edd542b-8c82-41f2-8905-51cb91dd0a75", "comment": "Malware payload (Mirai)", "value": "e85e295ea489ab1650f656897ee0fd9d4e1ff1f115b2f6af7fa90eb6e469112a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874755, "uuid": "a06bb01c-1704-4438-b551-6046d68a53ce", "comment": "Malware payload (Mirai)", "value": "6de6e9eff4c1257097c36588be2701e69656ad2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874755, "uuid": "b8a9b327-9cd6-4bbf-b5a3-e2fddd331ec0", "comment": "Malware payload (Mirai)", "value": "403715ddd55b6e891d68e84232b20ac7b810939e81e4a06ff7bd31ea3173f1d763fbd4dd1c69fdd4d4698dbd3c00f08f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874755, "uuid": "70b803fb-6a1b-4a44-bf90-2d0a6519c9b1", "value": "T1CB514EC922D25032AEFAD97373B98544B9A0508735C67E489CEC38F4C68CD46A5C5BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874755, "uuid": "7ab31507-8b64-41e1-8805-f045b74989f5", "value": "48:ipfqfipfgfN4pfxfipf1fapfxVfxUpfxXfxApffOfApfEfapfhfipf4f/4pfnfCn:ixcixiN4xJixNaxxtxUxxvxAx4AxGaxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874755, "uuid": "744bf2ff-e305-4de9-b3bd-e9f6be70bb25", "value": 2479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874755, "uuid": "b521cf6b-4e74-458c-862d-d293034caa55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874755, "uuid": "c8fb7650-07e7-4590-b84e-f294af1b1449", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dbcd4b-2c08-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774855193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855193, "uuid": "41f1b986-e923-4557-91c7-8cc41c32822e", "comment": "Malware payload (Gafgyt)", "value": "5b78d7e945f1978810ff995a8285a34c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855193, "uuid": "148db9f3-c658-4763-a3ca-02cc9489f4e0", "comment": "Malware payload (Gafgyt)", "value": "e87ff6780c00bf117e4fad0bc8389d605550c04ff9565c3a14b0126058eec520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855193, "uuid": "f7a930f1-5812-4dac-9771-b3d1304586f5", "comment": "Malware payload (Gafgyt)", "value": "b3543275ef7732434042a58f05a63293eab66718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774855193, "uuid": "169a0db4-2829-4cbc-a2e7-ce715a7c03f4", "comment": "Malware payload (Gafgyt)", "value": "42032ea57f00424be75a8fdffe8b21ebf0086025f7204fffabde367c979831863ecfd16494cadd5d5e513979b6534ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855193, "uuid": "7516c423-b0bc-4891-9e4f-88d0dfb92251", "value": "T15D83C71E6E218FBDF759C33547B78A21A79833C626E1C685E26CD2011E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855193, "uuid": "fa54393d-cd20-4f98-8d42-87edb072084c", "value": "1536:cNV67Yr8ZLTrEyAlafla8kaXKtZSqiDzLcYeRIxmb3:oV6fZL3EyiZSqyLc6xmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774855193, "uuid": "9708bdd4-2928-4298-8a47-178a556ca0e1", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774855193, "uuid": "73bd88ef-872e-4394-9dd8-e6d5093cda75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774855193, "uuid": "babf4054-bfef-4309-b1a7-266e42136911", "value": "mipsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1d1148-2be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774838101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774838101, "uuid": "7c9ec5c4-635e-459b-839a-ec996d72382e", "comment": "Malware payload", "value": "cda4d3106fcbc1fbc8e5be6b70811b2d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774838101, "uuid": "aa7d9185-36d6-4d51-9924-57862d989fc0", "comment": "Malware payload", "value": "e883b494df1db6b562b93761cdc79c53b2d73ac3b1158f9926621613ce012759", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774838101, "uuid": "8d87d4a7-f93e-42e0-98f0-cf5edc6fcf49", "comment": "Malware payload", "value": "c964614e27a5b421b48cc77c9205e797f2d02d06", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774838101, "uuid": "81f03831-5204-48c6-972c-cc2493b9b2f3", "comment": "Malware payload", "value": "4d4b42ccf044a0ea8add9a5f92503da4d83510fa8be2ad8ced89b9caa68932b545c97c9bbb98cbf9de28dafbcb095b5e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774838101, "uuid": "44e9e6ec-37bd-4e54-a493-46c14533d266", "value": "T156D3C49433FC6B05F7BFABB5AAB010508B36FD729E11D64D0C8561DC2A32B949A15B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774838101, "uuid": "f38da85f-9627-420f-bf56-cc5bf2359112", "value": "3072:CjMD9v4UpqVr14qVnzgJy9bNeslDYyfr:Wwi48nZ9bYOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774838101, "uuid": "7610b9f2-b021-47e6-a50e-4c374cdaacca", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774838101, "uuid": "cd424425-4190-48f2-933c-95e4b846d1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774838101, "uuid": "bfbb05cf-811c-4fdd-a9a6-9a663c0040f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cabc39f-2c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774870903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870903, "uuid": "edbb9597-8620-4d04-a013-47ef3d5c0455", "comment": "Malware payload", "value": "ae01df9a399d6ad1450d0b51549d7eb4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870903, "uuid": "248d91a7-c628-4f2c-80ca-9e050aacba89", "comment": "Malware payload", "value": "e8d5395ed8fb773f0f3aecffb4c0bc964bf1e1b602ecb14651f9471cf2b36601", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870903, "uuid": "350f4d51-9783-4b49-9147-7ac95104c462", "comment": "Malware payload", "value": "a4d0fcf42274a4575771fbead8bb6cb02f77b37d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774870903, "uuid": "0ead6832-8052-4d51-939f-6a9e6ec24155", "comment": "Malware payload", "value": "f9c73ee3e07ff95909af6b1fb0eebcd759ddc91c31d1ad8b1934e52138b62097e0e4e4e450b0ca9a661084be2a124431", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870903, "uuid": "2395bc5a-c511-4fac-b849-9d9cedfcd651", "value": "T1A33168240AE51735D1F28F3A687ADB108A31FD0AF9728F5E11A486981C05B20AC76F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870903, "uuid": "5e31924f-f9f0-438a-9f7e-650f33eb6928", "value": "24:8fpuJ8JnH7UlAZP5J+/5+RXDInlFaDvmEidPtvANOsLlaZStGabWlYqmRv:81JbXZxwP3BhPtINOgkaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774870903, "uuid": "2b48c471-9a6b-4388-b6d5-e2db8a1f3ed2", "value": 1467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774870903, "uuid": "155a397f-6535-4b62-b891-9cd9f0b8f648", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774870903, "uuid": "07f002da-8faa-4302-acd0-d7db0d825605", "value": "\u0414\u043e\u0433\u043e\u0432\u043e\u0440 1120187311701010128000310-7091\u043f\u043b\u0437\u043e \u043d\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0438\u0438.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd79721-2bf7-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774847816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774847816, "uuid": "22565c74-894a-48cb-bf4f-89063fffc2b6", "comment": "Malware payload (ACRStealer)", "value": "83bfe0826fdf3dd5d796e63a711939b3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774847816, "uuid": "bcbff6b6-83dd-480b-856a-d7400f248665", "comment": "Malware payload (ACRStealer)", "value": "e904222262967fdd0d6e618a01dfb21404e5a520505af644ac989f38a8ca717f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774847816, "uuid": "cbd87782-bfca-47b6-a2c4-c394cd8b82af", "comment": "Malware payload (ACRStealer)", "value": "7536abf1358a23a9ed0aaf308ad7d2e34bbaaaa3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774847816, "uuid": "a618d1e5-f681-42a8-b3b5-4451c7c951b2", "comment": "Malware payload (ACRStealer)", "value": "3dc35b9268e0a9d62306f59593a4f9cafdc1d500eea94068eb3696ba47a1a794835b0bebc40e510dba662772c3c87a39", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774847816, "uuid": "55193e33-b4dd-4e5e-be18-a53b36aaa3c5", "value": "T1C2365B0BFCB158E4C4A9923489678256BAB17C451F3663DB3AB0B3641F337E01EB6758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774847816, "uuid": "fb325f67-b39b-41b9-a301-04c38272d48a", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774847816, "uuid": "48781a50-7ecf-413f-8f51-eff031480b8f", "value": "49152:0OAtyC93JAT903VrO7VRDWMqK/c3V6/fExwkde6AFsj0vQYQclAdO9nypcup:0O9u5kUBphvia/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774847816, "uuid": "ec11923d-b758-43ff-8c4a-6db34417ec6a", "value": 4957184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774847816, "uuid": "470e3733-2cad-4062-bf86-4aa17a2ced81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774847816, "uuid": "1b0f8a38-f6ae-4f27-8e7e-66cca88cc80a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.58864782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699d4524-2c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774860160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860160, "uuid": "08803399-3770-40bc-a0c3-56b6efe42146", "comment": "Malware payload", "value": "294ffbbe86b0f28145cae566ea81f52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860160, "uuid": "8ca447e6-e92c-46d0-b58c-5a9e9153ee29", "comment": "Malware payload", "value": "e913b436fe3debd25ed0fa24e84e313f104490be66687a584f9cc15e0b23d9c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860160, "uuid": "72e19d23-f800-4e11-a6e7-6a516cabb392", "comment": "Malware payload", "value": "208df40f867f890dc89ed646b65a62c0f55be9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774860160, "uuid": "1f18c9a5-9788-4baa-918e-01dbee151aa5", "comment": "Malware payload", "value": "3cf8ecff04cc65d54ca077899a5e56253044f3f7bcaa92575c4d939a8de858e7e5bdbdf22541cfb43d2c6174240ec6fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860160, "uuid": "24681807-8fd6-4509-8e81-5466f79999db", "value": "T1CF18338392939442DCB67C709CC3457FE4AC9EBDD2ADA11BD226E50272B0E7B153B361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860160, "uuid": "04622b40-62d8-4379-87e9-d8c59fa81a1a", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860160, "uuid": "1f857e2f-4b17-45a0-8133-3f56ab6a7ac2", "value": "1572864:di7IIuYGoq/gWC+GfLrhkWI7EWHv5UK+13dToezjLvraIfEb07lnxOQy+/3C7:di76qq/gjLrhkWI7EWPOK+1jpcGlnkKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774860160, "uuid": "661960f9-1f9c-4438-b57f-054315e1b012", "value": 92367160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774860160, "uuid": "4b81c8df-8607-45ae-a68f-5f3b54a8ce0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774860160, "uuid": "b18f9ba2-c27e-496b-9d17-e5eb1d47ea6b", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35084de-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909247, "uuid": "5d6106d6-233b-49eb-84d8-4d5349c2d0d8", "comment": "Malware payload (Mirai)", "value": "05f38591f3182dd5870ac19432339a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909247, "uuid": "45ae1c37-1dcb-46dc-8e5e-9b9d9358f993", "comment": "Malware payload (Mirai)", "value": "eaacedbbba3a6ac2b258e34561de392eabc990f0759a504d02e3b19e4a4c9623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909247, "uuid": "479c3e61-6cfa-4e05-8f80-8c0af0b2edb5", "comment": "Malware payload (Mirai)", "value": "1922fd7700eb052749b9a4f084b68cf42592c74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909247, "uuid": "c7e16730-5688-4c57-bd5a-41b8c9f23576", "comment": "Malware payload (Mirai)", "value": "fa8da1b8c82f42cc4e8c412179089b3b5c71b7bb7b8379b489836275029bb7dc7099c4e9f8b164033040e2def401e33e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909247, "uuid": "fba3dc7d-d405-48c0-8531-1e0218b3ad3a", "value": "T15A530203992A56AED511ED7363AC1F0F41229BC2191FC4DF70506FC616B50E8B78EAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909247, "uuid": "b8d11aff-87e7-42e2-bff0-57ff9477d425", "value": "1536:MumfnZknOByaK+jsEW1mGSMne/I0zKYALkg4azHA:5mviOu+jsXwGGI0zKfLGazHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909247, "uuid": "d44a1ec8-7040-482a-84be-ebb03f3f71d6", "value": 64612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909247, "uuid": "906f1074-d038-47a5-bc2f-bfabce79d083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909247, "uuid": "6665df86-6333-4012-b9ce-56a49b91c30f", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35453233-2c87-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909465, "uuid": "408fb152-e1aa-4438-9a2a-59f02426afd3", "comment": "Malware payload (Mirai)", "value": "379e3f9fff946762be17836d0f1463fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909465, "uuid": "656425db-6769-42a9-b97c-6a0bc086d1bb", "comment": "Malware payload (Mirai)", "value": "eb59c0759e97e09d08e00e1816ffae1dfda1dfc19c7a94f8f5942cba2adab7b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909465, "uuid": "4abe975d-4b2d-45ca-a3e5-04ef3b414d21", "comment": "Malware payload (Mirai)", "value": "45e6ce2e6b46ce271967d3d54bc3d5631f283300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909465, "uuid": "d5ac8859-392d-4a05-98e2-8b5d3004d275", "comment": "Malware payload (Mirai)", "value": "c806921449c2f90c787e2ea0fbf890a9c0001ea4be33eadddc2fb317eba15d0a708a72eca3da02fc7da8d65491e97a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909465, "uuid": "620f6ca3-62e2-47d3-b489-cbc38772f9d8", "value": "T19D145A12FB0C0463CA931CF44E3F47F5A3621A9101F99111291DBF5A9A32D77AA8BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909465, "uuid": "6fdd1821-01b4-4511-9390-d11b1c7c05eb", "value": "3072:3I4i3WI31ZoM0YHr8YIVwNWALOSbsrSY7Xsl8TYUaJ:3I4ZI31uMJL8VVwNMgf2Xm8JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909465, "uuid": "2cd518f8-7f11-48b7-8e0c-abb55abd5f4c", "value": 197320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909465, "uuid": "fd2b8501-4cd4-4f34-a471-b15bf09212ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909465, "uuid": "ebc05436-887e-4acf-9942-eef4bb7086e0", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc003466-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853910, "uuid": "73778e7c-8316-4d9a-953a-a543693f40d8", "comment": "Malware payload (Mirai)", "value": "33e4ddac9c1af5d1c75f16055f8e27a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853910, "uuid": "af5cdd97-a996-4ef9-880d-1443e8f7555e", "comment": "Malware payload (Mirai)", "value": "ec75e884f1f7033aed21f3d93c893239c349efba5d799b8d34c67be61c6d1592", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853910, "uuid": "048844f8-50ef-412f-bf6a-f3d502131295", "comment": "Malware payload (Mirai)", "value": "0257d0ec58026eef8200c4ed5842af450330bcbd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853910, "uuid": "8d00e6f5-6862-4ed9-baee-0063ac1e110e", "comment": "Malware payload (Mirai)", "value": "c109ed5b3575d4b4a8ec66b87182ae0355e5a95b90485170e06866a886ce0963d8157bd63644285adb889049b8474b61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853910, "uuid": "25963908-c81f-4974-8e5a-96d3fa81ff1b", "value": "T17563023E531A76A5A9E8E03641468A87E2D7A2BDE17F786D0040C0DE2D5C07B0B5E99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853910, "uuid": "f5937c3a-b11c-4591-967d-930e8866d2ff", "value": "1536:6ZlqTVq40QhRrsw0qakCyaL7zgCHtVnjJ7aaz8C1zE:ulR4Fvow0rkSgUtFcE5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853910, "uuid": "c07db344-d384-47ae-a7b3-cd6440294367", "value": 68872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853910, "uuid": "18562acc-c413-4474-8e7c-10ab24da55c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853910, "uuid": "ab038545-5e2b-4b73-8aeb-48d6a897e236", "value": "kurayami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd969e7-2bfa-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774849214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849214, "uuid": "fddf94cd-8762-4ad5-b8f9-8f1dd1279b0d", "comment": "Malware payload (NetSupport)", "value": "09b56edc178e8352a844697155173f88", "object_relation": "md5", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849214, "uuid": "a8929c9f-b84b-4985-9167-4babedecbd6c", "comment": "Malware payload (NetSupport)", "value": "ed0b26555214dc2af3fa7052e62a55d84b8afa548374ea80f8b43f0f3e746ed5", "object_relation": "sha256", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849214, "uuid": "dd2c1574-01e0-4d31-8649-dffd84cd05a5", "comment": "Malware payload (NetSupport)", "value": "2074dec650984f3cbb18e65bc6f877d289be589e", "object_relation": "sha1", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774849214, "uuid": "5d12284f-9f80-4894-baf9-4edadfbf4a41", "comment": "Malware payload (NetSupport)", "value": "53e647e2d932139f981ae08341eac65e7013ca6ebe1a5e6720b36171fb108b93df12518b8f2ed70d969461de6e8badba", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-87-38", "colour": "#DA7169", "exportable": true, "hide_tag": false }, { "name": "agdosve-com", "colour": "#A34918", "exportable": true, "hide_tag": false }, { "name": "asdasfa-com", "colour": "#5A232F", "exportable": true, "hide_tag": false }, { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849214, "uuid": "53785eaa-6315-46e3-9362-d2fdc2c99aca", "value": "T1F3853340C288ED11A9197489B31572598DC8739B09FE43903EBE89B16E57FE3EB4DD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849214, "uuid": "306ec5b9-77f7-4227-8965-8185645e3c57", "value": "49152:HE20pEa6hlv1tMVpy7ksLRxMgo39tyLUkbzNuY:kYDUVpNMofOXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774849214, "uuid": "7eb438ca-7a15-4f84-a504-2b9ad2c1350d", "value": 1850802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774849214, "uuid": "973207ab-18c8-47aa-b861-7e63067da6a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774849214, "uuid": "79644dc8-f54d-4d12-8425-aa2e82ec9a61", "value": "kqgWNAYv.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1562c55-2bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774850456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850456, "uuid": "833b3262-2c93-4eda-b1e5-c9a81ef8a233", "comment": "Malware payload (Formbook)", "value": "106e64a18ca2978bd15c38eeed938a6e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850456, "uuid": "b5ec1e27-0396-4021-b463-93f3b9b33017", "comment": "Malware payload (Formbook)", "value": "edf43a512bbd4c90ce45a339181ad3f11f8bf091420a49d8913ac26d84767e39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850456, "uuid": "56b22264-67e9-4f12-8dc6-9f571c226e42", "comment": "Malware payload (Formbook)", "value": "eacb62f747ce2e59c46eba8825884c607da94bb0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774850456, "uuid": "10c0b2f2-97df-425d-8d50-0e9355aa896c", "comment": "Malware payload (Formbook)", "value": "042611f9909b68c8197d450773f8dc4c75a2a4ad4a4077aeeb7c27066dd96adbedb03287ed77ace2d24edce130006175", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850456, "uuid": "15803e19-48e1-4a3e-9a6b-c65fbd25153e", "value": "T1036523609B56FEAF96AC4721A17BFE3C17A20F5AC80404C6F4DC11E35BA574AC83BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850456, "uuid": "47e0a942-5ea3-475b-9319-f6f68cdfeb5f", "value": "24576:tkxNqygu+c86zdPo9LrZWopL+pUmh9NEuv901NNqn6ApAwSz5jhs3pqHm:ixN6lrTpKGmGNNnwppqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774850456, "uuid": "c3870c87-82c3-40eb-9c4b-10434026d0b3", "value": 1485011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774850456, "uuid": "172b9684-d936-46de-b911-8c381a8e6939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774850456, "uuid": "0abe5ba0-c387-4a8e-8563-f3e679b61fcd", "value": "ps_Fb6zwsOySql6_1774850076601.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1481a75c-2c06-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774854005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854005, "uuid": "1c3e7fdb-86a1-4fee-b37c-de5887aa8930", "comment": "Malware payload (SheetRAT)", "value": "3551a472b4d5d7962aa569a3ef1bac06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854005, "uuid": "701a7191-cd41-4239-ad8e-5032653eccab", "comment": "Malware payload (SheetRAT)", "value": "ef036cd46e63f884bb90cdc46ca36706edbbbace48fd344a0aa10820c37fb8ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854005, "uuid": "8f75b261-0132-4831-8860-778ef4db389d", "comment": "Malware payload (SheetRAT)", "value": "4cb6ec9c9a6ee080a19735be0f8f72719f152961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774854005, "uuid": "28a866d7-d1df-455e-be62-abaa946b9d5f", "comment": "Malware payload (SheetRAT)", "value": "2cacfc730587c0d66f97c7769a2a75432508ecce9c961ff31ecbdda0dcc9b930b9381dcf530d1d56b5561ae0cc3ac65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854005, "uuid": "364611c4-63bb-4c87-8e72-e5ea1bc6e056", "value": "T18ED4A21CFE81F804DE1A3DB7CEE911005B7165C1AE129646310AAFFD8B663B359E267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854005, "uuid": "014454d2-fb64-40cd-9192-2b6e112f0221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854005, "uuid": "8e84e64e-e232-45f6-95fb-c949fae82d12", "value": "6144:fodGnLw259k3KG2F4JisZrh3e6VlWT8b9JMIUQWuUPAn0iHZAA04bVmbcbp2bDh:fiGLf5sO43NpPVle8otrhi5SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774854005, "uuid": "8d1a9f58-f967-4760-9eef-4b8799d9dea7", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774854005, "uuid": "3d1b7170-c30d-4579-aa84-d688325ab381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774854005, "uuid": "f3708964-dc59-466a-a891-3bf855b910a5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5eec1e-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853722, "uuid": "b2f1c02c-861e-45c9-a234-74772280c032", "comment": "Malware payload (Mirai)", "value": "e19ae62a3cc2b1b3b4acdfa1207f1652", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853722, "uuid": "ecc24f02-f1c6-4840-8652-87cff022a5d9", "comment": "Malware payload (Mirai)", "value": "ef09341b8f63722884ee3697480f77774c8849c30c12d075b5545832619428df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853722, "uuid": "42949a48-29ac-4fb4-bf2f-a91a6031302d", "comment": "Malware payload (Mirai)", "value": "033f30a410e9ff04262310cfc2da7db2dfc11417", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853722, "uuid": "0a91b585-218c-48a6-9962-b76aba63d223", "comment": "Malware payload (Mirai)", "value": "61a72b4dc9a51cd099f59b41689073ab833a6d5c4cca0b2d2e30fcddf30134437e30147c9b2e54d2e9f8237d582ff4c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853722, "uuid": "ed506c76-eecf-493d-9637-f772ac65bfee", "value": "T1AF01D388069314716C8298F359370D4C20C5708B3E4B7DB8752FE8B01FDCE60FA61696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853722, "uuid": "616b82e5-777f-4a3d-a742-532143741117", "value": "12:zq8R2JYZqyQ5loXFbKxa6wz5ArtWFFFFMFrtWFU7ArtWflRLxA1KNBd7sAxUhBZQ:enJua01q45AgFFFuFgFU7AgtRLxJlUhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853722, "uuid": "7744f7b1-a45d-46a3-aa2f-18561f148bbb", "value": 660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853722, "uuid": "8c9c72d1-5090-40ec-ae78-571c83819b3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853722, "uuid": "66561497-f406-4bb2-bcc4-89db0897f34a", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2960f-2c59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774889737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889737, "uuid": "bfebce30-4fa5-4a65-86a6-4972f67a3a84", "comment": "Malware payload", "value": "edc72245181eb8f8c8d531cd1e9299c1", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889737, "uuid": "b4d9a9dd-9b2b-409f-9470-d3e12f1adcb2", "comment": "Malware payload", "value": "f0b1c9654a642746eda12251860fdc8a9292bbd67b95941b31e50bb19ff9ef75", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889737, "uuid": "94172fba-9dab-4ec3-adcc-a3607f7a66ef", "comment": "Malware payload", "value": "13ee51b4255dca94c6343d4ed0acd4af575c7236", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889737, "uuid": "1fe3c588-0101-4eb0-a1cb-99152022edba", "comment": "Malware payload", "value": "424be3c04452bd2bd66e6e09d49344f059ea96b57c50848987ee6aa0e32a83942bdf57ac670a63737c7042c5d2485065", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889737, "uuid": "b4eb1a14-0b41-44ca-82d4-4885e55f8ed1", "value": "T1E8D19D60478B9E2EF486FE702A3087918645C1F832B5E4C744706DB6DCA966ABD7171C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889737, "uuid": "47754bbf-dea2-4357-982c-12e470a5647e", "value": "96:fjGiyG9dCAmC/L9u7xEfuzlkBHZR3FHxfAE23vCdL721WRLoq6yudhbPtbadeGMZ:fjMGn0XEfo8FHNy3KdL79JShbPlIePZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889737, "uuid": "94bc2966-aa38-4995-ab30-8bb70409dbe1", "value": 6741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889737, "uuid": "5a57022b-0991-483b-a870-abd26f6e5744", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889737, "uuid": "985e0342-d8f1-43c5-a419-3c68af48a0c2", "value": "1f29823dc863f3bfa9d6399876db8aa3f1a9dd943e75b7113c4abbcb92677156.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c176f1-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853847, "uuid": "a508d601-a59d-4069-8b5d-e709ce5613a3", "comment": "Malware payload (Mirai)", "value": "8f769c544b5ff67d3431fafab2dcbf85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853847, "uuid": "778ce844-ed6a-4ff9-a67a-03390a6c5f83", "comment": "Malware payload (Mirai)", "value": "f202499650c3e64e3fb73930238ce42ba3e2696a1e40c5e45e98019c6d54436c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853847, "uuid": "f67306c6-9c45-4c82-b54d-7070176068c7", "comment": "Malware payload (Mirai)", "value": "c3df1cc5448110bde4c31803c4f70b8345272449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853847, "uuid": "741b2dac-eabf-4b99-ad0d-88b5d897a190", "comment": "Malware payload (Mirai)", "value": "1ef297e9adde9a9c5d843c60b2056aaa2cb18d1588e740cde25eac84c4cfbf3a102b498d5bb3ca59d7406734bd4ca87f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853847, "uuid": "6a54d86a-261c-4439-89e9-23a9c6dd6d33", "value": "T131042906B5CCC0FDC89AD1344BAFB536D971BC5D023CB25B27C5AE222E4FEA05A2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853847, "uuid": "1acb68d0-47fa-4404-834b-ad93b2d21d86", "value": "3072:lZBh9eWdVFe5uF9Oe1BKTssZ6re6IPjN+gUmcxO+/cztjRlfhjV:lZBh9eWHFeXC6v6q+xV/E5jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853847, "uuid": "997836a9-9c75-4e5e-a7b6-3c4eb8f779ad", "value": 189992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853847, "uuid": "bbf0822b-9ab1-44c1-a7d3-22d9a69e24f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853847, "uuid": "7458a7bb-6a94-409d-a20b-7f3dd08d65c4", "value": "kurayami.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9e47a2-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774868004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868004, "uuid": "3614ddc6-5b35-4b77-87b6-d89785f27a75", "comment": "Malware payload", "value": "295fb8ab0b4e40842c9ac088fc3a463e", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868004, "uuid": "505b784e-e3de-4521-accc-690dc4b72895", "comment": "Malware payload", "value": "f208dcc388d78245b2a2bd7d87309a5ba257585e070b278d797898b649e3e03b", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868004, "uuid": "e61fc374-0696-4183-a290-00a0dcaa723c", "comment": "Malware payload", "value": "eadad59f4a2a4c413f7323891aeb886b738f97a7", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774868004, "uuid": "63cb231e-0bcf-4fa8-a3cd-2d262359aa24", "comment": "Malware payload", "value": "3f38ecbe90096ae2c5f36ab29f86aff01aa9562e8e52ee7eb947d2f1dcea0578e235f63ec5a68422a6d9def519388e9e", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868004, "uuid": "01eb1165-a86f-44db-b636-d3462885f03d", "value": "T153F42346A6C51F36EA80B07DB3AF51D0D48C4C0750992E4ACDB86396EEB6781F397327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868004, "uuid": "5b3f3bdc-c392-4424-b683-73f52778c5c2", "value": "bec9eeadd4e78e2b82a4cb142bb3fe2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868004, "uuid": "ce5a3532-898c-4400-af61-edc5a1931392", "value": "12288:VB6P10eAczcOXmmpKx1LjY5NhfYjxBHzHLA8T1GfBz+bIt+EVq8CgoAr5:T6t0qZmm4x1ubfYNB/A8UpVq8CfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774868004, "uuid": "6ce3061d-48b1-4aa4-b80c-9af1170f7aa6", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774868004, "uuid": "dde672d5-3f87-419a-9e61-86da930538ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774868004, "uuid": "26847425-4e7e-4a7f-bfa0-7a071cb9200f", "value": "RuntimeHost (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d553db8f-2c6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774898566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898566, "uuid": "49cf483a-c8de-4683-8cc6-66e6bf63e94a", "comment": "Malware payload (Smoke Loader)", "value": "8e74633b92c29397b02d0100a7655579", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898566, "uuid": "6c642585-9eb5-479f-ab36-6be4d81c68e2", "comment": "Malware payload (Smoke Loader)", "value": "f546690d185b892ddfc311aa5cd0b710a6ae5e803c3b1b238283fc080277f98c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898566, "uuid": "2f992895-3e4e-4aa5-b0dc-a3afcbb1004e", "comment": "Malware payload (Smoke Loader)", "value": "0592c7fb13aa23051ec3fef5caa5125f6c2ade65", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774898566, "uuid": "202ff1ea-3da6-484c-9b2f-bd539da8f9ed", "comment": "Malware payload (Smoke Loader)", "value": "46781afd3fe530fb49f3906317107e17f4711b81f1e84dc21048fa8f40fe6b7a245db8cfe4269a322464bef6146b1f03", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898566, "uuid": "4f81ac06-a5c5-454d-9867-55ff1d5de81c", "value": "T14F752906BCD108FAD06A633289B755A27B70FC690B3263C72E50B67D3EB66E15CB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898566, "uuid": "50f9e0a1-8ec9-4ef6-a6a7-ff482a90c360", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898566, "uuid": "6c35e66a-59ee-435f-9946-7c93746fa70b", "value": "24576:ye9hTtmNaBXd5YqnJpHb29LPZ6K9nnTCWWrtP2lPie0:ye9ZtmNaBXzYqn329LPZ6qeWWAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774898566, "uuid": "f9b9bfb7-ddf4-48cf-9951-8b545b87a188", "value": 1635456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774898566, "uuid": "b7819463-9e7a-4a53-9551-b3034b2906a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774898566, "uuid": "cbab36e3-c3c5-4ed5-9e57-ee1853d841c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a30950-2c11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774858726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858726, "uuid": "e9ba8b8d-4214-4ed7-ae85-f9be116076e7", "comment": "Malware payload", "value": "803575b87f343a7337795b3928cdc122", "object_relation": "md5", "Tag": [ { "name": "1800-png", "colour": "#B2EAC9", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858726, "uuid": "47062416-f8dd-4a5f-9504-82ca5c15841d", "comment": "Malware payload", "value": "f6e7efd22cca156d6ae9c17018b4bd61b2a5f37a93173e23f057fb73c45b52ee", "object_relation": "sha256", "Tag": [ { "name": "1800-png", "colour": "#B2EAC9", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858726, "uuid": "eace7027-ebe6-48b8-a505-ee5d34fb605b", "comment": "Malware payload", "value": "878e98e9cef1d3aa30c71887fd877c6adb7f25e8", "object_relation": "sha1", "Tag": [ { "name": "1800-png", "colour": "#B2EAC9", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774858726, "uuid": "7145e7dd-0f39-4c66-80d9-970ba3ef7079", "comment": "Malware payload", "value": "506d5ecb296677db757b6c0cb7557cd6c6da7bb8dabe6618334fc7f555fbade4eb0d6e898b75636d455fa31b881afb88", "object_relation": "sha3-384", "Tag": [ { "name": "1800-png", "colour": "#B2EAC9", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858726, "uuid": "9efe44b9-22ce-4424-883c-e399135118d3", "value": "T1BEF0C01EB6CA12C5F864F4B4AD732A737976D99F4018FB7E0F07817044C45C51F59158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858726, "uuid": "39c77017-88fc-4a36-9077-7881af54dfad", "value": "12:5j+17nOktwTbTMJg98vYEPsLTqk036fSu53JOAAhLOSD81RTnOktwTb5rta5:9+5bqHTMy8vYZLn0KaXAAsRbbqH5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774858726, "uuid": "67b524cb-00ee-4948-93b0-f9378d931ae2", "value": 566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774858726, "uuid": "e36a6ac1-0767-4e4c-9f33-f16bdc152587", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774858726, "uuid": "e10d0c46-93c0-410e-9304-672df35dc2d6", "value": "9ed90842177042d6798fafff44197a1127d436006ca35edda90eb6fcaa6c8a8c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50000b1-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909303, "uuid": "3bcf8404-ca43-4371-8c76-c4c495348bb7", "comment": "Malware payload (Mirai)", "value": "e790be70a0bdcad22062dac095d34b91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909303, "uuid": "5dbd8b72-2274-4e34-9d03-32c8f5c8d957", "comment": "Malware payload (Mirai)", "value": "f72b61655d5dd7c7fbb5f08f197aa61bfbc0bc32ee39f52db68049f5b67786a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909303, "uuid": "92fa9f6f-8345-46da-ab9b-5a9eb0dec70f", "comment": "Malware payload (Mirai)", "value": "e6c4360ca643a72a96655cb19490e67f1c979426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909303, "uuid": "a138b8e2-c6cf-423c-8eac-1740ca44d081", "comment": "Malware payload (Mirai)", "value": "5e541dd6bbb35f194062e44a848784efab0fb0a37314bce4ad00fd9b5bcaac511100ecca201d0c0dbe420e00a9aa179d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909303, "uuid": "d94ff44c-8523-4604-b96a-a78acb5679c6", "value": "T11F149D68FE4E7C92D2C7E37EAD460FB275237978D566C0B51A00939EC5EAED848C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909303, "uuid": "6b8691b7-a098-4161-957c-f9d9cbaed2df", "value": "3072:4GM1O4xnY1YLBdCPVQI7MG679OJNJzPxVr:qk1YLBdCPO97Ebfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909303, "uuid": "9493b0be-c19f-4e70-bd7e-f9d75260c504", "value": 197520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909303, "uuid": "52a5a03b-6613-4c7e-8271-06855dfab668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909303, "uuid": "89865e3c-08cd-48b0-9c48-0a9c9ee0bf47", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680a1ebd-2c26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774867889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867889, "uuid": "32dd560f-b234-47ce-b483-25ca61c17835", "comment": "Malware payload", "value": "676db75c6be8c97f8b33fab26d0960bc", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867889, "uuid": "bd87911c-7135-47c6-9246-4ddb36eb442a", "comment": "Malware payload", "value": "f7912a3d9af87e08df8f39d14b22fae25b7a425a1c26e5b41c26655aafe2d424", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867889, "uuid": "46a79bb1-4417-42fd-8db1-65818daa9cda", "comment": "Malware payload", "value": "d8e271d9fdc8de16d4ce0f561263c65eb2caf665", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774867889, "uuid": "b37a3177-1f9d-467f-b39a-97ef7a085fac", "comment": "Malware payload", "value": "dbf3bf22d3106041acbf5982eb1e8ca8334ce28418bcc9d64a54c5673e4bf6d95610ec05424a66d22fe6f65e13956c6a", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867889, "uuid": "0d9f7bf4-c40c-4947-8ce6-3ad34920a61d", "value": "T17F25BF61FFC188F2E692C13451EEAB375E3CA6284321DEC3E384596999201D1673E7DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867889, "uuid": "903f125f-24d6-42b4-b4a1-d9361f89db0a", "value": "57d8142a55119bedcf042524e4de8b36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867889, "uuid": "4376c8cc-e0b7-4c37-a047-68834d32a993", "value": "24576:5gNwIhBzoXzkXHcBAGt9ROaEny06Qf4Rw0Z3/v895eBN:5gNJBzwzkMx3H1wEDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774867889, "uuid": "3fbc7889-8395-4ee0-b521-e1962256ed4d", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774867889, "uuid": "f7aa7495-6f9d-4ea3-85c7-55bd19ddae80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774867889, "uuid": "7df1174c-498a-43bb-9ea3-1ca089f86c60", "value": "mozilla (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbb5215-2c86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774909261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909261, "uuid": "9be7f01f-40d0-40ca-b5c1-3c472b06a045", "comment": "Malware payload (Mirai)", "value": "ea9f614b199a49b10064c9aaf27e3a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909261, "uuid": "a3e92a4d-9b6d-474f-b362-dc3e1e10445f", "comment": "Malware payload (Mirai)", "value": "f93c7d148e76bb7a029130af5bfeeed16c4f7c0eed1d85d3b8d2410dba64a659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909261, "uuid": "97ba6fcc-7469-431d-ac8a-7427ea2df551", "comment": "Malware payload (Mirai)", "value": "9fa67e0023e17889059f1673ff3b09f682df7b4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774909261, "uuid": "7b4a23f8-c3ed-45ad-8d1a-f3fff246106b", "comment": "Malware payload (Mirai)", "value": "de00d8629b190f4992984eebf061877bd38ff7bbba85b4fa6830733696b454cb9d075fb1796e9bbfb8910503a0453a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909261, "uuid": "f1439fa9-aee7-4a91-94eb-920db43a714a", "value": "T13C73028C6CD9476DD6B8A5378148F60149F5C2E3F383860FE2EBC15E24C919FD986A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909261, "uuid": "63f7144d-ed93-4a1f-a661-3ba21a9466d0", "value": "1536:0tEiPGNdL1ITaEB+qydr6a7vYqjWuw0eCWlLGJH5NN:3iPMdJTqyd5xaueCWRGV5NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774909261, "uuid": "6d577cc9-d0c5-429a-8e51-0c4a905ffa4d", "value": 74672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774909261, "uuid": "9d6d3765-a04b-49e4-8c04-02d0ff30bc62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774909261, "uuid": "0e1978d5-bc73-44cc-a7af-4bf2f655d346", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723288c5-2bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774830539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830539, "uuid": "c62ad28b-f66b-47e8-9ff7-2d68f375499e", "comment": "Malware payload (Mirai)", "value": "f225d83b26430e26bd8df7b409b03d6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830539, "uuid": "0435e509-f591-4cd4-a07d-ce02e7868741", "comment": "Malware payload (Mirai)", "value": "f98f9ae6fc927faeb11fa38c4fc8151a619debbe23da9931354466a2d8878b3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830539, "uuid": "e5d9051b-1ac3-4e65-9f86-373b86021add", "comment": "Malware payload (Mirai)", "value": "908042149986c7694a68b061e40fa693b4ae5cc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774830539, "uuid": "6e055dea-1829-4741-aee3-d40f7db041f1", "comment": "Malware payload (Mirai)", "value": "da902a541d6cce5dad1b9a50a47c50d413a5eb4b246fa78e2002e4c6a6f2f1c995a58ac07f8fb623514d2681d78c261d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830539, "uuid": "27bbbdc6-00f3-4dd4-b06f-4f947686e5d2", "value": "T1D19318C6F401DC7DF80FDABB4463690EB631E2611A831B266757BE53AD321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830539, "uuid": "9d65404b-41d0-40bc-ab49-000114df643a", "value": "1536:jsdLEbXJld3puE6tRknqUDP4JX1ougFWSmfBPD8bcjabkH5A2gk0z/z/V4yFKGCF:jbuHt4qUDP4J4wSmfZn2wA9kqzFKGCJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774830539, "uuid": "2edaefe1-5d37-4c96-bd0f-cf40bd95c77b", "value": 96740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774830539, "uuid": "113af2a8-d180-46d8-bf46-7e6e3047484a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774830539, "uuid": "643f116d-d4d8-4980-8ffd-f7c472bd8c86", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edcb7f1-2c65-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774894985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894985, "uuid": "db95b495-d0d8-4d78-9841-9ec892a4c8b9", "comment": "Malware payload (ACRStealer)", "value": "9b6415c3e87607adc239eba14e3ab814", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894985, "uuid": "bb1fde51-f708-4a05-8daa-bb82b790f0e4", "comment": "Malware payload (ACRStealer)", "value": "fa670b1973f600fb77ef2b0896caf26926a6fe106aeb5890c3f303d866c83a38", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894985, "uuid": "22022545-82d2-433a-b878-5a406f74be8b", "comment": "Malware payload (ACRStealer)", "value": "d0718699b49c4df6343f8a3dae8c64ace847fe79", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774894985, "uuid": "51f06af3-889a-4fcd-b74c-28f4df3de2e1", "comment": "Malware payload (ACRStealer)", "value": "1f54925ae3ea3e23ddf982e94a61d81f9d7c4e6d89563b1a32eb5ee384a447182584f4bbb0bf3a03c9943758f45b2dd6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894985, "uuid": "0ca58676-cbcf-43af-893a-7c735275767f", "value": "T145365B4BFCA268E5C8A981348577521AFAB17C491F3163DB2AA0F3651F337E01DB6718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894985, "uuid": "fbaf0031-832e-4377-9fe4-9863d9dfcc51", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894985, "uuid": "4c827083-2a33-4a24-a785-5e77f76611fe", "value": "49152:U0LFNdxeMO7ZjhwnEzm9mvrkNfQ6j6xdQclGfppcn:UKLQhzdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774894985, "uuid": "f0a16cd3-a89b-4b61-9f47-54fa144fda8b", "value": 5122560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774894985, "uuid": "4be71e0f-ce3a-4380-9190-08a83f465dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774894985, "uuid": "d73ab448-6af2-47ed-b6dc-c1c31696ec64", "value": "SecuriteInfo.com.Win64.MalwareX-gen.48994846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ec406d-2c77-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774902891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902891, "uuid": "404efeb3-be44-4f37-863b-1614c34b3c4e", "comment": "Malware payload (CoinMiner)", "value": "5a8bf2df30bb7708557377d7b1400bd8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902891, "uuid": "7ba834e4-fc38-4552-bba3-afb8e1894154", "comment": "Malware payload (CoinMiner)", "value": "fc21a103ecc58048bb6d431cbd4ba89f2c69f97f45ba2c1b0810d657f50c29b8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902891, "uuid": "ce7573fb-b02e-4c0e-9986-29bf462d081a", "comment": "Malware payload (CoinMiner)", "value": "d714c5969c3554b98134ff0c603fec2bf697915e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774902891, "uuid": "92b05a6d-c597-4a85-969a-bec0d81e9c5c", "comment": "Malware payload (CoinMiner)", "value": "7d745c7236e0d1c71ca85e74fb9e5345a0b0f0a3dacfdb66d570f4833ac6488ebc1aee81f14e4adb326c6f65ca98efca", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902891, "uuid": "94a47a74-d3bc-4e6a-802e-17c7ccf4b228", "value": "T16EC533056110E2B6C8CFA8786A6C0FE3799539904B7F8CF31ACAD55932306D5E612EDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902891, "uuid": "d316e140-062a-4fec-aab4-823c33838ac4", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902891, "uuid": "5490ad86-e9ac-4e5f-ac56-b241c680557c", "value": "49152:Xw/w6qbp/Xexee05fyCN5CoBNEZIIODn4Ql7Jo3/BOtKo55jFdUKc6rO:v6qbp/keeaCAEZW4cVo38tKo55jFw6rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774902891, "uuid": "f2c061c1-e01d-4fde-8101-3e192765c0cb", "value": 2733848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774902891, "uuid": "b9dc3f33-21b5-4766-927c-6f61fceb9341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774902891, "uuid": "789d748a-90b7-4557-8f95-e234fb827b15", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ec9faf-2c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774879161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879161, "uuid": "f8042e0f-5a51-4887-a9f3-dfbc69eb38d0", "comment": "Malware payload", "value": "70faaff3c1008c0894e0e7af00455b5c", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879161, "uuid": "7ac6d2f8-0f34-4303-afd5-d9977e3f04a1", "comment": "Malware payload", "value": "fc88b233b5723886758932d74fffd3e58b528b6dfe328c16bec581ecdd452fa8", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879161, "uuid": "3f943112-bb1d-43c3-87fb-8052cb884a2a", "comment": "Malware payload", "value": "ce127a3d58d2e57770fe849842ad64456510280a", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774879161, "uuid": "56e7badd-46ea-4824-939e-3fa4ffc18e5a", "comment": "Malware payload", "value": "9719140ae54ddac67105a952dab9b8bfa5c2433eaa975b1d96ad80d79930c24e22d9b65e4b0888ea007c2b0928fb4101", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879161, "uuid": "cc01e740-697f-48e4-a98d-7482ee35d789", "value": "T19AD1750FFAA112A925C7532D5809544D28EE00BF5E0C1E9078BC8748EF9467CCAF97DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879161, "uuid": "d50d24f6-a574-4fbf-a510-329a99653608", "value": "96:RHlRJNqMdOivavebyZEh2NfvPLvQ0hBgx8/Qh3E:ZJNVOivavebyZlNfvzvrjQ8/Qh3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774879161, "uuid": "429d6d67-3a49-4ba5-bb77-e19bf6bd45ae", "value": 6618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774879161, "uuid": "4ed162dd-f9af-4677-810c-09f2c720ecfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774879161, "uuid": "84634a23-daeb-46ef-bc96-42e152cf058b", "value": "se.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df929de9-2c05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774853916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853916, "uuid": "8bb2de14-0e6d-49ca-9e02-642279cd201e", "comment": "Malware payload (Mirai)", "value": "2ca0a6c2ac82539b2d940c89f1be2873", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853916, "uuid": "06423b4a-4a0d-45bb-a973-96a6cbed53f2", "comment": "Malware payload (Mirai)", "value": "fd485085ceefa78e1c338b510d5a93b8798c7d04b9385abd5632979051ace9af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853916, "uuid": "e26c457f-8f8c-4f20-8026-dff46f1f7455", "comment": "Malware payload (Mirai)", "value": "13007df94b8e610aa9829a4f9f2dfc9c4e62f27c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774853916, "uuid": "bedf9c5a-682c-43b3-9684-19076f086e31", "comment": "Malware payload (Mirai)", "value": "93289c2e88d64f4cf33c5268c23d4da1069943b7b6e2bfb2bc694bad97fd5b32d2b4252d75459c093bd2a33fb3d18f81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853916, "uuid": "b9058044-d5b0-4290-b677-53c5ae50f5c4", "value": "T12B1302D1272117888361EB753CBE702A8538162B32E51E403D97A64EF60F715987BEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853916, "uuid": "59709d1d-78c3-47f2-9762-5a0ca78d5ef4", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGC:87vbq1lGAXSEYQjbChaAU2yU23MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774853916, "uuid": "a3ba39c6-573f-4120-a9a8-d66274000319", "value": 41876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774853916, "uuid": "a97fa904-24c4-431b-9390-4ba1ef26f7d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774853916, "uuid": "600db9ca-448f-48c8-8d2d-15d178987a68", "value": "mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37347ae0-2c59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774889711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889711, "uuid": "cf3221c0-902a-4eaf-a1b6-18b8d76a1e7b", "comment": "Malware payload", "value": "4ecfcedcaff39edc155af03e6fc334fd", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889711, "uuid": "07c1bd74-82e1-498e-9f90-1a1221ac0b6b", "comment": "Malware payload", "value": "fdc8e7126881bcbbaee3168892124fe22d116324f89d323241927e4fe42a2a42", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889711, "uuid": "47345ee8-73a8-4728-a7ba-447eda7fe633", "comment": "Malware payload", "value": "b20afda773d0df33c5fc1430b87837a3b7af8b0d", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774889711, "uuid": "c85cfbe4-a0e4-4a83-aa54-f59d1c3dd260", "comment": "Malware payload", "value": "76d942e64a093a93df012159ae94c44d577ba10c66586fa88198b45db576150d07ccf01eb6502e77bd462d29c7f507e0", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889711, "uuid": "47f3a4f8-e6eb-4add-8cc1-555fd02f8dfe", "value": "T10D412BED9FD06378F09BA4B6C80F17E280B33645709DC67D419D3911B57BE1A39A6123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889711, "uuid": "9a32f459-02e6-4516-acf6-04b273cc9ce1", "value": "48:9HblRGJ1Hsdxpxft1Kx5kX8qIqrRYK8AFYi02OagwS+It:xeDoxNiksMFYddsSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774889711, "uuid": "a564ef74-487e-4611-a7e7-1b74c438dafd", "value": 2256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774889711, "uuid": "83891063-c6d6-4119-b779-6a2713fe1c26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774889711, "uuid": "cf5af208-71be-4b06-a580-abe1955de6b3", "value": "2b273638168f08549c480761a2c80cbd91cf3885dd83d10a45270dcbe5b29abd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b4453f-2c22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774865997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865997, "uuid": "ef50649b-993c-4f65-8671-1cdc2489abc3", "comment": "Malware payload", "value": "022a5cb0f592f447acddca0f7fef5d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865997, "uuid": "7569de0e-3f3b-4965-9311-e9a9c9ac8047", "comment": "Malware payload", "value": "fe045f14341b216640c6c732cf2d5d96eca4a98a61296ca37bc8bb02318ac1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865997, "uuid": "9af90f2a-01bb-4f65-ad01-a3ab64b57fce", "comment": "Malware payload", "value": "a7f296c0897f5a3b6962267cefe2a15aa0c347dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774865997, "uuid": "6b5aae67-2044-4ca9-8d43-7d3005893e61", "comment": "Malware payload", "value": "4ed7669920b1f9e17287d631ecb8111e454179b965aba1f5c139c5843a9f7e069f4b7519bc7a606e5c6418d822e14ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865997, "uuid": "47c98419-865b-4e2c-8af2-992aaa4b69ed", "value": "T10B267C9E7A7E0399D4BBC1B4A6B38197E5317C019B705ACB2384535C2A731F09DEB2D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865997, "uuid": "5dcc9e0a-7f27-49b6-8998-f96e08d5b676", "value": "726ca573e92cd3f2777a240240e4c934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865997, "uuid": "3ed45c5b-56d7-4afc-be3a-7984f1eeb74d", "value": "49152:b65oSpQzhrXJv+opEEUb7jN8Gtu8ZnPFHz6Jz6Jsv6tWKFdu9CzPTvG7spHFhh68:W5gVcVPFHzVJsv6tWKFdu9Czij2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774865997, "uuid": "9cbbf213-28c8-45fc-8654-b591ac68287d", "value": 4472320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774865997, "uuid": "dd8a448c-7b89-4e68-9f2a-788d8d3038d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774865997, "uuid": "085b977d-ffc8-4436-944b-04f403aa548a", "value": "2026.03.30---\u6700\u65b0\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c7e5eb-2c3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774877782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877782, "uuid": "706accad-5e20-4e66-b9ab-2658c1e6baff", "comment": "Malware payload", "value": "6d59433818f1bd3623bf04fe2e3a1455", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877782, "uuid": "d943be94-0ef5-4758-8597-5495974c1d37", "comment": "Malware payload", "value": "fe557842d9c53617a746d8ccc64126628a1972fe796c8ae343b26164bbd0f0be", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877782, "uuid": "dcbbdbf0-99ad-4a21-840a-b19c505f7405", "comment": "Malware payload", "value": "86d8aa167e14d0515e471eaf59f3b1eaf7333fcd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774877782, "uuid": "736dfe4b-bee9-4ee9-bca3-e06c5d5ca63e", "comment": "Malware payload", "value": "dd608431915eae3ac7f1597b2ee9eb970cf7c71132015e7b5bccbf8be05025e7f94ae8132600b473f3147ec6aab3c090", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877782, "uuid": "f0cd0806-1d3b-45fb-a148-4da3369670eb", "value": "T198110253F427835202BE8861C3DFD857F6907053422959A7BF0C91500F316D743B429E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877782, "uuid": "14dc7755-f081-4b52-8862-fe125760f51e", "value": "24:7AQBw2j/0rQkcr6yH0yPvyLaKIZqKUsasq2+TVEeK41:7A8lIs6jyPqv+axG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774877782, "uuid": "556f9226-1684-4c2c-a3c3-aa267dfad0bb", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774877782, "uuid": "a7e9e69e-dd31-4940-8921-ac81f6ef4b1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774877782, "uuid": "b917e3f7-8c4e-43fb-852a-90d6aea48f5f", "value": "ZoomWorkplaceDesktopClientAutoUpdate_7.0.0_33767_x64.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca4832a-2c8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774912430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912430, "uuid": "929e91f1-a21c-436a-8262-433f49c31876", "comment": "Malware payload (Mirai)", "value": "ac01de7aba718d330fb1e6288d556dc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912430, "uuid": "3d8d6986-1afb-4fbf-9a7b-533bf3be7144", "comment": "Malware payload (Mirai)", "value": "fe670335a7b4191791ed95670f5e1fa40560169d5872d8b88d82f09ec9f9d5f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912430, "uuid": "8e6d7e99-9500-43b2-a8ec-20fe1e9fda94", "comment": "Malware payload (Mirai)", "value": "6132f66bb3ceef27609fce605c9a799189ec7ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774912430, "uuid": "f9c40f59-fe4b-4c3c-871c-1fb8dd20d4ee", "comment": "Malware payload (Mirai)", "value": "4c1493d199b33195d4447c9ce50d15a9b86e4fabfd1cfb6037ae58be862da8f70fbf36b1d3e76d8137c95e02179d399f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912430, "uuid": "f2439940-f702-46f7-b785-e0d2ec62d8ea", "value": "T1B7134AC9AA03C0F1EC1112F510775B519F72A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912430, "uuid": "7e30f6d7-8106-41b8-9b75-a6ab2c138887", "value": "768:x73jOIDzzrq7WiEu+R2UjaZEx63Sxoa9d7yvEdjpKMxn:FjOAzwvEub4aZEg0FWIdKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774912430, "uuid": "1fce4625-9a78-48a0-982d-1a7bdbd37ade", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774912430, "uuid": "205ea904-e36c-4cdd-9ae7-8e2500e9b70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774912430, "uuid": "6403bfdb-0546-4519-82ca-e101e5dc4f09", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f207282b-2c36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774874992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874992, "uuid": "03578420-6c16-4770-ab2b-7de159de7384", "comment": "Malware payload", "value": "10071fb7b0a2b0b51fb860aa4e4a736e", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874992, "uuid": "f641e52d-8148-4a24-8d5a-6006f2bcbb11", "comment": "Malware payload", "value": "ff0ac416b776cbfb989d496338a251aff194af81fbc5c53d76f4d122331bbb83", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874992, "uuid": "62f1e12a-93a4-435e-b896-9e57ba51d78d", "comment": "Malware payload", "value": "a113ab0d8e9bf8c2510d44b4c4cef6e9d59ea9c3", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774874992, "uuid": "ea1d3d72-8f79-4291-9abb-4af9bfd06e82", "comment": "Malware payload", "value": "5dc6171589eb32e8d3ce7372094bb22b536b2b1b41d8aa4586fef58301811352259e81baa3f10b1e11ba1147c0224cc2", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874992, "uuid": "c54abee9-b422-427a-88b4-6e8423a0ea08", "value": "T12601940850CE2382E21218B52DD82F31A1C0EABE174800E36827A6E0249B161809B394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874992, "uuid": "baf6b443-2abb-4d7a-ad7b-6f96e2b86514", "value": "12:5jmwxl/smc+2783hqq+r1y59aDDxMQChMiijTPvgmcrhtk5WlVIuHmoiJlC6XoFb:9mwjfD243t+rgaDDxMXBijTY1tk5UIuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774874992, "uuid": "fd852a67-0623-49c3-9aa9-f3e494ee5c7f", "value": 698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774874992, "uuid": "6b1c9000-e215-429d-9610-bf35f4091d9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774874992, "uuid": "3aa93a4c-e579-4d07-a500-bf5f877ad284", "value": "sysmon (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e327d3-2c75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774901793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901793, "uuid": "6579a759-6699-4d57-8886-a47a0a361783", "comment": "Malware payload", "value": "9aef52bf39b81ec1444a4a7e094dd51a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901793, "uuid": "e134ab70-0bb9-4081-91ca-279f4aa792de", "comment": "Malware payload", "value": "ff5d24eed3c7c1be33b9976a0b75d7c986c5ddbbaaa9604c6c2714e80100fc7d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901793, "uuid": "e87fbcae-5239-4999-9ea4-282bc5abe590", "comment": "Malware payload", "value": "9401ae1499dcbda7b98f4ebdbdaecf85af3454a9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774901793, "uuid": "65a4665e-90bd-4eb3-93a0-2f7f6c0dfd35", "comment": "Malware payload", "value": "68150a3604c155736826b6e05d7fa66b23b5dd467cbc34d0ee2cb6829634629a28e21a450c346d0535e35b1906421857", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901793, "uuid": "6ea285dd-fbbb-4664-b17d-5a772976cb1f", "value": "T11221CA81DE766514D703C778C1C6ED058881136B0B9A37AFE53CD8817D10AC0FE02E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901793, "uuid": "51b730c4-9469-44ba-b842-7f2b1964494b", "value": "24:9Upa6W5XlNx1EoBbGjIHi36wa1MoUn4lOAjUMdZM/rh:9Qa6WbNxqodGwhLROAjUvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774901793, "uuid": "28e85238-be3c-4aec-acf9-ccec51d1ef2d", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774901793, "uuid": "753bc8ce-dc5b-4e33-9528-48db834b5f1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774901793, "uuid": "7bfc9596-0d74-4239-b94f-6355d25388d5", "value": "DOC_kjPxP6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }