{ "Event": { "published": true, "date": "2024-03-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-03", "timestamp": 1709510581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ce902f4d-4475-4cdf-a53e-7e7114d7801f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84b338f-d933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709452719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452719, "uuid": "df5b183a-8893-4514-92c4-e20993fbc8b4", "comment": "Malware payload (RedLineStealer)", "value": "8cdbc72db59e94aaa9a9819490ead89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452719, "uuid": "0842350a-23f0-4046-9619-8ada10698b06", "comment": "Malware payload (RedLineStealer)", "value": "0440799536260c4fbf3fb98b341dfbf06f5ab75c4e8d7e04127b337770e20684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452719, "uuid": "f81f8a69-a9a7-49a5-a6e6-d9d286583884", "comment": "Malware payload (RedLineStealer)", "value": "776ee5fed9333ee59549c9844ad1a2e2321619ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452719, "uuid": "6840428b-1945-40ab-800c-a7540903393a", "comment": "Malware payload (RedLineStealer)", "value": "0049e5bacb407cbf575d2d66cccaef3e9a26f67277ba414ed67fb41c33d1d8face1049afff35a07326d450cd1e9b0c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452719, "uuid": "bac4e43a-cbfb-4354-b72b-2d1f8e43172b", "value": "T1F6A4A73FB0453316DE7B28F0C99DE5548625D8F83A028A6757132B3AAD1FF807EA154B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452719, "uuid": "955524ac-0a18-492f-887a-6f5ff9061872", "value": "f427f7e2d298a968a6955e590f98f31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452719, "uuid": "0953fba8-b77b-4a97-b16f-9727792e7128", "value": "6144:ovuOJWo+Pt9uj7F93V0flM5gUICGALWzN5gtWHUHYzoQnW8x3A+0KMlPhJkbWO43:ovuOJAu7BlIk6rnjx3ALKiPhJDO46Ba5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709452719, "uuid": "8f4904ef-c384-4db0-a98f-0cfecc4d1296", "value": 488008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709452719, "uuid": "30b72f9e-0034-44cf-9447-2f627d81205a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452719, "uuid": "83f6971b-68a9-471a-aa38-b6858da301bd", "value": "Protector Inj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5886ccc5-d9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709499319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709499319, "uuid": "92238e69-ab89-47a7-afff-6aade6feb5ac", "comment": "Malware payload (Stealc)", "value": "aba5f42a0fa310741a691ccdcd48ce6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709499319, "uuid": "834a4d61-d7ea-4df8-97e3-5a70aebc274f", "comment": "Malware payload (Stealc)", "value": "060e2fc8ebdc81deb2d610728f6bb21736eb4daba3c95c227fbf36e677f39a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709499319, "uuid": "9829fa32-e439-4faa-b5c0-2ed708070a0b", "comment": "Malware payload (Stealc)", "value": "dab39422f0c7e69ca563db6348fb09439a6a1018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709499319, "uuid": "193232cf-baa8-4dfe-be91-b6ea2d01c116", "comment": "Malware payload (Stealc)", "value": "4b3f1ff5dd56d06c891c5fd6776efdd2822d5bd7f8b6b6895db5e668db80de6673e3fa3b3f94d94385df34797e77af63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709499319, "uuid": "6ad76717-9a9e-4e4c-b8b2-483e94f2b043", "value": "T13A162332A1614026E7F201B7FC2C95303E7DE728575488B9E3D89D2C6EB44962BFB257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709499319, "uuid": "8304ff57-83c3-4049-a343-5fac6ec40c91", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709499319, "uuid": "ea8de25e-bb08-48f3-94b5-a1a7cc2c1582", "value": "98304:8fUbaq5en+41qGsiR31QvkCHGDCHi1601/KqS81V7Iz/ih:8fUbe+CqO11QvkCHdHiAPH81VcOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709499319, "uuid": "3c4d92a2-7b47-4a4f-8824-f529c82aab34", "value": 4274694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709499319, "uuid": "427eaa4d-ee8b-4000-8b99-98590c1b6ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709499319, "uuid": "84cc93a3-334a-4871-9df5-19d85e56473d", "value": "aba5f42a0fa310741a691ccdcd48ce6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3b15fc-d94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709464696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464696, "uuid": "1ad5df6f-2ad2-4f02-8d75-d39b2ec0da1f", "comment": "Malware payload (Mirai)", "value": "aa8dcc1db225d6c7e67d490846109810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464696, "uuid": "e99e1921-cea4-4674-98bd-667a5f929540", "comment": "Malware payload (Mirai)", "value": "06f2e6504b1953035aabfc8d9782800e77591599e6f36e543a042da1a7dc8dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464696, "uuid": "11ea4c04-63e9-44b3-923a-25649f9ce4ac", "comment": "Malware payload (Mirai)", "value": "45fa1a88ed79b3163ff4a32c97f1a2e704fc33f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464696, "uuid": "8f001332-463b-4198-8330-139022a7e3ed", "comment": "Malware payload (Mirai)", "value": "558d527d7c02550393b46c91568fa7ea1a30fc95ddfc9e6b4ea29de922beccb5b1d7d9881a43bace272140befa34247a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464696, "uuid": "ae0cbbbb-1a7e-42a6-8487-9be15c340383", "value": "T116832A9AF400DEBCF88BD6BA41664D0EB930A39016920F377767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464696, "uuid": "742246da-ee1e-4813-b7f6-e2a2759dc017", "value": "1536:qLf0+QM5PHyVwi7f2UUiEy+DlOo7ZL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fd+DMKSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709464696, "uuid": "c59d0103-2c1d-48c4-ad07-9c7aed6ae45d", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709464696, "uuid": "1b9e246b-4011-417e-ae4f-b9588620239c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464696, "uuid": "6d0fb16b-5a6a-46f1-93e0-3cb2551f3653", "value": "aa8dcc1db225d6c7e67d490846109810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbeb3046-d962-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709472911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472911, "uuid": "d7dc8180-caf3-4d37-83bc-e95cdc012cef", "comment": "Malware payload (DCRat)", "value": "93839c239e47b2f789f21df88d7c4108", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472911, "uuid": "ba6757e9-cfd9-4c75-8a6a-295f941b11b7", "comment": "Malware payload (DCRat)", "value": "087c9cdb646257b5d47ec47a40b95dcb8c9980de98e1f504252a0d8e77262c99", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472911, "uuid": "3bb7f5f0-1a29-462f-b721-ba8b37e2836e", "comment": "Malware payload (DCRat)", "value": "d6a581ede39e87c28f557cb754d4153c7461e179", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472911, "uuid": "cb105458-803c-431b-8a28-20ce7b67acf2", "comment": "Malware payload (DCRat)", "value": "87191323d7384a4e69d8f469917d87cb3c9dc25ca50fd64f47484bdc6f2bd4fcec7ed8c7f66f72b55f903b1341be2020", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472911, "uuid": "cb64c6db-d1a8-46df-b509-a0e1bbe139ec", "value": "T1EC06F10665964F33C770173185A7423D8290DBA27662FF1F361F60D2A94BBF58BA21E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472911, "uuid": "088d758b-0d83-4c2a-aac1-be84787c479d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472911, "uuid": "74e15dab-2679-4e1b-a9d8-16c96ec9110b", "value": "98304:Z4vlOAuppKN4eSHhofI0UuPMfNK7Q1MFLQ:Z4ke0BRGMfNK72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709472911, "uuid": "b8e910e0-6382-412d-b748-d74413616272", "value": 3701248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709472911, "uuid": "ea490008-b863-4386-828a-358fa5783cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472911, "uuid": "ffba3256-d54d-41d6-a14b-7c559da1704b", "value": "93839C239E47B2F789F21DF88D7C4108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dc1f96-d953-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1709466197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709466197, "uuid": "35cc4616-9c38-4c46-a4a4-b14be01b3e06", "comment": "Malware payload (DiscordTokenStealer)", "value": "dc63e2868844077c7df67f07e44e2dc7", "object_relation": "md5", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709466197, "uuid": "4f553c3a-ef3c-4e91-958f-240cb2b17899", "comment": "Malware payload (DiscordTokenStealer)", "value": "09088616a44d681566729b31770e0d38e048c6eabd8014dab241a7de67072de9", "object_relation": "sha256", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709466197, "uuid": "5931baa2-0229-4816-afef-30c840508e0e", "comment": "Malware payload (DiscordTokenStealer)", "value": "f7f9993311221ab88cab798c7b93119f489e4e8f", "object_relation": "sha1", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709466197, "uuid": "3735d36e-1518-443f-9d14-cb937e0ccd21", "comment": "Malware payload (DiscordTokenStealer)", "value": "61847cfa829aecab3701005c2f25ba9778f5565e7232b3eef5a4e39a4b300cf380e5df7917c6c63341b8c3f1c0c7b20c", "object_relation": "sha3-384", "Tag": [ { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709466197, "uuid": "383887f6-220a-4142-94d0-f31951e3cf65", "value": "T1C8869D03F85555E8C6EAD2308A358352BA307C994B3037D33B61F7B92A73BD46A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709466197, "uuid": "0ba29fd7-7d49-45b5-8020-2599aba5a69c", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709466197, "uuid": "5442646e-ed52-4a29-a49d-9541f67cd323", "value": "98304:gm3dsa/tnJtIhQnE+iN4cKflz2Sp7zcmksIG7dPQrl:FPnJtI/5N4cKfxj7kVoPsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709466197, "uuid": "e008a1bb-1f43-4693-947d-7b4172fcb280", "value": 8454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709466197, "uuid": "fd2a15f0-5886-498b-80de-13e05f14f929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709466197, "uuid": "6bd71621-1d94-417d-869b-b78ce2ec547c", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc5095f-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465020, "uuid": "e82dc66e-1500-4e9a-9277-55aaf89eaa5d", "comment": "Malware payload (Mirai)", "value": "78d65f30b1b94133a49d005a7453fad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465020, "uuid": "d6bdac17-17cf-4034-9562-7ea950bac06e", "comment": "Malware payload (Mirai)", "value": "0a2cb373cc0ddf354ba60e8a0f200299ba1d6b0892aebf5905b0150e94276304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465020, "uuid": "1285bf57-66ae-4c74-86a7-0c179d9bbb41", "comment": "Malware payload (Mirai)", "value": "f637d4f94373a7ca2c1a8b0a9c95bf33bdce9c17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465020, "uuid": "77cc3ef3-e3c7-4615-8927-e4a77cbb3dff", "comment": "Malware payload (Mirai)", "value": "71d15244fbbb82eb7a4668098d1e8cbf6ce4fc971789923639029830021678b043e6f0f6c21f9677cc01c0c5acece19c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465020, "uuid": "c386409b-7798-4df3-90b6-693782b721b8", "value": "T15473B70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465020, "uuid": "7ad429e7-9c9c-4d8e-b24a-8d222126901d", "value": "1536:3IHb8FMv77EKQHlySR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyIFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465020, "uuid": "bdba9bd5-e3f8-4f41-a248-c11393ec0449", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465020, "uuid": "9aa4dbdd-a368-4517-9e90-a4c96c3cc9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465020, "uuid": "07cb934c-88f1-4db1-b78d-a4e289bf747d", "value": "78d65f30b1b94133a49d005a7453fad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aebc8f-d9ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709504871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504871, "uuid": "2cdf1d9f-aff3-4f21-a0f2-23a4fa1011ac", "comment": "Malware payload", "value": "bd98e7c9ca771be14cd9229bc1636732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504871, "uuid": "2cbd641e-d1b6-40df-a814-4db3261ce34a", "comment": "Malware payload", "value": "0ea2d73e47b8642b24371be112fb04e455bc8577fa17911bd17793887cedeb7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504871, "uuid": "0aacc911-0ed7-44e8-b6a0-313b5155ca26", "comment": "Malware payload", "value": "4a4723378eb0268f4659f1b1d3f2be5f74e20b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504871, "uuid": "ec4861fe-8148-45ec-ac08-9cf4ce6d06aa", "comment": "Malware payload", "value": "da8ac88845fa4f1a31646b7716df9fa1fa6d10732e3b35cbfe4c42a900eeee7d98a69226742b39cbd5839fb9b0df3444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504871, "uuid": "b43a5640-5e7b-4326-ac80-8620915427b8", "value": "T1FFD419037BE058FED1D5C970474BD1A3A934F8864163353F3A95AB402A7AE309F6DBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504871, "uuid": "967bacfa-779d-40d6-bedf-f084765580cc", "value": "12288:vNr8EGmp/etbb5E/QiXnn5J7tE5IavCilgG1k:+mEtBufa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709504871, "uuid": "4323ca52-35d5-4df6-85d3-a9c0bf315236", "value": 644992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709504871, "uuid": "45d2e884-370a-4231-97d3-255ca189349f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504871, "uuid": "10573dc0-0cf9-43b9-bf00-1b1e1a546d63", "value": "SecuriteInfo.com.ELF.Miner-KX.9484.23394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a06caee-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465016, "uuid": "1c8eca78-db1b-4877-9461-cd5e21edded1", "comment": "Malware payload (Mirai)", "value": "4c50058ef716a59abbd432f18933e55f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465016, "uuid": "3586c251-77d9-4a24-aedf-41654ffc1bdd", "comment": "Malware payload (Mirai)", "value": "11a268e56021ba5ceba480cfe3bc057e4a699e8bb514a7420d6dbd36563f15b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465016, "uuid": "3c627196-2345-4804-bde7-ce2bdcf40305", "comment": "Malware payload (Mirai)", "value": "4bd3e6ec90336758869292cfa9956b61182286ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465016, "uuid": "224c0889-b9a6-41ec-9b81-fc3ef3379891", "comment": "Malware payload (Mirai)", "value": "ab48eafb18d1535f3bc7fbeae9edaf99e7b5e05f4f23a6e266d78e5dd6ea0828fbfa43c5b3f0186e323aad5735906fa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465016, "uuid": "d127ebfc-be44-4e4d-83d3-5c644409ee88", "value": "T184833924BC391E27C0E4A17A21F7C722F2F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465016, "uuid": "ea8632f4-0b7b-42b8-8c21-d59aa58ab871", "value": "1536:FrWZnHJSkunDANOJpkKJ1+fUH4ZtNaMCcz75ZXbtAR:xWZQJ04CftUzczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465016, "uuid": "dc2bc4d1-1d56-4472-a438-7e96234d838b", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465016, "uuid": "f4ef0d2a-a512-437b-8144-3abe0c05dc9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465016, "uuid": "ef2d0332-ab26-4418-a6bc-ccb0cbabc034", "value": "4c50058ef716a59abbd432f18933e55f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7e44d3-d97e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709484782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484782, "uuid": "e0308b5f-446d-44a6-a6d9-04bc978b17e8", "comment": "Malware payload (CoinMiner)", "value": "532a5d365c76aa04dfcbeabc7af0f7c5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484782, "uuid": "eb382feb-db5a-464d-9e55-af43a71688b6", "comment": "Malware payload (CoinMiner)", "value": "12ec4ba0eb6c327c01f4b7f9e85a398df8ed1f98e85ccff9f31054e632a35767", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484782, "uuid": "93af07ab-ffdf-4d03-a259-edc520ac991c", "comment": "Malware payload (CoinMiner)", "value": "6a5367293e02d806b44847ff9274157bb30aac72", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484782, "uuid": "f3323ef1-94b4-4d91-b73e-109f9bb468b2", "comment": "Malware payload (CoinMiner)", "value": "f807d53cb12f7725ede1d5cbc4cf7ba5b37cc54e8e58253c6c8c01e341ece6e2262ecd508de84e427e10f8440e765257", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484782, "uuid": "91cd39b8-e893-45ac-a3c5-ac9a2573da39", "value": "T15D7533ABE08F12B5BCB8E177F10764952B51F2C3D99ABF6E03E02355E45C4645CB20B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484782, "uuid": "82f1c40b-c04f-4b49-8c25-216f05aa2f77", "value": "49152:ErqFJhG8CwyjASYMihF0YHoxTHpQV40Se:xFJ8jjAVP0YHoBpXve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709484782, "uuid": "395f90dd-716b-40e7-a1b8-f10e9910de8a", "value": 1592188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709484782, "uuid": "9a4f44b8-bc0b-4b23-8f37-a556f437938b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484782, "uuid": "f7e67857-147e-4237-9405-9289f8bc221f", "value": "redtail.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9edf0-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471101, "uuid": "b2d77a06-9071-4785-bf82-25eccf334541", "comment": "Malware payload (Mirai)", "value": "f302a1aa77e1636b6824867810938897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471101, "uuid": "e84506cf-37d7-4bf2-8b99-f9523aa47521", "comment": "Malware payload (Mirai)", "value": "1397837534d497bd6fac944f9a9e001d2b0aa462685c3b4377fa46a791f697cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471101, "uuid": "e3ccae27-a4ce-4918-b43e-283d581141e8", "comment": "Malware payload (Mirai)", "value": "673d49d11500ae22ecbd7797a970515d9898d72b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471101, "uuid": "d1f7f92d-6682-4fe4-b9e5-de792a57d35b", "comment": "Malware payload (Mirai)", "value": "31d14eb27636fff7ac1969608f24331d1ab765f8743e2cbe527b08a27dc8ebc09b646f1dfd87793c10735fa4c4ebacca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471101, "uuid": "0fb9a505-540b-4eba-8aec-c3e6c522312b", "value": "T14643FAA3BD10FEBEF40BE33E84C34735B630BA5645931562A76778A659363C4341AF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471101, "uuid": "cf458cda-b966-46be-9c51-afabd67adbe9", "value": "1536:KDndjsR8835Lga8X8k/845TxBcgFac6FQ:L8s3OjB7c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471101, "uuid": "44ed55eb-c5b8-4c3a-a0ce-ea0f0e905b90", "value": 56266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471101, "uuid": "7e8041a0-711a-4dbc-94aa-cceea6ced7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471101, "uuid": "f3aec056-bdb4-429e-ba24-0f6a4187b541", "value": "f302a1aa77e1636b6824867810938897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c88351-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490327, "uuid": "3f2589ea-8c03-40ce-95f0-f98a88594f5a", "comment": "Malware payload (Mirai)", "value": "320f974074c2707e40eafccc2b742c3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490327, "uuid": "5f00bc79-7cf4-414b-b586-884681ffd2e9", "comment": "Malware payload (Mirai)", "value": "1460c7e4d65af956ed85beffd667dfeffa92979f29767c3cb44ff6c8d39dd193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490327, "uuid": "72564ad3-a36c-46fd-a802-d2e5481594d6", "comment": "Malware payload (Mirai)", "value": "c7dbb042849bca231d099afbf3002c11069bb576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490327, "uuid": "059b3da7-04a5-4dec-889f-fa41bc76af59", "comment": "Malware payload (Mirai)", "value": "0ae2a01016c1b43c4a666cb7c3c69c837ef326e13b640a48df303c1cead6a1050da6e9c970b052d1897b8b5b596bd45b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490327, "uuid": "a58e5a9f-a597-47e3-831c-92822c5d03a5", "value": "T1E383C74E6E219FFDF668833047B74A21A75933D623E1C685E2ACD2141E7034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490327, "uuid": "f587af26-39c2-4fcb-a8a2-2df8ea143a3f", "value": "1536:5APT64PwDlzJ2YDbfIlPXcbtF5qFRedS/FhWXCeWtcTMU5iO9:5gTzPslDIfcbTewJM+N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490327, "uuid": "a3ee8077-6462-43e7-ab05-64dd4bff8ed2", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490327, "uuid": "67676b96-5c54-4676-8eff-231dd8646d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490327, "uuid": "51cfd63c-df32-45db-aa57-17412e0ccda6", "value": "320f974074c2707e40eafccc2b742c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6d3a6d-d986-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709488379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488379, "uuid": "667c44b5-84c7-4c6d-b284-48f4ea223c79", "comment": "Malware payload (AgentTesla)", "value": "5c98322d94db41ccddd29461bc1d5628", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488379, "uuid": "754d2d01-0cca-4394-b99d-32144e0b19f2", "comment": "Malware payload (AgentTesla)", "value": "16737e459b8e53d9f640cb4ff3d4f29476660c4391b30eec4653a2d855dfab6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488379, "uuid": "bd35235e-5bbd-48d5-a0f1-e0bf637c478a", "comment": "Malware payload (AgentTesla)", "value": "37e1f6ed71484884076021e8a36a3d38377a6b01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488379, "uuid": "a8a76149-85f0-4390-980f-2efe4c7f6c2f", "comment": "Malware payload (AgentTesla)", "value": "8fd1bed69d02e8ca36cdf625ce14108d00299e1bbb2fbb779ecf9ccb7f5a4556f96b430df72b2b27b5279244f5c46c2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488379, "uuid": "c6c3fb9a-8192-4c0d-9919-2a7bd0329615", "value": "T1EEE4236A7B9D452FC56F04B69964C1C2CBBB131B5234F9EE0D9592B8C8437C9839C83B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488379, "uuid": "863cdf37-1e14-4d46-b068-628c14f9e3ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488379, "uuid": "fc5b5ad6-e1f1-46da-9c40-18d877c6f9ad", "value": "12288:ovzScVag0JZxISZBNrOLUl6fzfWnMtdtEPsM5nR1OduJ:0zSOgxIgxOfTWMvwvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709488379, "uuid": "8e0e8a0c-e931-42f3-9d47-41206e75392a", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709488379, "uuid": "3f53f56f-8f25-4c1b-8786-15a6d0898be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488379, "uuid": "16fff460-19a1-4aca-8d71-ca6ad231ab08", "value": "gsLrPNKzQQjKVVi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9984b429-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709470652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470652, "uuid": "b8c92e90-2d9f-4e07-9186-b0b6ff42f3fd", "comment": "Malware payload (Mirai)", "value": "559c2497174fd32a9bcb145a65420692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470652, "uuid": "8798435f-ce98-4146-9abb-f3131e03bea3", "comment": "Malware payload (Mirai)", "value": "18437aee12ed64359bdff62b2a5d50a8188dd04bf7b4fb4f1d3197297aefa048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470652, "uuid": "aa8e40b6-6273-4b0b-9911-435774ad99c4", "comment": "Malware payload (Mirai)", "value": "7fb1a7aa51485b7d8225f92d9157390112772833", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470652, "uuid": "eae0c125-246e-4346-a487-a37e88916e66", "comment": "Malware payload (Mirai)", "value": "121e77ba4cc97d6ddd6973c069e70b19b8a036262eb194e8db9b77f22923377d570c70363a22010f232d7923a18a6951", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470652, "uuid": "6080134a-e5e5-4b0f-9f18-8427d19d5d59", "value": "T1A023094AF643C6F7CC570BF10297B9AB4231B929AE620D5BE31C7DB8E7539887016361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470652, "uuid": "81e143ad-5307-4779-abcf-8c742c351a7d", "value": "768:7n6C8xTFA/nrx49FR5FZFJHBmd/z7nq3VO+ilO65LzBUgvw7a21eZbFW:7FTx49FpZF/UzbeVOxO65zBUgL2uFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470652, "uuid": "08ccfb6c-13b9-4b85-9654-06e8980570ac", "value": 49873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470652, "uuid": "72578645-175c-4b6b-ad38-1446506ea9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470652, "uuid": "4c18f2d9-5fdf-4e5e-a22f-811ef966f339", "value": "559c2497174fd32a9bcb145a65420692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5eb580-d920-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709444617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444617, "uuid": "a5e3012b-5b68-4625-998e-86261df6c0a5", "comment": "Malware payload (Mirai)", "value": "aef86930e71c474b9d403249e9c89def", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444617, "uuid": "bfe5e546-8a33-47e1-8e24-8b8c91c82151", "comment": "Malware payload (Mirai)", "value": "197662eeaa9a2163f31dabe0007150336ff57795e5dc4134574b55f386e21339", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444617, "uuid": "60cd6ace-870b-497b-b54b-bcc6a9e89ef3", "comment": "Malware payload (Mirai)", "value": "4d7697ef1615516bcfac648f01ba2d3b5f6f4e44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444617, "uuid": "a4f6c1f4-8213-494d-8183-abab91d44621", "comment": "Malware payload (Mirai)", "value": "4096645ba78eb177df9f2972d18073235e2a308c2780c35dbee6c2a8969cf4baa3961455932247414a4185e05857c659", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444617, "uuid": "d8c9bba9-f11e-4584-bacc-d9f6bc7702d5", "value": "T17B731956B9819B21D5C112BEFE1E118E3313077CE3DE73229E24AF20778696B0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444617, "uuid": "c0862b14-7d5d-407f-a4bd-be5c252a6818", "value": "1536:Zyniv226lniqteJ4UxQa5IGEQnMWiLicmoa0w7OS5ZYGI9:Xv56liaUxQa5Yicmoa0waSjxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444617, "uuid": "a535c511-25c1-4f32-879b-91a389b0749e", "value": 75668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444617, "uuid": "b396d421-3837-45fc-a13e-b684acf3f703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444617, "uuid": "f466edfd-2efb-48f2-87f4-7141f41c9374", "value": "arm6.nn-20240303-0543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9ecedd-d900-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709430608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430608, "uuid": "e1e70104-1978-4f3b-9dcc-4e5275ba37da", "comment": "Malware payload (DCRat)", "value": "0433d45f1a3b187e7c917e997c923028", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430608, "uuid": "6b7143df-b55f-4a62-8bac-81920c93a3fe", "comment": "Malware payload (DCRat)", "value": "1b881d8c3ba53e9b250de6d1118a27738fd8e88fd475e3e01afabd4e627f83a2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430608, "uuid": "e4194ed6-9680-456e-a9c4-a149860f95ce", "comment": "Malware payload (DCRat)", "value": "9fd30e675bde471d997cb6c724df217179d319cf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430608, "uuid": "b982d1df-cf32-4a92-a8f4-444c174acac5", "comment": "Malware payload (DCRat)", "value": "07284c0facff3b2234828ae0043cc68046f8fd988245bd8678a23cf9b77fe68f6f563f50703fa56484f82359ad10ac8c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430608, "uuid": "d7368e29-339d-4514-8a16-1113a4c10a81", "value": "T1DF453322A3D3F9B2C5798A361B0F7570D619BE49C1357029B9D38B2F854031FCE649EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430608, "uuid": "eb7b186b-1ace-442e-9387-9990e47c1ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430608, "uuid": "21fad0b7-0b8d-43f4-824c-5bc130426a18", "value": "24576:QRV6h2A85yTO+MxjGhiANcjPPbnGnPcUcPseGO3G0uLz:Qf6a5yTyBGhAjHKUFGAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709430608, "uuid": "261a080e-afff-48cb-9a83-042742210f56", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709430608, "uuid": "f386df9a-251f-4c17-a812-4079dbeb318e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430608, "uuid": "8109c071-4306-469a-bdc0-e9e3d0157f0d", "value": "0433d45f1a3b187e7c917e997c923028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e3ac7-d905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709433022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433022, "uuid": "6929b2cb-53f8-48f1-a473-5a37d02a9584", "comment": "Malware payload (RedLineStealer)", "value": "3f630f50c12e0fe6c702803627028e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433022, "uuid": "46ef00f5-b1b9-462a-a7fd-585a3b2ec58e", "comment": "Malware payload (RedLineStealer)", "value": "1c418da72750c77e0d3328392dfe0e476aceffae63c345d29db09fce5fe0897e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433022, "uuid": "c9cfe9a1-6f6a-4b22-9840-0ae3243d9fe2", "comment": "Malware payload (RedLineStealer)", "value": "59d5b2c03a797e3d9e7fe48f13b2d5772d4237e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433022, "uuid": "a36220ae-55f0-48d9-ab2f-b29afcb42e39", "comment": "Malware payload (RedLineStealer)", "value": "d6a76c70a0a62fcc1e33e5a9dcf8e6911dcc05e1562e640a558a568400edd4ab238891764bdbe43a735a6019796c9324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433022, "uuid": "3dcb7a4c-954e-41ed-a6c4-7696362500d9", "value": "T167E533B9BF60A595DF8C0076A4DE90E57D4C8E028FFEC8C9758C0B9933D7B816784A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433022, "uuid": "c14e8fcd-c2f1-4220-9d6f-7164e5682311", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433022, "uuid": "802b0fe7-fcd9-4aed-8f6a-87eaea5c567d", "value": "49152:oiG73cTSbsYwKdh+zOV6izs2Xs0CGIUfGLqDKegbJbtIypVN:LG73+SbsTu6iz/Xl1IUOCKegbJbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709433022, "uuid": "69c16197-728c-4484-ba1f-034d06017de4", "value": 3099706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709433022, "uuid": "651b962f-9d39-47be-9c27-23bd38da9b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433022, "uuid": "0f7124ba-23a8-4989-8933-9e2aecb9a511", "value": "SecuriteInfo.com.Win32.Evo-gen.18720.2409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bd71aa-d921-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1709444787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444787, "uuid": "e4643d12-3a52-4976-adaf-fb3aded68c0c", "comment": "Malware payload (Glupteba)", "value": "cff10b1823ef198c4f8571539a54f58f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444787, "uuid": "7f9ebee6-eb0e-48ea-8b8d-c43b948e9573", "comment": "Malware payload (Glupteba)", "value": "1e750e4de75ed0e592725b1e03c2bfdef0e62eaee04cdc4dd139edde2148e551", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444787, "uuid": "de38b4bf-4c87-4f73-90d8-f323830c5174", "comment": "Malware payload (Glupteba)", "value": "8c4a80af458861ae4228fff7cb3c9e11c68b2b88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444787, "uuid": "7ed33385-2e6d-48be-ba83-d4385973ce72", "comment": "Malware payload (Glupteba)", "value": "f597e73780e3aca2b423d42d995c8fcf93ffdf51fe157c2d6fb1c864587f5cb77bf5ac36b7f6fcf7b60ef217a1793c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444787, "uuid": "7c289946-a6e6-4aa6-8037-17d3498874a8", "value": "T1661633123960C036FA66D030CD6AD7E086B678A1D7189C137B0CAFE95F3328655AFE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444787, "uuid": "bcc266e9-8c88-4aae-8dc4-d6b3f21f69e8", "value": "99a932f0cadd6d26123940658eec1af9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444787, "uuid": "931114d5-7c1a-401b-8184-9d1bedeb6215", "value": "98304:rF7fKd4Pcj1x07dk3n/9a1UJpezGk++zu28SAxLOSC8:rVExx2aw1ULoGkn18S0CSC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444787, "uuid": "8d2ac5da-efd1-41a9-b10f-42010cd67896", "value": 4334984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444787, "uuid": "0728334a-174d-4f35-a27a-1c4902ab3119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444787, "uuid": "2c591111-e76d-49b7-9cc8-b56f3686e0d3", "value": "cff10b1823ef198c4f8571539a54f58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a4b50f-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709490476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490476, "uuid": "7c681e47-936a-4454-9e8b-85042649dbb7", "comment": "Malware payload (PureLogStealer)", "value": "2fa8c24b42f6542a290d85a9a3723e2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490476, "uuid": "d04bb7c2-b8ab-4414-bc7c-9e3313df98b0", "comment": "Malware payload (PureLogStealer)", "value": "1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490476, "uuid": "5697f15e-e42d-4bc9-9134-77a1c02db948", "comment": "Malware payload (PureLogStealer)", "value": "d7a518d0d6eae7732a59c6a7c397f0777d111255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490476, "uuid": "14429253-0999-4294-afb0-c4ede4dd6598", "comment": "Malware payload (PureLogStealer)", "value": "ee62d6ea70214d6432c73cc48431a09000db83d42c1f39ffb2b18474eb8b983740c439c49e692b9b987ce6b6927d35dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490476, "uuid": "e8575218-ca19-47be-b6fe-8828f3423fe8", "value": "T182649E548297C933C79C4B74E4C6E106A7FA4247B402EF4EA07C35D29A163D2EB53A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490476, "uuid": "3a610b42-ed40-4d02-b6f7-e8b89594cf00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490476, "uuid": "91fc8c44-a007-4f51-94c1-2a3227787f49", "value": "6144:3eY+jinF8jE9sKKegRcd2cS8ADT+5amtQuicddRp:fJf5vr9AuYOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490476, "uuid": "afe8ad86-00bb-4f0c-bb88-1e8fe6205a36", "value": 336520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490476, "uuid": "4c09b07f-2350-412f-8c22-93bb4de8d35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490476, "uuid": "b3c7558b-104b-493c-8ac0-70847a60cbb0", "value": "2fa8c24b42f6542a290d85a9a3723e2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a73a45-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490349, "uuid": "f23d293b-a6cb-456d-bcfb-6e6bb137f271", "comment": "Malware payload (Mirai)", "value": "fc08a705275e4fd7f7a1404c53d0524f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490349, "uuid": "8b70fb38-9e72-4255-94f0-bc26836199ee", "comment": "Malware payload (Mirai)", "value": "20a934c2448d90a74770e2f18944db2169d2d4596ec1637dff2e1c282e3d0d2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490349, "uuid": "442630a2-844b-45df-8e5b-26500aa7adcd", "comment": "Malware payload (Mirai)", "value": "a53991a2ee967ef097c622980ca34a8db6a2a17f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490349, "uuid": "a3245069-0ffe-4325-bd6e-0e3709ec9ffb", "comment": "Malware payload (Mirai)", "value": "b1cdfcf5267e416f0d70f120e7ddf78524deaa7b515e3615aee6526873b27713abf96a7d60c3de7b9fdd601f9e598803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490349, "uuid": "0da09252-0cb6-4b03-885e-9e065ee255fd", "value": "T19E83D506EB610EFBDC6FDD3746F9074225CC954B22A93B3A3674D828B54B24B0AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490349, "uuid": "e6a324ba-12ed-4744-8b95-78c1d1c762f6", "value": "1536:Fg6ROCfQ3fmeA/Z/vUp/cib4Ky0d3MPZk2BxoBuW52OHbFfRdDi6Y:F1ROCfQ3fmenR8Z06PNRYfRVpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490349, "uuid": "5afab58c-1d4b-4e20-ac0a-2c4c89992314", "value": 85956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490349, "uuid": "a04310f6-baf7-410f-aed2-78c39bd54d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490349, "uuid": "d66966a8-63ee-4ede-870d-06631f307434", "value": "fc08a705275e4fd7f7a1404c53d0524f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ace44-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470683, "uuid": "d7c590b7-f307-4a04-a89f-26a714b4a71d", "comment": "Malware payload (Gafgyt)", "value": "e166087b14bdb4f0595b8d3fa6c1ccf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470683, "uuid": "4c0f583d-b8ab-4b8b-b5b9-db7e0e8bb242", "comment": "Malware payload (Gafgyt)", "value": "20b0b9ea77feff421905625d121b21257c5431f49ba2b6411787c8d7984dedf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470683, "uuid": "b572317a-f836-4283-8653-f72761983bf9", "comment": "Malware payload (Gafgyt)", "value": "b53efd608705c2376df57ebde3fb3a2d56ac6c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470683, "uuid": "4cd573e2-42b8-4880-8a11-d7bca306dbfa", "comment": "Malware payload (Gafgyt)", "value": "6c8ff8d9b43c2bb51b38dd685e46b65919685fd562f15e88a5f9bcdc84ea8ad41d37371b7a30b7d54f806a678fd11df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470683, "uuid": "b8d67fe4-12ba-469d-a8c3-0391d2fe1d00", "value": "T15E931949D103C7B3C4430AB151DF5A8A1722FA664AEF49A6B71B3FB49B13AF53106F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470683, "uuid": "ea3d401d-b2f0-49f8-a256-75561ca2a02b", "value": "1536:yY39lMYalPi3ODYvPKyWQ6nRlEwscCnMCYeZALe5hdpxrl+bPM37K8PN2UrYe:J9JalPFEPetnRpsJMCYeYe5hdUbE37KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470683, "uuid": "4723b2f2-a801-47d9-8137-7972e866dfa0", "value": 96131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470683, "uuid": "de0c7d4e-e0b4-4ba7-8588-f5b9bed4ad87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470683, "uuid": "8108e830-f7e3-4612-b463-a5f0446344fe", "value": "e166087b14bdb4f0595b8d3fa6c1ccf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc42727-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490312, "uuid": "60e1f313-2e75-4792-b4ab-74a644a08fdb", "comment": "Malware payload (Mirai)", "value": "cf68b07652f4e2043201ad71f74771b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490312, "uuid": "8122616e-54e1-4d82-ae5c-418e9adec921", "comment": "Malware payload (Mirai)", "value": "219658667afd35e2fe3f3f7876dbcf70fa9d7bfa3a13df745edc665ee70928f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490312, "uuid": "bf3ff852-8e8f-4811-af4d-cc01afd35578", "comment": "Malware payload (Mirai)", "value": "fc799bc6230d339c0b6221d5a1bc0688f0a3e75a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490312, "uuid": "7ca0ad37-22ef-4f68-ac99-463e5990cdfb", "comment": "Malware payload (Mirai)", "value": "41564d46cca799905290fa15ecf520ff16ea92f06a05ee8cc6a343ab3a0b112c4c6d862055986e6f03db3b544a8740f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490312, "uuid": "08fc99c6-842a-4e6f-96d2-ad35fecac5c4", "value": "T1037329C7F400DDBDF80ED77B4457050AB671A39216830B366797BAA7FC721A81922F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490312, "uuid": "cd86c627-84e4-475c-9889-da1d73a0c69d", "value": "1536:IAWY+4W4k7VBIiKlHly8VVcsG9nkPgP0JvDrlrTy11eHg/Z7iH:I1N4WJIiKlHfr+koPoNy11t/Z7iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490312, "uuid": "ac6abe71-3692-44cf-bb99-6bd63fa6f2f0", "value": 74796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490312, "uuid": "dab7fd18-1ed2-4f08-8104-07db0fc5bdff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490312, "uuid": "553eb26c-18f7-4622-a720-f2d7b07b5173", "value": "cf68b07652f4e2043201ad71f74771b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384fa55a-d914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709439136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439136, "uuid": "deb4987b-9d9f-48a0-b229-7d2901af90c2", "comment": "Malware payload (VenomRAT)", "value": "29f127851fff4d296c91aedc30b1aa4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439136, "uuid": "aa7f48a5-f75d-4c88-9fd1-19f0e1e330e3", "comment": "Malware payload (VenomRAT)", "value": "28ad6e97a9428581834835d6b18177af24f884aa29b6670b3c8fedd11fc34043", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439136, "uuid": "d3a71ba6-7fca-450e-b453-fcf884e0d0b2", "comment": "Malware payload (VenomRAT)", "value": "6bbf47e4642f83ebe9e40bcffb60925124ca7f43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439136, "uuid": "8bdbb62b-d1d1-4a20-b017-56258e1a4ff9", "comment": "Malware payload (VenomRAT)", "value": "c9dce451ad0447d2f3a3480dc83fd376ea0b894ead00948a9cbd77ee28d61a3f5e578a952f2a4d499761138f9d89abcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439136, "uuid": "206c36f6-7462-45d3-970a-88c2f1127803", "value": "T153734A013BD88D26F2AE47B9ACF256074EF4D5576112CE5E3CC800DD9A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439136, "uuid": "5c5d027d-bcb4-4972-85a8-6ab50800fbc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439136, "uuid": "4b5df5e5-733a-4607-a719-50ef6005f23f", "value": "1536:uUB6cxwGLZmCN7PMVvFZLatIlH1bD/z23rQzcBLVclN:uUQcxwGtma7PMVvFZLaCH1bDLgQYBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709439136, "uuid": "546ce716-994a-49f4-8d12-87f4f09525e1", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709439136, "uuid": "45b2bab6-5f37-43f7-b981-dede3dd99bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439136, "uuid": "3bfb5d95-6eea-4b89-bbf8-d87e8d49a174", "value": "29f127851fff4d296c91aedc30b1aa4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7b6d5d-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470707, "uuid": "700945be-164b-4452-b179-2c50ea34327f", "comment": "Malware payload (Gafgyt)", "value": "65723177014ca21b99c3256000e0d71e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470707, "uuid": "da059384-e500-4d83-ad35-8f0be355a7b8", "comment": "Malware payload (Gafgyt)", "value": "2aab0918710e87642fc932c2b444ab09f7ed1d7e6ce6ed7e81f0f38cd868504e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470707, "uuid": "6e8b7567-fd7a-4400-997f-9fcbe3bf7246", "comment": "Malware payload (Gafgyt)", "value": "4df45d9315fe494162c806d517e3176b4c3f2c60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470707, "uuid": "58301f31-5f52-4db6-a0ad-65c4cb9fc2f4", "comment": "Malware payload (Gafgyt)", "value": "939fc297bd41635214d886670ebf2bd630c114fb507c3682e37845ab9bab4177f26c7c03244dc523c72eec12062c4009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470707, "uuid": "678baddf-d15b-4bbd-b013-4e7dcc6582fb", "value": "T1F2A3180798625A77D005597136BB59302B36B9611F4F1ACA6D6CA6A047CB8CFF00FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470707, "uuid": "c7b9e263-cb5e-4e4c-951e-a316ab674cd5", "value": "3072:pJpNzUmFAyrmN2vdYOEFtrI5h+cauMufnK7uGiSUKfM:ppzUmFA8W2vdTmrI5h+cauMufnK7uGi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470707, "uuid": "146685b4-3fd3-4b50-9705-4868fd146591", "value": 103392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470707, "uuid": "072a30d9-4f02-40eb-81fe-a3eb873500bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470707, "uuid": "3456b314-066c-43b4-955b-5bf9c24f8091", "value": "65723177014ca21b99c3256000e0d71e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6623ce-d9b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709508159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508159, "uuid": "6b72746a-292c-46fa-8ac5-521cbf22313c", "comment": "Malware payload (Adware.Generic)", "value": "47ffc2d4c1d245c0389a35c239330fb4", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508159, "uuid": "0332eb43-6e44-4a74-9b4b-25a53e89c613", "comment": "Malware payload (Adware.Generic)", "value": "2d186f5614d371744ff1d63d9b5fd7ede2f3f9dc1e64ec9660686965c2cc3007", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508159, "uuid": "f76bfdcc-f972-4ca6-a080-8aa077f144c3", "comment": "Malware payload (Adware.Generic)", "value": "0caafe722071e068e501c2b601260fb0b99c3034", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508159, "uuid": "3abfe045-d413-4596-8f36-951e42d8fdaa", "comment": "Malware payload (Adware.Generic)", "value": "48af1b057ef8921f3bb3e78188e92551239546d9c056821a53f8d039558659350993abb7c10f171d430457ed3beffd81", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508159, "uuid": "e24f2d91-ec66-4101-b1b6-51c3a0331c9d", "value": "T1B8F6333FF268A13EC49A1B3305B3935099777BA1681A8C0B17FC785CCF765A01E3A656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508159, "uuid": "a3b10308-e918-44da-be7e-7f96fdbf6b36", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508159, "uuid": "3b34f9be-0bdd-4517-8015-e6196d676f01", "value": "393216:FH0C7CB5lggkV58j7oS7Mngv3Bvieo9dzSddRL:Ff+OS7Mnpe6ARL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709508159, "uuid": "612ecb54-2e7a-4bf0-b66d-5d6541a04a6e", "value": 15303704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709508159, "uuid": "a8eb68f6-95dc-40f5-828d-5780e3ba8b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508159, "uuid": "454f4a20-7446-451e-a4fd-2db396dcb9de", "value": "SecuriteInfo.com.Trojan.WinGo.Agent.13789.28985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfc91ff-d921-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709444806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444806, "uuid": "74f8a7af-0733-440c-b526-802b7e2db9d9", "comment": "Malware payload", "value": "f3fec7e80dc6297092e4c2731489e2e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444806, "uuid": "a9944a48-ede7-48b8-bb32-5ece2ffadc1f", "comment": "Malware payload", "value": "2d98c72f5c8a7154f3d5b9a6edb0e7a8ee8ca8295cc28862e3822319e7ef759d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444806, "uuid": "7cf5fdfa-7ff6-4a5b-9f22-bcba9d1bb8c7", "comment": "Malware payload", "value": "7f8d3793e0ba072ecdfe4c57599210b885f610e3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444806, "uuid": "7581b862-7a83-4d46-aa2a-31a46ebf89ec", "comment": "Malware payload", "value": "a90d29e0eb7f5c742d0c16c1c952bcd8a2f2f9df6d04d1dafb3d1e1519d2a73b707f74b4a0547e1d7a7756961a56e1d2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444806, "uuid": "6d811784-cb25-49b8-b09f-eb710dd004a6", "value": "T127E027D0A7552B83D0971C71517593B3C95F407911547E5E101F5D115FD38B04588F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444806, "uuid": "823c5539-06e6-4686-b73f-c1b8e7f392eb", "value": "6:5j8z8AzVJyMLbpIcu9imeF3gel5iGCLJwFAD2lGzatBzVJyMLbEt+lRlX:5j84G8MLbmcu9ipRn5i91la8WR8MLbEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444806, "uuid": "68d10ab5-e383-4c2b-a2fe-759c58910f52", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444806, "uuid": "1056fcdd-5e23-4da6-90b9-50f9fc2aba8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444806, "uuid": "518ed395-17df-4eb8-b0eb-a197720fd2fe", "value": "f3fec7e80dc6297092e4c2731489e2e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc9b814-d8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709428914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709428914, "uuid": "6951bf1f-efdf-49cb-88bf-94a8538e70c9", "comment": "Malware payload", "value": "26d379214430c68b0241a59a6b381cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709428914, "uuid": "644a71a7-3a70-402b-bc1b-591079556ae2", "comment": "Malware payload", "value": "2dc0751d66d4ff6ce3ff5d7f1805e6244b3f8b55aed844f830a4b34560bd11c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709428914, "uuid": "0612e080-dc8d-4f7b-8cce-4b607eb3c83b", "comment": "Malware payload", "value": "4274eb710625463e2db651c7d48b31286be654b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709428914, "uuid": "10fbb019-8612-42e4-b670-440f30b2e1dd", "comment": "Malware payload", "value": "7e25606801e034de94c04e0e482b55c5e3d4864de1e105f3e9ad8dae87d93cbf94297089c2ac624edf5acb918d7f28cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709428914, "uuid": "3252a43b-878e-4109-83df-ca2bb0760f19", "value": "T1F2B341897190B1DEC467D131CA6A1CF4BAD42C7A939F4303A917399DAE3C897DF140BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709428914, "uuid": "9803a698-3ae4-4216-a394-40b91e5f7c74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709428914, "uuid": "193a0b29-2e5a-445b-a9c1-e7c92f074223", "value": "3072:5PazTB6gXGEnFGFlkEM1UZU+MqwV4UWH3JLSB79Y:5QT9XGEngFliR+MqwV4UWH3VSp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709428914, "uuid": "3cc81d7d-866b-40db-a98d-ace7737f2a25", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709428914, "uuid": "938a5461-3fef-44e2-9303-7709896de5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709428914, "uuid": "bfe768db-17f5-4a62-9cae-ffc85aa1bd17", "value": "SecuriteInfo.com.Trojan.GenericKD.71649191.3944.29153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51149fc-d986-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709488361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488361, "uuid": "644ea43c-9522-413d-8eae-1e87b97bfa38", "comment": "Malware payload (AgentTesla)", "value": "a7365af0f093ece07ca4c574b2b877fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488361, "uuid": "25b9856b-78f2-4ba3-9e8b-cfe5fc2a98d8", "comment": "Malware payload (AgentTesla)", "value": "2e91f164c90f6e11220df79a2d8e43d0ac1771b5f9063a270764e4ab005daf8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488361, "uuid": "26c3767d-5fe1-40ae-af45-1022e028382e", "comment": "Malware payload (AgentTesla)", "value": "e9174ea168f0e68fd0e61aac48282112ad7eab12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488361, "uuid": "b561c223-1510-41c7-8329-2cfd5ba6c09c", "comment": "Malware payload (AgentTesla)", "value": "a6bd3ac0ca03ad844e85ac9b2d7e2125ea6ae2702532dc9fa359b94430a76af73843d9ba6fc72f9b9d113e23586c4b38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488361, "uuid": "032a7099-e274-4646-9adc-baf22e656df7", "value": "T15AE42339F3641A12CC3F74B4DE34813447FA668E978ADB7C6E5C83B55AC9BC054C1AA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488361, "uuid": "fbec1898-13ab-4eda-a650-834c958b76d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488361, "uuid": "2da8462d-7e8e-4f9b-93e4-f491234a2ba6", "value": "12288:hpzScVZFrWbOMqb8/k2+En2rijpl2UECkOvqbA1sbgbkvJKNOO:7zSOZFqbJqbkkxTidElw1JqKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709488361, "uuid": "59e9bc00-f9e3-4f7b-a3ef-c33c571f29c2", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709488361, "uuid": "ccdc2424-51b5-43a4-90c6-cfe9d985dccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488361, "uuid": "14d32797-e451-42fe-b358-827b84c1e00f", "value": "a7365af0f093ece07ca4c574b2b877fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3eee05d-d986-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709488386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488386, "uuid": "f7052959-ca80-47dd-a9b0-6e99b4e0898c", "comment": "Malware payload (RemcosRAT)", "value": "2d511bea8226ee5f43746fdb0c8c4582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488386, "uuid": "9533d09e-6b1e-438e-93bb-cb39d9f29546", "comment": "Malware payload (RemcosRAT)", "value": "2eac9d5d5fdb79b5eca2dc7fb9641415c871f5d1e49510ed9b4a62e533e44927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488386, "uuid": "861f4be6-9d94-4908-8542-ac7444a6d102", "comment": "Malware payload (RemcosRAT)", "value": "7b7598bcfa0189ee7858b998519c6b5e6f6bef24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488386, "uuid": "fb238d68-ced0-4d69-bfe0-9ff1b360c480", "comment": "Malware payload (RemcosRAT)", "value": "71f79eea74345724502e1e7503a844782f192a45d873c0a81f52f083665f83bb1e72db97c7e6c539cad13daeaf3fbed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488386, "uuid": "8b694c3c-7bb2-4b31-b2ab-d22191a8a30c", "value": "T1A1252361710CD023D5AF4E3D6C2228D15A78F0CB3618D7EE5CD7993EC6C3B0595A2AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488386, "uuid": "b2a3bcdb-9607-4464-a2c8-347376ee366d", "value": "24576:1I5i5a14g+OCEZNNJVQSfBxpZfCP+V5OJxn9+Mdt:K0vg+OCE1QCxpkP8+nTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709488386, "uuid": "6e88f49a-236c-44eb-bf35-091fe95314b4", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709488386, "uuid": "885b1fa3-52f2-45aa-bf93-eae724184c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488386, "uuid": "18215486-2567-4ab0-81ab-c9a7b4d4a686", "value": "2d511bea8226ee5f43746fdb0c8c4582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2049e56-d926-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709447098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447098, "uuid": "94efce69-a360-45aa-93d6-b4298afeaf93", "comment": "Malware payload", "value": "fe23fd85580fbe6fdc826563b625f24e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447098, "uuid": "f7bec496-40b8-44a0-bdc5-8c0faef7cb81", "comment": "Malware payload", "value": "2f5c232e29f0f78558fa733aa94b88972f158b48ddd422d3567630217f5d1c7d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447098, "uuid": "e56dbf1f-ab9f-4862-adf1-8308c6e1891c", "comment": "Malware payload", "value": "138a81cb076acbe7afac214adef3ce69a2614dd7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447098, "uuid": "70a7dd1c-f1bd-40b9-abac-cad903c3638c", "comment": "Malware payload", "value": "9d7e37a512165925a6e9ef8cc701165119cde640fe79697c61e5432295cf4f23add0d4ad2a75fd9ef1383309425056d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447098, "uuid": "80e19227-b520-43ce-b06d-2ab34497d75f", "value": "T147B72282EFA8D81DF977D07E8A75D266C4880D02C952EB53351AF21C6AB76C04E0DBF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447098, "uuid": "38fa237c-11dc-4ed6-aec2-212acbfe5971", "value": "786432:VY0Dt1RMH487rSCed1e6e8YemyVRysxK3ev6GouYGozCN3eo75qoPG90EyNlaJ:Vft1R8CpXOyuyKlXuYXzCxVqogx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709447098, "uuid": "5471111f-63c6-486f-b0e0-c5797897e57f", "value": 49204534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709447098, "uuid": "577613fa-8f50-4449-8430-9c0aca09d0fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447098, "uuid": "17b6456c-4fed-4ac1-9814-650a2cd1a2e6", "value": "USA-TV.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c1051d-d96a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709476169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476169, "uuid": "d6a67078-b31e-4e98-8edb-df8c5d0ad664", "comment": "Malware payload", "value": "2204cba332566d808353f256bd211595", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476169, "uuid": "88cc8d00-71f8-4f1b-b739-ec7faf9e9a34", "comment": "Malware payload", "value": "305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476169, "uuid": "fc204e5f-4f3b-4860-aa61-5986deebcd35", "comment": "Malware payload", "value": "8da4d578601335c86a3c0b432d37011da316b6cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476169, "uuid": "1ccab520-48fd-4617-97a9-1f83bf8f7c9b", "comment": "Malware payload", "value": "cb0a4525736f912d5f4831c4e969abb600fe9e8de97e3c6b83db8862304a16767040e1e437930fc2717e650ba9151557", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476169, "uuid": "ccbbe3b5-5ecc-4975-b157-d110da580e1e", "value": "T188537C10A3DC1E03CAAF4FB8B46141210BF0EB175762E7DB5985B1AA5BC2B811B553BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476169, "uuid": "281c622c-3366-4acf-95e6-76a56b15776f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476169, "uuid": "608c849e-ed7d-4dd0-870c-d9452ec31f53", "value": "768:z23A2DSSdh1uT+2r2tNQNyYMDuCxrb2E2EHLi6o2LjN+/BvSKheYih79CYih79pg:z8PDNhc/rU/h2EZHFL6vS57h9C7h96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709476169, "uuid": "2adb660b-49bf-4347-b172-c8372ce6fe84", "value": 63856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709476169, "uuid": "06adf2fc-b7b5-4493-91bc-71e8629a4396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476169, "uuid": "c9793815-a3aa-4234-94fa-1869ae33f731", "value": "SecuriteInfo.com.Adware.Downware.20073.15011.9774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3247b91c-d914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1709439126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439126, "uuid": "a4b55af7-5eb2-4cc5-b885-e5e157ace4f7", "comment": "Malware payload (MillenuimRAT)", "value": "60788d9aaf351fd3d262b7465df7b8e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439126, "uuid": "8c1cd6bc-8d40-4a96-b24c-f6c97456a261", "comment": "Malware payload (MillenuimRAT)", "value": "35b5f1ecbedb1bd24453420b7e34d743ea9af6cde269eaa20be9ef81775de6e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439126, "uuid": "f8cb96b5-cab7-474b-ab31-509577179f83", "comment": "Malware payload (MillenuimRAT)", "value": "c69d189f0c68b6d937831e5cb4df543426a89aa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439126, "uuid": "55baeb76-8969-4e4c-a42a-b0f787876f9d", "comment": "Malware payload (MillenuimRAT)", "value": "5d4b42acbb0f8dc24477e0acd22da26e9635fdbd7a2a494d75a2722d8488d6ed5eb1104691f890811f9738ab231ab34c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439126, "uuid": "43063dc6-4e1d-4021-9e89-95e5199cb672", "value": "T1ECC533146BEE494AF07E9E7898B3801842F5F951BF30D74D4A82608D8972B81CF61FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439126, "uuid": "a7e27653-0992-4e70-9190-70d8c734ff4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439126, "uuid": "bba5bbc4-9300-41a8-aceb-e0874d76dba8", "value": "49152:RmlkqXfd+/9AIUbowEOvygS7/1sHOqJ02nTPFdRPqxMaivHly8Pv6Uc:RmlkqXf0FvUcwti78OqJ7TPBvc8X6Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709439126, "uuid": "44d768fe-d7ec-4712-81fc-09297a307e67", "value": 2582528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709439126, "uuid": "4480f979-b202-4e33-92dc-b6131e0ac52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439126, "uuid": "04247bee-09b3-436a-9028-fd466c24763b", "value": "60788d9aaf351fd3d262b7465df7b8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa91546-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470627, "uuid": "f193a437-9083-4b35-b263-2dc0e005d284", "comment": "Malware payload (Kaiji)", "value": "9bbbc6d572eeb0f314cc572929295684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470627, "uuid": "8179e6d7-5fd8-4cb4-95ca-870b1636ab31", "comment": "Malware payload (Kaiji)", "value": "35bd4cc4f59f2862d77edb92a124feb2b3810267bbbda4571172e9d3236abbf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470627, "uuid": "5030814c-69cc-4afe-8853-a7187f8cfdd4", "comment": "Malware payload (Kaiji)", "value": "6e1a73c6c33c6034c0b2738c0f086b595649f17e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470627, "uuid": "38a55768-f885-43ad-a110-2ef689ed3442", "comment": "Malware payload (Kaiji)", "value": "c69eb113c44090fe87597a8126c7972208dad357abd10d93a88f1766938c29b1847611cd773ce35762ab7c856e86889e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470627, "uuid": "b2ab394d-ab4e-41a8-b100-c6b0fecc6d39", "value": "T195562913BE18D71EC62522345EB2CEA4672A1C8A86D6A517B345F309B8F10BC5D6FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470627, "uuid": "de026ded-038d-41cf-a694-d1c81a9031a2", "value": "49152:vj2ikDKMeT6zKjTmB+dGpawj/mNGZWtaan757Hhu/BQ37A78dWLilulp73RbGog1:LuLiW0Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470627, "uuid": "7bed2184-192b-4432-aa95-4e817e7eb1d4", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470627, "uuid": "3d33e345-7cb9-4d24-be8b-00bc330f8144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470627, "uuid": "9ba830cf-1bce-4f72-adb9-9f2c66c4da8f", "value": "9bbbc6d572eeb0f314cc572929295684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b567287c-d94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709464686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464686, "uuid": "7a4fd85d-2f7e-4e18-9a4e-26d73fb671e8", "comment": "Malware payload (Mirai)", "value": "7114b16ed4c391926afb86d2602f7d84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464686, "uuid": "cbee8014-38b3-4eda-aafe-7bb00ae3abc0", "comment": "Malware payload (Mirai)", "value": "36bc6dc656ec8d9b8488ca5879f58b3cfef5246b82deb7dd5ff80545e9cb6e27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464686, "uuid": "51883b81-5e43-4d1b-96a1-d7bf48559a04", "comment": "Malware payload (Mirai)", "value": "2c9693b92180a1271cdec3ba62c4dcefb3b42ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464686, "uuid": "4466306e-b525-4d0a-b0b9-7ca022c48d2b", "comment": "Malware payload (Mirai)", "value": "557c3c266722a3cad9d7ad2b193c5ae547ca9b7f4be665377a2221512e968c2b47527d8c9d90e4db889d6f5451f66696", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464686, "uuid": "a1ebd030-7d05-4847-84ce-482068a912ed", "value": "T1E9931986B841AA11C6C61677FE2F108E331257ECE2DD73138D245B707BCB91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464686, "uuid": "a84590f1-f142-4206-9d72-ebbd72375607", "value": "1536:XhnOIrV41TKXiiREM0QhuZGVsy5zVMpW1i/at+rbNMKiq+Vu8KRY95cYG:brCkZRE2uKhM01WaM+Vu8KRY9y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709464686, "uuid": "8acfd692-a447-4f5a-9c85-750e9b4911ad", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709464686, "uuid": "3bcb0de5-848b-4d6d-b938-0be772e68a25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464686, "uuid": "fd5e14c2-4e45-4047-bb48-47679e5b1f5d", "value": "7114b16ed4c391926afb86d2602f7d84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a93618-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470637, "uuid": "88f9dadf-b44e-4a9b-a87e-936a2de4cb1a", "comment": "Malware payload (Gafgyt)", "value": "0e3abb49552e9100b3462abd8bb4b68f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470637, "uuid": "78bfceb9-b452-466a-b2d0-d7ea70c4f0cb", "comment": "Malware payload (Gafgyt)", "value": "37360f6da31b73b04cfef519dc71f25dbb1a7ffd1014c78bf0152099e08add72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470637, "uuid": "3583d4bd-cb85-4a6a-87ea-9bf479f2da0e", "comment": "Malware payload (Gafgyt)", "value": "fa38d0b95319b7ff50afcfe698b8078e690aa87f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470637, "uuid": "3586e67b-7676-4ccf-9b33-3c54d3bb1706", "comment": "Malware payload (Gafgyt)", "value": "e9c3f43e899b5382e0d9c15936505676491f64511c679ce841a12932a5fd67bded3b79077e1bc5e13948577d04edda9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470637, "uuid": "b5a225a2-2cc7-4a67-b98b-d6c2d42a6c00", "value": "T1F8331947A8A19EF7D005B6B529775E64035BF8126F4F0A9A722DEEB4030F5CAB40F364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470637, "uuid": "fbec80f8-4bd6-404e-9338-0f96f59ca36b", "value": "768:1y13xkp8FHKrY7yB5aWc8O/kKvX36xVTp+fYRo9XXKouXt6WCSdRXUR0ZwPxZBhv:1y1O8FFG3K//Y9+fKo9XdugWCaR8phT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470637, "uuid": "67647c82-1100-4819-aee3-ee22a7cbd0fe", "value": 54290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470637, "uuid": "fee06c83-c29a-4a30-bd1f-fa3966005cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470637, "uuid": "81c5039d-d46b-40c0-ad74-87cb066dd1c4", "value": "0e3abb49552e9100b3462abd8bb4b68f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c02cf9d-d931-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709451651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451651, "uuid": "9ba65da5-76b1-4062-9192-196ad159fecd", "comment": "Malware payload (RedLineStealer)", "value": "085bfefa0b2e0d793568ed3e656c6cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451651, "uuid": "e76435f6-4aab-48b8-9cfb-477db413c085", "comment": "Malware payload (RedLineStealer)", "value": "399a9677dd0d25bf26716dda37a5bf44a26ed901025a5fe21f4573f859631811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451651, "uuid": "8c9f0af0-2337-46d4-98f8-7c223407726b", "comment": "Malware payload (RedLineStealer)", "value": "081d4811442306e975328dd3d063d03f2d4ac566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451651, "uuid": "ec30c381-e421-4873-8c34-114208c71e16", "comment": "Malware payload (RedLineStealer)", "value": "0dee347243712c8e649245b4ffccbfd061ec793b7075ca8f259b9c0bb734045a34847a96c86fe1ee78a3554fdad19f50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451651, "uuid": "3e879b2f-b070-498f-b9ee-6dfb9f3162ab", "value": "T1C1A4B73FB0453316DE7B28F0C99DE4448625D8F83A428A6757132B3AAD1FF807EA154B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451651, "uuid": "9baf79eb-d814-4a52-911d-d4d7acb3352c", "value": "f427f7e2d298a968a6955e590f98f31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451651, "uuid": "5e48f755-48e9-4f5d-ad65-e02e9660b70f", "value": "12288:B4XOJPgFe7BlIIGfnjx3ALKONCJDO46bK5:tJP77Bl4/N3ooJb6bK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709451651, "uuid": "6baa2579-6201-48b2-a3eb-470901a24f55", "value": 488008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709451651, "uuid": "0f9e7607-5b8c-4ae4-a7c2-fc385ce98f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451651, "uuid": "a41ab9ff-a2a9-4778-8c3e-c070bf37cd15", "value": "Step 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0fd288-d921-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709444803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444803, "uuid": "cd7db13b-8994-4f96-a87d-adec0f140460", "comment": "Malware payload (RedLineStealer)", "value": "597fc72a02489d489b93530de2c30bb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444803, "uuid": "78396c30-11aa-442f-8e9d-befaa46af9e6", "comment": "Malware payload (RedLineStealer)", "value": "3c2b9fe3c1738e99588a5abf9373ce717aceaa02ef1895d55e998770af8d3e98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444803, "uuid": "d5aca13d-ce0f-4c95-989f-99165d20cf0e", "comment": "Malware payload (RedLineStealer)", "value": "6bfe1f53affe68aa157c314cb77e055ffd982e92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444803, "uuid": "1c0f093c-63ec-425c-8345-16efd774b5f6", "comment": "Malware payload (RedLineStealer)", "value": "557c1690dc9ab43a55b490a85614fbb7646de709bde061e0e594632b8707df3f605121bb23795ee1f56325de885ce03f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444803, "uuid": "40770d81-6e91-4eac-a5d4-1fb47a9ee434", "value": "T123544A2833E89910D53F4B79D471E6B093B0EC16A853E35A5ED06CAB3D36780EA157B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444803, "uuid": "90b59141-c11e-463d-bb32-d1c8a5c777eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444803, "uuid": "ec8325e9-4136-4952-97ad-a85846c95697", "value": "3072:6qFFrqwIOGMNyHESF9D4SGqFqsUviy72Gtnl8yJTZnUHI4cZqf7D34leqiOLCbBa:5BIOGv7G/s4ltJTZU5cZqf7DIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444803, "uuid": "63506459-d42d-464b-9af7-594be4b0679c", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444803, "uuid": "4895862a-278f-47e7-8b35-7674df0a26a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444803, "uuid": "4b2cd648-3742-43d0-95d3-b49d31c5099e", "value": "597fc72a02489d489b93530de2c30bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf70d88-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471061, "uuid": "0e65f1b9-b4b8-430c-8f64-9975c8947656", "comment": "Malware payload (Gafgyt)", "value": "76c39b6633e348da50f7176cdefb06c8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471061, "uuid": "5592d6a6-b1d3-496e-ad96-080a3f29e6e0", "comment": "Malware payload (Gafgyt)", "value": "3c521d6db959df9f9ebc3dea91ec2fe68e6f5dd6865ca53c1db77ce845fe86f5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471061, "uuid": "75c120cf-fde0-4c62-bc59-6b60a9f70a96", "comment": "Malware payload (Gafgyt)", "value": "c16a265df3db67983347db1b8901d1641d160bf9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471061, "uuid": "54cba9c5-3a41-48a7-bdbd-3a63d4c1be77", "comment": "Malware payload (Gafgyt)", "value": "da43e20623c23ca17ecefbeeec5b580d59ca82849e0a56787e5661dc10f84d1e824f7cd77575e4518750498c48ebd5d4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471061, "uuid": "eabcf7e1-dcb3-4180-8fae-128e2ad014b4", "value": "T11BB35B276151C5FAC48346B037CFA6D16823F9FE0B62718737E87E682F228C99D59B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471061, "uuid": "d96bd732-bdad-4818-972b-58ab54526d4e", "value": "3072:ccnzWCtPo/2xiKw/SE0Oe+MphaGh5DtjoKty8wdOM:Pi/DKw/J/MphaGh5DtjoKty8wdOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471061, "uuid": "0368ea53-d9e0-4a98-8554-8bf652cb8eb9", "value": 108742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471061, "uuid": "8353b772-e982-4db0-b9d1-738e59189b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471061, "uuid": "fd4775ad-d670-4053-8564-282c078c2cf0", "value": "76c39b6633e348da50f7176cdefb06c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0a2f55-d957-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709467841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467841, "uuid": "5979173d-ba4b-4e5e-b758-87e72361ec9c", "comment": "Malware payload (Mirai)", "value": "4d3c0cfbe103c9b63af49af04d6a6143", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467841, "uuid": "3677fd39-95ab-4b2c-83aa-d248ac667c6b", "comment": "Malware payload (Mirai)", "value": "3cb8715937fe09f4a1cbd7fc049f184ddb6150bf5116e1827655a7ac464054af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467841, "uuid": "55be5567-af4e-4fe4-ba78-b42ed6f886f8", "comment": "Malware payload (Mirai)", "value": "5221040120892a4eef5df32ac5b65f1914776365", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467841, "uuid": "bbfdc005-532e-4d3d-bcc0-a5fd729274d1", "comment": "Malware payload (Mirai)", "value": "81bc9ccf6d936175c0c7be449aa4ed1ee4e90899bbb09902e12dfacc2354f3cf4e398ac5b1123aeb9ee2b0ad41450210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467841, "uuid": "b3c2a1c8-47d4-4a25-a253-8641ac6b3ed7", "value": "T172533B81BD816613C6D422BBFB6E42CD372663A8D2EE3303DD256F11778692B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467841, "uuid": "502f513c-2e97-45bd-b921-8d5b7f674e94", "value": "768:HKU/uHzjs2+mZNLKs6Nk4wzBlzldiZgZoxONSdwya6GXEmMsajO54oXmCjSQ1CRA:z/Gfv6N9wllzldiOUyyEAsajij72QYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467841, "uuid": "dba79897-4718-4bc0-8fed-bdddb6aa736e", "value": 60872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467841, "uuid": "f83fb02e-82e9-44ef-8f84-2c6e99b50a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467841, "uuid": "25e78fe2-a790-4d60-8200-a410c2b69aff", "value": "4d3c0cfbe103c9b63af49af04d6a6143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d06b29-d982-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709486435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486435, "uuid": "bc5e6b8d-4823-4fce-8d33-86d3c26fd0fd", "comment": "Malware payload", "value": "b5b6378ec17872a044a00545cc9e7d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486435, "uuid": "de4f4178-63c7-412c-9b2f-58ed8b6feef8", "comment": "Malware payload", "value": "3d7e41d0139dc07622f5bcbcb1b9f55e94af121b8f2c61da1e0a4c246472567e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486435, "uuid": "eca8e359-adc0-4ea5-a551-bf09679fd94e", "comment": "Malware payload", "value": "6f41ba4593977b49c5d8ec2a3065dfc356c9e0d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486435, "uuid": "d2d677b7-0954-4f50-8490-c5132229c2e0", "comment": "Malware payload", "value": "f0eb45d12947152764d0b983cf1ac15e07f847c74036f563dc2b43d2553876891816a05d31b192ef91ff1039def32463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486435, "uuid": "fbd25f0b-7b64-484e-8b9c-4c0fc9198fc4", "value": "T10E8523BB4585F521E010DE36ED24FE940136BF523E1A6E733924EF99863AC899D173C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486435, "uuid": "94d05239-6ebb-44cf-9ab0-8a67f69d6ed9", "value": "3522b9bc4745e0c9ba72665f520a6966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486435, "uuid": "fd039e0d-08f9-4590-bfcb-3f5c936ad102", "value": "49152:Qxm491sJHpbEzWfGDT1tVtiQ3R4SszXgoh:7m1sJskST1tVtiQ3R4SszQoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709486435, "uuid": "e9973a92-fbc9-48f2-9fed-bc67616152a4", "value": 1731968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709486435, "uuid": "5e927a08-2e34-40c1-8013-676ba1e00dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486435, "uuid": "455dec13-0376-49d2-8d44-0480d49b1836", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11400.31388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c3984f-d986-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709488368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488368, "uuid": "048e631d-4aae-46c9-bcc5-e025d138b630", "comment": "Malware payload (PureLogStealer)", "value": "d43161ed5bd895c6fa3a44c741cc106c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488368, "uuid": "fea35f82-0f13-409a-847d-cbf4fc573a42", "comment": "Malware payload (PureLogStealer)", "value": "401b546970f2c35197b605750f872b7c76231ffb22e66b2d53284d30f2248832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488368, "uuid": "122d3d36-c372-4caa-a3c4-dc6ae6d4ceb6", "comment": "Malware payload (PureLogStealer)", "value": "a0520b20c1f12adbe3200d65109a91313544f811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488368, "uuid": "7af05ab2-26b2-4359-b7ec-04240ab1886d", "comment": "Malware payload (PureLogStealer)", "value": "02ec5e41aec27dc3e847ea41efce36f3f98d049d83d36aade78100d1e5e3dbefcf71dda0781510a1217937f03b64d4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488368, "uuid": "53e63b0b-f55a-496c-aa05-8ef5f9fdb073", "value": "T1C4E423A6764CC627C13F09355CF191A50BF69587BB84CFEE9CF400AF09796846B8672C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488368, "uuid": "6f3fe6e0-ecf5-4616-a50a-eae6a53ffeee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488368, "uuid": "d622896c-ae52-465f-b97f-356257cc5289", "value": "12288:S1zScVEn+sofl0EcbNmoLCVINqpU2Xz5aEBI3geChpN2uBHs:gzSO6DYqEcxXLNqVNxIQdhpbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709488368, "uuid": "78095e2b-79c1-4913-9def-230ea3409222", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709488368, "uuid": "889045fe-658e-4bfb-9b59-ae521cc7da7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488368, "uuid": "0a9596ae-e33b-4c69-aa9c-6c6e1de4563a", "value": "Order List No.22724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd27ceb-d95f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709471411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471411, "uuid": "cb735d19-c6f9-43f2-a345-0cc0d95d7075", "comment": "Malware payload (DCRat)", "value": "7a0d168c394928236bfabb545759bb77", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471411, "uuid": "def8d225-5382-4c0c-a3e9-2dfd38e5b05d", "comment": "Malware payload (DCRat)", "value": "4264bbbf1898d723595899e326f4bcb87ab6af4356f43d258b74d1c8ab157d6d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471411, "uuid": "a4cfbaad-f0bb-4dd5-a967-33daf32c69e0", "comment": "Malware payload (DCRat)", "value": "d420de59b369c552f41f23b16249447273af0bc2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471411, "uuid": "41a474a1-2425-4982-bdc2-4f1f90ac7f36", "comment": "Malware payload (DCRat)", "value": "0da387527bb014840c218e85ffa12befac9b8feb145f2cb6d20b87d38f67bbca83787baa3e461d4e5432869cd4feab39", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471411, "uuid": "7302e56b-25dc-4c98-a544-35b8774ff741", "value": "T11CF4C52029EB1136F0B7AFB195E1659E87AEF5F3B7168F8E304142C68712780DD9173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471411, "uuid": "a7b6fbc7-3216-4dce-84dd-35a73b08611f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471411, "uuid": "1d01159a-c53d-40b1-9768-6b005fd8b029", "value": "12288:Ilu103Amsb7spvAi2pdDyC0pW3Ari4VVyZpqeBFmWqyL1SNQj38DA61+:I4X+NT2pdDyb3i7l/mDA61+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471411, "uuid": "1855b278-399e-425a-a3fe-574b377ace2c", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471411, "uuid": "faf476c6-3039-43e4-afe9-077d42ad99a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471411, "uuid": "239e887f-be73-4d58-a12a-f0847afd0aa8", "value": "7A0D168C394928236BFABB545759BB77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be071a8b-d94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709464700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464700, "uuid": "e09902d6-e755-4f47-9343-18a79d53d40b", "comment": "Malware payload (Mirai)", "value": "a0b8db060930a784a7e3273ea3c627f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464700, "uuid": "5f33e0fb-1d60-4eaa-93f1-82844a948dc0", "comment": "Malware payload (Mirai)", "value": "4364e07cf5802920eed2e1ddf6b325583c943dd7db5b2f4d48e5c5ed5b21cabd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464700, "uuid": "dbfcf956-39bc-46b6-b739-d95630c4beb8", "comment": "Malware payload (Mirai)", "value": "90b2a3249290ca071597b162ef32ac693715b99f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464700, "uuid": "6326ec29-c507-4210-b049-7c936c8f888f", "comment": "Malware payload (Mirai)", "value": "8bb7bb10dcad4c106f52d8efa1045bbbdac3504c0baefad5f3c566aeae52c860904dc49d61f5dc832f05a1fe056827ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464700, "uuid": "9e03f217-d6c0-47d1-a9a1-76a036832fd4", "value": "T128B3D40ABF610FF7E8ABEC3745A92B05249D514B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464700, "uuid": "f84bd83e-d68e-4335-80a7-2b9f9fb90daf", "value": "1536:g9DYWFx+xx+AaEPieMR2jk2EkZ+BzYnjKoOvDBgplbngVZ14hvG:gqWFx+xUA0jR2hEkZ+BIpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709464700, "uuid": "5c6e9027-d177-4e4c-bb2d-fe8f24f4e519", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709464700, "uuid": "50654720-1869-4c8f-9502-87aad4ac8d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464700, "uuid": "d5617b17-ae94-4562-a95e-dc1e38549ce1", "value": "a0b8db060930a784a7e3273ea3c627f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42d40b3-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1709490481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490481, "uuid": "d729a9df-be43-4c6a-8aa2-5311e4b51c3b", "comment": "Malware payload (Amadey)", "value": "e7b9fce9d5d9b6d0f9bc5b1ca3835bde", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490481, "uuid": "ab059c63-6991-45e9-a7f7-7c290c19b4e4", "comment": "Malware payload (Amadey)", "value": "453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490481, "uuid": "0fa49681-7552-45ed-84b1-15fcc1e3ce51", "comment": "Malware payload (Amadey)", "value": "25f64712b63cec205160b579f8e526bf702c3cc5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490481, "uuid": "8bde9ca0-5410-46c0-9dcb-f50ef5a7fa46", "comment": "Malware payload (Amadey)", "value": "f7d9f2f560cc50ed777c4e0428254b643e23154cbdff9834d07510483584f005deaf48314ef8d8bd1107794657be55aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490481, "uuid": "c1389f15-b38c-4043-8993-9edc5934d03b", "value": "T14A9533FA7E330438D8F650B8296F13061ED4EA4D59A9ADD6F2A963F7970C42EF147210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490481, "uuid": "1415fc01-29f5-4ced-9f98-fade26b3494c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490481, "uuid": "393e5b6f-2bee-4fcc-9e1c-f80c7110735a", "value": "49152:3aPyhIA1/NEdLoHh7IvqUqZNNpclBrAxtYH:3aPyhN1CLeFIO/NYBre6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490481, "uuid": "6197ea76-e348-44c8-8d09-2cb7ffd4e1b0", "value": 1956864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490481, "uuid": "60fd3c23-5a96-4d42-bb49-2e10c4af52ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490481, "uuid": "e2235fbf-5094-4ab3-9c1d-75f8f8462c62", "value": "e7b9fce9d5d9b6d0f9bc5b1ca3835bde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf6d9d3-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490333, "uuid": "4d26f711-318c-4cd1-80ba-52538e345031", "comment": "Malware payload (Mirai)", "value": "b24318a6290e15f99e553a7b54044741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490333, "uuid": "5e70d705-5c2c-4029-a48f-91819914e613", "comment": "Malware payload (Mirai)", "value": "45703fc7e2e662743d4d0d6f388d74bd7dbb1857128c2948a954d0448bcb2bef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490333, "uuid": "20f1a950-0481-4f68-be21-0ed029e052b7", "comment": "Malware payload (Mirai)", "value": "88b28ab87d7485c323b4f09d2434181c651b60c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490333, "uuid": "80fee3cc-4e41-4948-a2ad-1f17d11f4803", "comment": "Malware payload (Mirai)", "value": "039003b16cfc102638bc1e2a42cb5fe50b142ea347277f56187e52dbc3881a85f73dc15a4eef5792f8ec3331cd8f3abc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490333, "uuid": "2e6c5ece-9384-4c75-ba5a-d6eedf6286bf", "value": "T173534C02B30C0D43D1675EB03A3B27D5D3AEEAD021E4FB84655FAB469271E365286ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490333, "uuid": "24625450-85a2-4f2a-bbc5-9aba8cbe52a6", "value": "1536:TqVXGrptpOEluulxyYlWZwYkIwQW97WodCgaKpkI:hpjOElRzlwkIFW9L9aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490333, "uuid": "ed399aad-7aa0-471b-b80b-59434a554377", "value": 65068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490333, "uuid": "54102d8b-f9b3-47af-b71a-ba982c8423be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490333, "uuid": "fa66cd7f-d815-4286-9f9d-037b8bb1d7f7", "value": "b24318a6290e15f99e553a7b54044741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114de027-d8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709427044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709427044, "uuid": "8b0a1fc8-ccaf-48bc-b73c-9af0f2b3b90a", "comment": "Malware payload (Formbook)", "value": "e6757d695ab5409bbe170be6bf76397b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709427044, "uuid": "c8df4a25-0e4e-47cf-b966-781fbe5abce6", "comment": "Malware payload (Formbook)", "value": "45ea7fead20be41cb313fe740b585cfc085ba9e03633af049886bbe294c3dc1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709427044, "uuid": "1e718406-5bba-433e-af7c-bd1f54e64408", "comment": "Malware payload (Formbook)", "value": "57214bb4cc2b51c8574ea64fa506b391ad15ce11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709427044, "uuid": "58faa783-31a2-490e-a30f-446e890946a1", "comment": "Malware payload (Formbook)", "value": "5fa8a07996b73b6f576b86b375a5ef460587563edb9fdd456a878336d4513e066c96863c77610b4d7b5fe7c71424a876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709427044, "uuid": "7d1e0a60-7eba-4934-8021-f7f6b6250bc1", "value": "T1FEB24A09B7E8CA29E2FD8B7595B3514542F2F5130523DB5E2DE9D0ED0A23B849A01BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709427044, "uuid": "5d2e6418-51cf-4873-831a-d961f00b1692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709427044, "uuid": "022dcbe5-fc41-45b1-8510-b1ee462e1cfa", "value": "384:Xx4ZGxgY68oMWDaZWkYWH0++Z/cLpzshZG/aBbAc3cp39n+4+YEy2toRIRLOeEl5:h4GxgNMWYh7FLYNBb7PBLOxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709427044, "uuid": "dcc160f0-bb0a-4434-a092-6b3f853d31f3", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709427044, "uuid": "6acfce15-0076-4659-9323-17cc891c96f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709427044, "uuid": "9a54ac62-07ee-4330-b326-a4695fed7e37", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3480.22759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5f96f1-d920-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709444615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444615, "uuid": "f461daf8-d104-49f3-ab15-d4662eb07bed", "comment": "Malware payload (Mirai)", "value": "049b21ac79a9a7786cb06b92a340c0db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444615, "uuid": "ed9440fa-6fc4-48e0-8d08-b3526f019910", "comment": "Malware payload (Mirai)", "value": "465a502c15686d391047073011660c44db90d9944d341419dc47112bdb8b347f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444615, "uuid": "3f0d10e5-ea9b-4568-82ff-eb24bc8784f0", "comment": "Malware payload (Mirai)", "value": "4afdf753980290baa26d4d0534e1242d2a779b54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444615, "uuid": "d61ad6a8-2694-4db1-abaa-27814bb978ac", "comment": "Malware payload (Mirai)", "value": "e16dd0ba4325f496c60f957fd59e8cc77702861c29e38a8b7fb4c49c7faa8ad8c2f64ca61635e2257af38b571b622aa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444615, "uuid": "184bbed9-bace-4b5a-85f3-75af8f0133bc", "value": "T1FF633A51F8819612C6C112BBFB6E42CD372A53A8D3EF72079E25AF2137C785B0E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444615, "uuid": "5e2286c5-eb6d-49b6-9819-be92489a2152", "value": "1536:yWB9lBreTvYUqt7YoV+9orx1ih9Wk4vp4hW7vgiI:yWuApmo89oN1ihIvDgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444615, "uuid": "041c83c1-583f-4247-a205-ac49e8ee3667", "value": 67688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444615, "uuid": "3ef1672d-296b-412d-85c5-d2903a43b916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444615, "uuid": "04dae38f-a840-47de-bbbe-6dc3d2722aee", "value": "arm4.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a1419b-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471075, "uuid": "e7665937-dce9-464e-9ee8-e68954422f93", "comment": "Malware payload (Mirai)", "value": "839beadf2d3339a72f26e8766a1502ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471075, "uuid": "d505314c-6952-4aa3-8f59-2f38d5aae82c", "comment": "Malware payload (Mirai)", "value": "4ab520a0fe086092930b24b9194d0d9af29d24b155613c04fa82db2607cf7b05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471075, "uuid": "5f623c99-cd65-435a-b613-15f56df43b71", "comment": "Malware payload (Mirai)", "value": "caa9da3d50b7ea6922727db1f76d09d3a6a87c07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471075, "uuid": "a0799258-8135-464d-b9c2-bd45bdcfbc0e", "comment": "Malware payload (Mirai)", "value": "81be3a59a5f767fcdb9d41781955ff86c2e7d05d1e51a1e028b8350980a46b9ed8da302073cc95147265f0c3895f191f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471075, "uuid": "c2fcf5bc-9bbd-4f9b-9bbb-3ed4045e4cb5", "value": "T148832B05F511976BC1D127BFFA5E425D33272B98A79B33229A246BB43BC179D0E3C121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471075, "uuid": "a4e26ee8-60ec-4692-9811-e876f9197883", "value": "1536:QTnEA74m3Rtkx9z/e6cWqczItiOWdYPNePbKBkEN2B3Y234BItJ:/A74mb29zG3DWdYPAPOGgWXoGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471075, "uuid": "50ef6cc2-ef9f-4123-9421-4aa546223adc", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471075, "uuid": "dc9a2938-2f23-4fce-ad63-79cfe724fbf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471075, "uuid": "76cc1320-7a29-4621-a5c7-68dd0bb8bd09", "value": "839beadf2d3339a72f26e8766a1502ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5d4f54-d956-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709467540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467540, "uuid": "ee824b16-5df9-44cb-9da3-2c24952582fe", "comment": "Malware payload (Mirai)", "value": "da5fc2c63dd6b1cdf42a6c99c7c97de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467540, "uuid": "1f7fbec7-b57e-4a6a-a687-a326ebe76f6a", "comment": "Malware payload (Mirai)", "value": "4b18c8727784b9ea896928332519333aa41047005af8c7affe7544607de083c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467540, "uuid": "734fb2c4-1403-4b9b-8657-c5af938bcce7", "comment": "Malware payload (Mirai)", "value": "a338ab3547a1ed908269b2e0b03f5b34ab87c531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467540, "uuid": "cf507183-5b1c-4dd4-8ea4-8a8a23cfca10", "comment": "Malware payload (Mirai)", "value": "e8e7758be93de15a1494ccc8d28fa7546e4f44f386f73c5812401335812475fe9313437460f585f6fc4c8486e4fe215b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467540, "uuid": "3d9796dc-2fec-4660-982b-86c997235209", "value": "T175633BEAF800DD7DF41ED77B8453050AB23563A105921F3A775BBDA7AC721A4093AEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467540, "uuid": "5539ac75-f2be-4730-a6a3-dfed543c5c7b", "value": "1536:QWanNvSA7TDBF/9hQkyI6383VkbtcNF70uudIsvW27ZVz:QWaNvX9CkyI64VkcF4uujXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467540, "uuid": "172b3241-5da4-4c78-99e7-332b9d5110ac", "value": 68180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467540, "uuid": "fc5d6145-1473-4a12-921d-cfe357667202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467540, "uuid": "f8766412-f39a-458d-a110-9eff05cd5583", "value": "da5fc2c63dd6b1cdf42a6c99c7c97de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e9e77-d93f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709457745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457745, "uuid": "0f3311b2-a619-47d8-b088-4a5996ac062f", "comment": "Malware payload", "value": "cee21c06cff2c54b527af674a50a3aa1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457745, "uuid": "2eefd4f8-72ff-48c2-ae59-fd5dcbb597ed", "comment": "Malware payload", "value": "4e214651262c39904bda6f011c46e3eb52bfbe51cf0b361c640b678726f0abe8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457745, "uuid": "41260909-2cc7-4b0d-9379-790b21db7ba1", "comment": "Malware payload", "value": "fd30504892b3153c5859390428a079fa8f86e616", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457745, "uuid": "5ac6eecb-0cbd-4262-a282-edeb7a6378eb", "comment": "Malware payload", "value": "195d8f21fda9973730a56e6eb5fd08d3762c7261fb72731f0a2a02c1964518e8006aac7e88722d2ea5bc8aae971349fa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457745, "uuid": "966a67cc-8f69-48a6-9696-d05477b952f1", "value": "T1EEB5BE1A35CA8A36FB7E82706679D77A21B97EE04BB200DB63C43A5E1E705C10275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457745, "uuid": "a494a4ae-e4e4-44aa-a98e-133ddb73594f", "value": "49152:+ka9ibZ7ZKumZrRq4Fb6HXr1iWnYs4ntHurpllQ6a6uxtZLjhdnNnVY7nE2N/OFj:HbzKZFnWnLuxTjvMEW/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709457745, "uuid": "e7aa0e6c-c141-44ed-ab0b-3bf1fbd3e4ed", "value": 2450944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709457745, "uuid": "1b5c422b-b973-4996-81c9-830efcd0d169", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457745, "uuid": "5153d74f-879d-4a15-a4fc-c6de2cafbff1", "value": "cee21c06cff2c54b527af674a50a3aa1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cdab48-d92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XehookStealer)", "timestamp": 1709450589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709450589, "uuid": "8669a9ff-7599-4c2d-9726-588baf4c9ae9", "comment": "Malware payload (XehookStealer)", "value": "1c3c3d869eb0804b24ed9bb2fdd8f3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709450589, "uuid": "7f1097f4-5496-4643-a408-1179b03b4110", "comment": "Malware payload (XehookStealer)", "value": "4f66ddef14082dc213e3a5bac8debfef24027b5b5e9b3be5ac85bc13a31adf45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709450589, "uuid": "785e5f58-e40c-449e-9bfc-56f7b8c34163", "comment": "Malware payload (XehookStealer)", "value": "54a4f56bc708d2c4e72d744fd095bab33f4e7525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709450589, "uuid": "2272ce98-5e00-4591-be78-ef61590e6935", "comment": "Malware payload (XehookStealer)", "value": "2edee9c0ff38aeeda01ff5298479959d69367f535c6da4d5fc13aeea7c8076f2c459129aa98dd58c89b3530eb246e409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709450589, "uuid": "46be9b4e-ec11-4508-9d95-abc5f0d873e9", "value": "T14674D01779D1A925DCB13ABA58E4B2E98E3EE470FDD06E173628193D8E113900CAC7DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709450589, "uuid": "e599aaf6-a201-4a84-aa86-ad3e8146fe83", "value": "f427f7e2d298a968a6955e590f98f31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709450589, "uuid": "9063ece3-5259-41ea-8071-40a9d10d45f1", "value": "6144:FqurA7Ow+h8xoQj7F93V0flM5gUICGN4nMd2pRnOb58++Xx1aa5+rsnFSEvfNH:curA7s8V7BlIpGdNI5j+B19vFSGf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709450589, "uuid": "cce59797-f421-4b33-96fa-170eb1099c93", "value": 339016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709450589, "uuid": "2edd95b3-d2b9-4d1b-85ab-2563a73ed0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709450589, "uuid": "2e4d32d2-0ff9-4278-9fd9-4f2ba75bbbf4", "value": "SecuriteInfo.com.Win32.Evo-gen.30977.32689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf585dc-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471086, "uuid": "8a27124d-9d83-4cca-9fe7-80f971fd3e5d", "comment": "Malware payload (Gafgyt)", "value": "467344b16b4ec2fae0a58b0ae93b2d5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471086, "uuid": "ec54db91-554c-48ae-93c5-a0f60d314ab4", "comment": "Malware payload (Gafgyt)", "value": "51efc8f2b51f1f3c5083056f96a9de6338ab1fc1909e64b4b685744d0eb43a9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471086, "uuid": "871a3794-28be-4516-b106-9598f043a28b", "comment": "Malware payload (Gafgyt)", "value": "c3e22d3472533707e983a6bbbda0bb857d616227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471086, "uuid": "5c48cf07-f99f-4023-9028-88cc392d3248", "comment": "Malware payload (Gafgyt)", "value": "80b8c234561444cef8f6b00b3b085289c9a8c55cb904da7bcfa2867c65f72e513b70f5a4a05acfdead96223da4492328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471086, "uuid": "02974c9f-b3af-4d0b-8505-ce83f493ae9a", "value": "T1F6B3F852F408DA67F01B963509C3AB19B770EBED0F532E32622739669E323C5E426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471086, "uuid": "63d1ebd2-cdbf-43f1-8f24-cec8b5b10b9d", "value": "3072:eipzhztynSH/gmXPm3lyzXwJ3KVfmkK7uTy0UKCM:eu1zsnSH/gjyzAJ3KVfmkK7uTy0UKCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471086, "uuid": "1f107ad5-d36d-45cb-b97e-8c7f4dac00b2", "value": 113204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471086, "uuid": "929dd8fd-98d0-4e6f-a5e5-062868ac5586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471086, "uuid": "c54c64ba-d27c-472a-a0df-03fed3761a16", "value": "467344b16b4ec2fae0a58b0ae93b2d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dc5dd5-d91e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709443593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443593, "uuid": "109d2f81-56f0-49e1-98d3-4c291f32037f", "comment": "Malware payload (Mirai)", "value": "703b2bb537327cc2e2299118b18619f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443593, "uuid": "1e5a1995-16a6-4f6d-8319-2ce860176ffd", "comment": "Malware payload (Mirai)", "value": "56fd82656a27d803f0976d6c762b2273d0d4b803330204260c7d66c62fd43ef0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443593, "uuid": "b69a76bf-f3b7-44ef-9ac4-e938d5c301a6", "comment": "Malware payload (Mirai)", "value": "394353d7a8f8fbc980d258258168c067c71ae03b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443593, "uuid": "bb96c5ce-c079-4daa-8a56-e7cb80462e74", "comment": "Malware payload (Mirai)", "value": "d56e7dd951b23ea964a066bc9105247822c277e3e124559e180aa625dc5a44a101787468506da1d8fc7648954b737fa5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443593, "uuid": "b4cd7934-812f-4975-a77a-1b899f5eeccc", "value": "T182E32A56A7408B13C0D62779BADF42453323AB6493EB73059928BFF43F8279E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443593, "uuid": "17cfd534-4546-4702-be9a-bb51d2c90651", "value": "3072:kPHGDzH7KJKaSRdS90u8rXhH6HLOERwCdz0EdM/9vxVfb:kPmDj70KaSRdS2u89HWL/fz0CM/9vxVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709443593, "uuid": "6f1bcbd3-a45a-4d95-bad7-7495e1aa249c", "value": 149647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709443593, "uuid": "7bde6c72-7e1e-48f1-80e5-3bed730c2842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443593, "uuid": "c244cf0c-201f-4c43-9e37-d673278a8c0d", "value": "arm7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9e5e40-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470632, "uuid": "ea85d490-9a5f-4032-a939-a5aac7914d67", "comment": "Malware payload (Kaiji)", "value": "c636e85c61f66e1496a0cc37f36e8174", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470632, "uuid": "b0f679fe-1eba-450c-bda5-41830dbc474d", "comment": "Malware payload (Kaiji)", "value": "57e879a44c0a5e230b9eb830f8b08157e98573bb624277939e9e358acbfe5b32", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470632, "uuid": "b268a855-eddf-4894-a8bd-04d8ab7738bc", "comment": "Malware payload (Kaiji)", "value": "bc896999566580a41cd69918d26093182f60d6ce", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470632, "uuid": "b0883ea7-2f35-4909-b70b-7e0aa34294c9", "comment": "Malware payload (Kaiji)", "value": "70bd463c07b619ff1521618242645fae64688cf2f13d70ba18d87e8f950e5ac8969d23730e087179b5cb77978ad843ac", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470632, "uuid": "a93d0b6d-429f-450c-8ede-6b3c51d329d6", "value": "T103463903F85195E8D1AAD130CA6282A2BB717C895B3023E33F55F7B82F72BD45A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470632, "uuid": "a01c53de-b0d7-4346-98a3-5919757e1968", "value": "49152:36YAazFaGdD95S9rb/T0vO90d7HjmAFd4A64nsfJSNi2nYr3miNAbBlrqlTMcN70:ldvpJYrjABENL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470632, "uuid": "c5e3981f-e66e-4bab-af1f-93d67b67dcbb", "value": 5398528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470632, "uuid": "1adc51b0-6e90-4400-b5ad-c49f18fbfd7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470632, "uuid": "7050182c-52a5-4327-89e7-ba437c79e95c", "value": "c636e85c61f66e1496a0cc37f36e8174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f3d8d6-d959-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709469010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709469010, "uuid": "39a998cb-e24c-4bd3-aff9-a04324b70512", "comment": "Malware payload (RedLineStealer)", "value": "2e501240ec8b9aab46d76a6504e44882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709469010, "uuid": "61c2706f-e6b6-4871-8b9d-04f6f511c3e7", "comment": "Malware payload (RedLineStealer)", "value": "582cf0470ba0d2c2ef2c3fee83442db0e345656f7d7c46ee5b613998fdd6ee00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709469010, "uuid": "5cc0e8d0-16a9-4f53-8ae9-4d5532d838b1", "comment": "Malware payload (RedLineStealer)", "value": "1a97d7662e66502faa5a7718565bb362eb6f27bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709469010, "uuid": "6f60809a-4df1-45cc-aa79-dbfddbe36eba", "comment": "Malware payload (RedLineStealer)", "value": "ca2d9204ad2bf4d94e33dd643eb052be601f8167b73d5b5ae82c7773940bfda371e0ada839e13ee8875310866a0040df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709469010, "uuid": "26fc05eb-6207-499b-bcfd-d9d9ba26ebc2", "value": "T1C527D03287433CF9D86C5936D0262E155E78368BCB25A1CFEBC424772FAEDC48D29661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709469010, "uuid": "d1782438-4e0f-4ed6-9d67-f4ea7462bad3", "value": "9576feaee7c50f81d281a6149bed248d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709469010, "uuid": "5ec4126d-2049-4e3f-87bd-9389fa8c76f2", "value": "98304:Kj1ZAxOCU3yUetDvB6ti3FOU8jRdqY9d2omTt20+NVZ:mAxOCU3yUetDvB6ti1aOTtlcVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709469010, "uuid": "35474343-e5df-48ec-8f4a-44898f5db5c7", "value": 21906944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709469010, "uuid": "9732be77-459e-4438-a3a5-21189d57549f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709469010, "uuid": "5c7f2998-b2f0-4481-9daa-bc2c4e3484b1", "value": "2e501240ec8b9aab46d76a6504e44882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d232ed-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471045, "uuid": "1a614aaf-6117-4a3f-9abb-56d5d7384a2a", "comment": "Malware payload (Gafgyt)", "value": "ac0ee7809f2349f7ad3e86ec011f7124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471045, "uuid": "f3ff3b61-774a-4a35-88a4-078d013bc900", "comment": "Malware payload (Gafgyt)", "value": "5830d3a37398dc673afc1a84e687753b1734bd6712c860de9524135293c946dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471045, "uuid": "c63a3a46-c838-4edc-a2dc-18f3e9c88841", "comment": "Malware payload (Gafgyt)", "value": "2f6d13130921bf26dbe4f14230660053af824ac4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471045, "uuid": "acfda132-d542-4069-896c-20c00a1d6852", "comment": "Malware payload (Gafgyt)", "value": "357aff78597f55cca4d0e5d9664827a161b02c0aaaa35022a2a3abe352640dfe0ed77acffc4e04f84c6a5778ce05b14f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471045, "uuid": "0e34c878-3c78-407b-9551-bb7c24f57562", "value": "T117E3745677508FB7C81F8E3216A94702208DD59E22E92F6B73F4C61CFB8A55E09E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471045, "uuid": "43bf6a89-7142-4723-9499-408ae7d281a6", "value": "1536:Dlb6AARdDeTVi6CVl9A4MxZs3lf4APKnQZTeKVdm5hF5G9g3rMsBRTFAHj4jM:xiq4SfAmsTM5hFgC3rMsBRTFCj4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471045, "uuid": "aed7d281-9a65-4db8-a4e7-27464a8d7ce1", "value": 153082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471045, "uuid": "5c9abb0d-50c0-4b30-9ec3-0c17e695bf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471045, "uuid": "7e261d09-887e-4484-86ad-2370c5a3b2ef", "value": "ac0ee7809f2349f7ad3e86ec011f7124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0f9bfc-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709490361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490361, "uuid": "e2457500-1e9d-444c-aabc-b45162e22754", "comment": "Malware payload (Stealc)", "value": "02973a41a79b53aa831fc27fef4a5c76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490361, "uuid": "31317c66-043e-4c92-8828-b2f6cfe69b9b", "comment": "Malware payload (Stealc)", "value": "58978edefe687a8790141583313962ab627aefaab2278e9da3a9fba753cdb608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490361, "uuid": "8fe556fc-ce00-48bf-a76b-accc9f8823ed", "comment": "Malware payload (Stealc)", "value": "2cad943820e8b6bc2f7ed89ae943518f051000a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490361, "uuid": "01ad249a-dec7-4c5b-9a02-11696cecceb2", "comment": "Malware payload (Stealc)", "value": "ba5ceba9183e234d8251304032e3da079ef33cd04f3648432318c91bc4690e60557aa191f4fd00c02db52926166a8bff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490361, "uuid": "30923e1a-df01-4ebf-959a-00072e1605b7", "value": "T1F334C02176E1C072C97B4539A4A1CAF06F7BF8715BA0C15B37181B6E9EE07D08E3A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490361, "uuid": "e99aa047-d58f-40c6-993b-04eb5bc12575", "value": "ede9c6017633125bea7e6d7ae9914f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490361, "uuid": "8ae97bff-4572-4645-8dc8-79ec2001b8d2", "value": "3072:j21CTVWKayMVZuZDoWco+TJsT2kYdklWYyl+HQt35e44sDYk:YYWKaJaZDj+tJkYq4R4HQC44qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490361, "uuid": "c2e6910d-bbab-4fb8-95e7-7d227a0eb45d", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490361, "uuid": "88b056d8-bf49-41f5-94cf-b9f1f51729f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490361, "uuid": "d41695d5-2154-4163-b42f-234427278525", "value": "02973a41a79b53aa831fc27fef4a5c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24193775-d96a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709476039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476039, "uuid": "4f1555e4-027b-430f-a887-c9c091d67de0", "comment": "Malware payload", "value": "4d3b13317394f2d45e2a5c6cc10cfde7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476039, "uuid": "d9bf211d-d807-4f41-9209-21b6a1265fcd", "comment": "Malware payload", "value": "5d1693788b0cd87fed08a6427108a4eb1f945a0ccb2477ae3f0da8cd7611cd54", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476039, "uuid": "b8213f09-e24f-4dc3-ad08-adcb02db73de", "comment": "Malware payload", "value": "a42dcbe370c356ca2644236c425f07772e1e054b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709476039, "uuid": "ce923304-42f0-43d0-a20b-ae4472b73544", "comment": "Malware payload", "value": "872a1515ef447529d02a46f8f17dbd89cbc695d133fe1555e2496bc8b3cdefa6aae01682adabdd43f1bbfe3e70314b2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476039, "uuid": "6ea8fe48-51a1-4d1e-bc59-420b41b38cad", "value": "T17BE0EBF0C9341BC3E0A31D72003157B3D7AF803A02287E0E041F24044EE3C708884784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476039, "uuid": "15f971de-bdb9-408f-b123-2de47451e641", "value": "6:5j3xAzVoXXpIcu9imeF3gel5iGCLJwFAD2lZvtBzVoXXEt+lRlX:5jhGoHmcu9ipRn5i91la/RoHEtaRlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709476039, "uuid": "a598cf94-7a73-4e13-8f15-6f6fbe4472f4", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709476039, "uuid": "e9901b10-a269-482f-9691-c106b1bd9fd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709476039, "uuid": "f6ffef72-3473-498e-9902-f69f1ab6c83e", "value": "4d3b13317394f2d45e2a5c6cc10cfde7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd4e2a7-d92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709451008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451008, "uuid": "97915431-9754-4be4-bc3c-b6e09ba45105", "comment": "Malware payload (RedLineStealer)", "value": "20ab063f206eb8115fde1479e05c245e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451008, "uuid": "8de41c58-5e11-4440-8713-da64c66a9a41", "comment": "Malware payload (RedLineStealer)", "value": "5ec4818da47f24ac8762bf73d0395662639142f86b930db138e586c2eb91b29e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451008, "uuid": "5f652ce4-89d2-4ad3-975f-1b5099dcf2e5", "comment": "Malware payload (RedLineStealer)", "value": "2088f3c51a5ad9e11da999a7114623274cc69692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451008, "uuid": "e3ebac15-f5ad-4986-a519-afbf10840726", "comment": "Malware payload (RedLineStealer)", "value": "4f3ad440ccc089ea735679f6f80b6a28539030ea6107321354bdc3e08b1d9fc876e3bf800a59b928c1fe1f1c64c50de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451008, "uuid": "13658791-41c1-4a07-9342-381b569ce1d2", "value": "T160545B1873E89911E23F4B79D471D67093B0EC52A853E31A5ED06CAB3D37780EE196B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451008, "uuid": "30885f79-22b0-451b-889c-925b0e11f52a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451008, "uuid": "9ac202c0-b3ec-45b5-8e46-19ea390dc90f", "value": "3072:lqFFrqwIOGEzyJNmWb7cGaXSf0vdSP/HqlYuJTZFfuIMcZqf7D34teqiOLCbBOj:sBIOGFiifzHqlpJTZhWcZqf7DIXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709451008, "uuid": "700f53d8-3051-4292-af7f-e7d0248cf498", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709451008, "uuid": "3c2758ff-39d0-4c35-814a-38574ced5360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451008, "uuid": "8a26eea9-a311-4519-880d-fc4ad357f70c", "value": "20ab063f206eb8115fde1479e05c245e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65556ed5-d921-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1709444795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444795, "uuid": "1571e843-a595-4bfc-b3fd-a80a47f70772", "comment": "Malware payload (PythonStealer)", "value": "231f199ed9540c2d1cbf4233be515988", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444795, "uuid": "0f4b0ec7-22f6-4b22-9938-959cc90dd681", "comment": "Malware payload (PythonStealer)", "value": "61c881908bdc8be9c8ee8e42728b6f116768ff2a4edd540e1d82a02c51fd6322", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444795, "uuid": "f9ed181b-fc04-4d71-beaf-3b55797e4daa", "comment": "Malware payload (PythonStealer)", "value": "99cbb7341dffb6925a88525ea82ca8cb0cbe10c9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444795, "uuid": "a64da8eb-74c3-48ef-a205-8833acda4efe", "comment": "Malware payload (PythonStealer)", "value": "48b1f7116acffc976ea200612b9082da5e8ac8d0635a623fe96123a6aca85deb436729d4c389a33aa131216b0c0d1a66", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444795, "uuid": "38de1a83-52c0-4b9f-9cc7-9110c2d7dedb", "value": "T196B63379DA23C5E8CF8BD17446A218E5F639F8B47554E0720385EA605F87FC68A78B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444795, "uuid": "5e1a1489-2fa6-4ec1-9b5b-82153c8572a4", "value": "e44f44f1060dd800fd861c4e5ad59e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444795, "uuid": "c73ea0fe-7589-4c1e-85e9-cc565849c18d", "value": "196608:UPAlP3Zobseq6ERnzeljovAlpbmVjHQLmcVZOfcvL2sTD:KCpoSvRnzeOvW6QLLiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444795, "uuid": "14b95228-97bf-4ec5-8ecc-f98e30c62114", "value": 11266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444795, "uuid": "05fb4212-835e-4e8b-8002-c8f281525c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444795, "uuid": "75c2d70b-d017-4989-92d1-8da758fc084f", "value": "231f199ed9540c2d1cbf4233be515988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26cf71a-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470694, "uuid": "a423549e-919e-4d0e-bddf-c6d9b635df0b", "comment": "Malware payload (Kaiji)", "value": "fa80031946a668346f6d076eec6ff710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470694, "uuid": "f7821759-22c0-447e-b7ec-f6a88ae8ba0c", "comment": "Malware payload (Kaiji)", "value": "62a1471b457169ed35709f3ca2234089c4ff16b0a747022e2d41c713db5d5230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470694, "uuid": "9d1c8d64-5409-41de-9c8f-e92a7019423f", "comment": "Malware payload (Kaiji)", "value": "2d6a296c217d97f3767ece35767abde9c5ff3b4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470694, "uuid": "ab39c61f-b82e-45fb-8ecb-f0040db42bfc", "comment": "Malware payload (Kaiji)", "value": "2f60c167b7eaf393e68cd32e64737fe3f4aff92e9d530901dbf9daf7a59619e9f05e118c84aeb0b2f8e2138aa242a9ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470694, "uuid": "1c62d989-1e64-4c25-97c2-808a6d84219f", "value": "T175365A99BC1DB862EACC7AB42F3541947335FD499F8183237518BBAD69F13188F22760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470694, "uuid": "4aa470e3-4d3d-4ef1-8420-237f62e71d70", "value": "49152:SNHAjYXHu7vLqfIgzOpuS9xFkNexWlfR5EyAGYND5YgONLoI1:0HAjYXIvLqfIgzObkNexInE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470694, "uuid": "1e9bc0ae-db43-45fb-aee8-ee644d3e371c", "value": 5046272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470694, "uuid": "88735b8a-1fbc-4b29-b880-28d248847da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470694, "uuid": "5a5057ad-16db-430e-b8a5-c448162cd06e", "value": "fa80031946a668346f6d076eec6ff710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06b5145-d939-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709455282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455282, "uuid": "e8fe4736-bcca-4362-886c-8fdf6ac2397e", "comment": "Malware payload", "value": "124bc3a45bd1b5b92eee4b288aee6316", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455282, "uuid": "6be4f925-d755-45c7-9a38-579adb09037c", "comment": "Malware payload", "value": "62b58cb5b1be8166803a00d15233f2aa9ac7e94a7b96365af22e2a573f5be05c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455282, "uuid": "a0311a29-c310-4412-9d27-5c955cc6e33f", "comment": "Malware payload", "value": "e33f1b91763631c789a0913f08c42edb310929cd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455282, "uuid": "c34fda28-2550-45fe-b00b-c30056aad01b", "comment": "Malware payload", "value": "9011b4ec55c2126eb08ca37a1414f7c67334ae99ac3b1578f40e70224cf1a70e34dd30b9d9bbf05b9bd252d8ee0e1cf1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455282, "uuid": "35c2719d-10af-4d19-8db1-0e981e679e09", "value": "T1E327335BF359A8AFC4BB25764E39562202930D660383ABE37D14B22D19B76D00F5EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455282, "uuid": "a7038124-2884-4ba3-9182-cf78d3966094", "value": "393216:5HJRhIDdbTQIIwuL2dl44JD+aR044So40MwNK1DzEWgM9KpwASW:N5IbkIIwjd1ZbvX0MwNK1NgM9CwAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709455282, "uuid": "74fb56f6-0c97-4dff-afff-aed24579a86b", "value": 22343104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709455282, "uuid": "07b29c9f-d55c-403d-ad27-c8ee4104b899", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455282, "uuid": "732a89e4-4e65-4808-85c2-e88d4e469d23", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a9fcf2-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471105, "uuid": "36856b36-a5ba-4fdf-900b-b2bbe7e9cd30", "comment": "Malware payload (Mirai)", "value": "05fc4eb8bd9e45c8972913f09c8c0f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471105, "uuid": "c57261c8-5185-4d10-bc8f-e668072b6a2b", "comment": "Malware payload (Mirai)", "value": "62e20f728643713a03eed83e7b435a68952218c4a14bfd16d0cd5d4ef3952956", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471105, "uuid": "ae2b15d5-83ce-480a-b5e1-7c9195538285", "comment": "Malware payload (Mirai)", "value": "dd232642a1527be7bc437ec4af6ac6c13b2604db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471105, "uuid": "91f48d88-86de-46fc-88f6-f884a685465e", "comment": "Malware payload (Mirai)", "value": "3c10d4a8cda0e6e794e0c34444cbf0f5a46077ddca48e9b26f2b354048db231caa018e144282723c77440cb354f4ab0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471105, "uuid": "2f516eb6-82be-4614-80c4-1784a0effbcf", "value": "T13343199BBB3C0B9BC4DB56F02CB737F08B69B95112950085A60EEFC40763BB06516F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471105, "uuid": "1a5f6fe5-4dfa-48b0-b5d4-b1b9a648ac0c", "value": "768:OLUOl8+kD0Oojcj/G+orDUks0+WwwCp0nI1qOR75NzKWiQbo:OLV2hicBorDUpXwfnIgOZ5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471105, "uuid": "6dece360-f166-4a53-8643-1e8ee56b57e2", "value": 57197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471105, "uuid": "c91b6cb3-acf1-4aff-9384-388ac98aa635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471105, "uuid": "a3403339-f41e-44cc-b7db-b412fc4cab0f", "value": "05fc4eb8bd9e45c8972913f09c8c0f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850ee441-d961-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709472336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472336, "uuid": "d456b657-8097-4d80-900a-7f190342f3c1", "comment": "Malware payload", "value": "b929a10eaea8ebc35ade26d693833e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472336, "uuid": "2305ed55-0fb5-41ee-867a-49b49f737888", "comment": "Malware payload", "value": "639e5529cd223a8df55f8f35f89ea18afb6800efe1def9376ae5e048ca084c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472336, "uuid": "9b9ff653-c01b-4367-9cba-39529f04bb31", "comment": "Malware payload", "value": "5c627a6905d6eb6aec20f523c45198bb4e6d72cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472336, "uuid": "d444cd3a-58a6-4f85-8e90-71dec04e590d", "comment": "Malware payload", "value": "0d8c862cf0b1233000eb50581e900c34aad3bac91126480e129c4604e078a9ad8b14d847d179c3c41f1862ab9a460cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472336, "uuid": "efe7002a-574a-4727-831b-487d1ba56b3e", "value": "T130458C0733A2C0E8DE6790F2CA295223D772741517389BDB64E05A2DEF93EA15F3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472336, "uuid": "e8a05a75-fd70-478e-874c-f79321496559", "value": "a649e6750bcf2911044dec744c57f40f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472336, "uuid": "922953cb-00dd-40e9-bd64-0adfaf60e92c", "value": "24576:XdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqz7:XdofGbSIQ177wZvYjiiRDXASat5RgsL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709472336, "uuid": "e28292d9-de64-42b4-8d13-7e8ddd187c26", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709472336, "uuid": "4aec5608-7d6a-4cfc-a1a5-5494a2e19f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472336, "uuid": "e79669cf-c7ff-49f0-9eca-5ecd891f88e2", "value": "SecuriteInfo.com.Trojan.Agent.22943.4868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0834315a-d97b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709483293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709483293, "uuid": "6f0da942-9b06-4f93-9c21-9139c7aa4f98", "comment": "Malware payload (AgentTesla)", "value": "cec230139ad2745a9fc15e02c6542e2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709483293, "uuid": "c61825c1-9ffe-4da4-b54d-288f671ae18b", "comment": "Malware payload (AgentTesla)", "value": "64887897dd3a2b278418cb096f83d7d1bf7ced1c118fef716bd8c6ec4fe91050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709483293, "uuid": "8751496b-5b5e-4c4c-9d0d-6a3eb1213652", "comment": "Malware payload (AgentTesla)", "value": "a32f05f294ee6ba0e713aa619f63bac3929c0bc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709483293, "uuid": "67cd4cb1-9b3f-4977-bea6-7840897e7062", "comment": "Malware payload (AgentTesla)", "value": "91020a4e62802f766c373ace741a2ab99efb045dd78a0eb6dc72aa22227181eb730fc09e4801e0aaf8dcb0768b50b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709483293, "uuid": "f251934f-10c0-428d-9ab9-0099487e513e", "value": "T10EB25B01BBE8463BEAEF87799DB116108133B6022907DB5F4CCD818F895F7D41712BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709483293, "uuid": "cf187cb6-99b0-4f40-889d-e26b7a5f7fa4", "value": "768:6YTLFV/TIo3J4bqBLW29ydo6fy+tJ1amp:6aLFVRJgu79UoK1amp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709483293, "uuid": "8e943236-ebdd-46e7-aed5-4033a8c02a08", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709483293, "uuid": "1a8b3e44-5410-4b6c-a702-2b53aa2e668c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709483293, "uuid": "bab12029-73c3-465d-a33e-8edc23d19c79", "value": "Urgent request for Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d038e383-d9aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlackNET)", "timestamp": 1709503815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709503815, "uuid": "cec4f318-1e6e-4562-a18a-0f753cf7416b", "comment": "Malware payload (BlackNET)", "value": "ad5d8a274eaff455047d801ee9b6231f", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709503815, "uuid": "20274cfc-e7ac-4a8b-915f-6bb76fb89f88", "comment": "Malware payload (BlackNET)", "value": "662344d80ecad59d7c9d4e0ad6864f8ccbbdf1a73321bc3ffeb24e5cec3e1bf3", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709503815, "uuid": "1fbd424b-c26b-4774-bbb2-f895749efced", "comment": "Malware payload (BlackNET)", "value": "1a43eb1ae77914cb58e6cffc8a4e8a1eebfee7d2", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709503815, "uuid": "f2bbd638-cd99-452d-b576-f61037fc7196", "comment": "Malware payload (BlackNET)", "value": "75a2eccff06e9105dcd085b3085d39ce65a6f134d90e12b9f9eb72908a2749ad0228bfb77a2ee0fb8a054ac0c4ea77ee", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709503815, "uuid": "2673b05d-c825-4652-8c08-c4997338f38e", "value": "T189B4E121BEC1C971D472193B5AF49B345A3C7D200B758EDB17A46E0E8E706C19B39BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709503815, "uuid": "58d9467f-d070-4b9f-86dc-f27684db3b1c", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709503815, "uuid": "05dfbf26-ede3-497c-ae9b-4be6a6f4808f", "value": "12288:uxjrr7F5qfMs8WdcOX+t4c08no9IaJnv+N6G/wWEh59ma4:uxLsMs8WdcMx8+I+TDV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709503815, "uuid": "df889189-5fbf-4fa7-8e5f-7e4c78da05d6", "value": 505153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709503815, "uuid": "d2215442-75ea-454a-a62f-bcf7843dc7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709503815, "uuid": "4d7e1dfe-f20b-46e9-acf2-2038366b14c0", "value": "AD5D8A274EAFF455047D801EE9B6231F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7b7a85-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471090, "uuid": "cd14e8ba-a04b-4c2f-bf89-f13478e3f7a4", "comment": "Malware payload (Mirai)", "value": "135e2deec8e0d436407dcea4aa47b2ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471090, "uuid": "6c9dc0bd-4633-438b-82ee-c7e848ca1115", "comment": "Malware payload (Mirai)", "value": "69bbcb2d4057e29b4a171ffd3efc33cf47514424e395b25d6089d018f2e655e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471090, "uuid": "13deb469-f05e-44c6-ae62-e7fcc5fa8132", "comment": "Malware payload (Mirai)", "value": "e3ae29915deea3250140fced9aae883117df94da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471090, "uuid": "8b110ea2-096a-45f2-8cc0-07bba109f9d6", "comment": "Malware payload (Mirai)", "value": "fbb7743894213ae5ca9636472ac002784be95dc2495636aeb90fd9ea5faa8021828747dd5c106de986b48dbba575b264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471090, "uuid": "b3357df4-450c-42f1-9f94-ae17edd70773", "value": "T1D17366797A61BBFEE67C82304BF36F70C35221923A919345E26DDB184EB124C1C9E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471090, "uuid": "d2cdef60-569e-455e-bb95-5b3b4b635a8a", "value": "1536:1OV8dSnOdMzLbHYSd1xVCkxff6Wkpc+FAcvJHCEev+KIRllwzE2mLp:m6HKIRM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471090, "uuid": "4cb2eddd-6c53-4496-a63f-88027665e44c", "value": 79843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471090, "uuid": "a3cdd4d6-40cf-4a00-b61e-fe8eae5fda1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471090, "uuid": "c4a1a597-5f57-4346-9a73-7057abfeb083", "value": "135e2deec8e0d436407dcea4aa47b2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a9865c-d8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709430023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430023, "uuid": "1aaac60e-2d2e-4669-b0af-bf000e4b36e3", "comment": "Malware payload", "value": "8be9a518d5e5d5aa5f2fe7f0b122f901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430023, "uuid": "675fb1c2-2562-41c5-8d5f-f6a2580bc5a2", "comment": "Malware payload", "value": "6cd56f8b0f3051ce9f26ae38ad4a63cabb913380a35741028bdccb78ac5b0edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430023, "uuid": "0d87d310-3206-49d1-a04d-6a9b14f54b5b", "comment": "Malware payload", "value": "398ffdbb4cec5b16d5ef43200ff2d91167e97ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709430023, "uuid": "a9cda14d-2ba1-44e3-9e08-1d676eb1d317", "comment": "Malware payload", "value": "b7f632899457469cc89fb4c21d28c304a7eaf346c52f504f53ca458d80084e5b417847da015f5aa8c17161023e56355e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430023, "uuid": "ea0113b2-db3e-4351-b8ec-1c1f15b8fe68", "value": "T129E4AF21F5C69036C2B327B19E7EF76A9A3D79360336D19723C82D215EA05416B3A733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430023, "uuid": "20514bd1-e276-40eb-816f-b858c63f1ae0", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430023, "uuid": "b24bccfa-9fc9-4556-8d9d-bf991a0af0d9", "value": "12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCURfc3D:uRmJkcoQricOIQxiZY1iaC2c3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709430023, "uuid": "249e22d4-e015-4322-b4f4-be030a9d6408", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709430023, "uuid": "ac28a1a0-d79a-4ea0-b717-ebf2b6ed9f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709430023, "uuid": "374f8db1-2498-4b8d-a5bd-1a336fd188c5", "value": "aL4N.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd51a5a-d98c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490661, "uuid": "f217e916-7b45-4f47-91d8-9bafa066f617", "comment": "Malware payload (Mirai)", "value": "2f72480da79583024af2281411d5a24d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490661, "uuid": "ca35d063-1aa1-4e8e-a332-98891c79e9fb", "comment": "Malware payload (Mirai)", "value": "70767ddffc5a1a23c07e4eb479476d15c14a61a0c70bdc5bbcb8e6196426301e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490661, "uuid": "50960e31-546f-4ad4-b7df-23c6238e1f6e", "comment": "Malware payload (Mirai)", "value": "63688bee5f4ff6da40c8d00a0a478546bb8bfa84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490661, "uuid": "7196c979-4b9c-4e3d-9ca4-c8b5c92e6aab", "comment": "Malware payload (Mirai)", "value": "863dc5134fcf8ea848039dd63ac7997f88560d3a3d7c642f6c052174064a144e6cf9bc4b50608200b9b144cc10e9f872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490661, "uuid": "b7ecfc19-10e5-420a-a5a6-2a32eaf4ee89", "value": "T1C9435AC4E683D8F5FD6601B51177AB778672F13A102ADE43C724E832BCA2501E6573AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490661, "uuid": "d41c42e3-5473-4a54-92ac-06a50304ecc3", "value": "1536:rvYRLS/4JWr5q79VufU0K1kVU94Sx7DF0DDDKU:rvYRLuvm9Af1IkY7DF0DDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490661, "uuid": "8c20ba18-cda6-4a93-80c1-b9457ff4b2b8", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490661, "uuid": "e4eb0c5a-ae1f-4985-a69d-f89cf252520a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490661, "uuid": "d3296f7a-0321-4535-8422-b613b9f12d37", "value": "2f72480da79583024af2281411d5a24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfffe7ac-d97e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709484917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484917, "uuid": "b5a82e93-12b3-40a6-b16c-d67fa13d0f30", "comment": "Malware payload (DCRat)", "value": "a67f060da7dbb7ed46c0e48079ab0121", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484917, "uuid": "70919cd1-b396-4ab6-87d9-734a3f038a0f", "comment": "Malware payload (DCRat)", "value": "71edef897009034cbc3e881b647df2207731c2c301159cc4d04e78b564efd53a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484917, "uuid": "f2fbc5a7-cb42-4732-be6a-c345d237d300", "comment": "Malware payload (DCRat)", "value": "664035db66a7982e5cfd0ae4eb84cec806527413", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484917, "uuid": "11dddfbf-edda-4c79-a477-97140d76e589", "comment": "Malware payload (DCRat)", "value": "5222cf252ba1263e9c9301fe323e507ebdc4257689da89d7a8bef5a6c346f22005d4b124f5ede43807ba0bd6c995c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484917, "uuid": "b6f59159-e1b5-4266-9438-090e132561e5", "value": "T195952341BAD186B3D43629367676AF12653DBD201F25CEEB33E42E5EC9315C08A317A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484917, "uuid": "983267c7-62c7-4a3c-87b1-9bb89ebaaa44", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484917, "uuid": "5897223d-a5d7-4bbe-a09c-52cbf3b3c998", "value": "24576:2TbBv5rUyXVn8gk96hBPzG6dwZ1Lo25i7raZR4JjccVFBK0UJEnXAiY4Zy/Jg3y3:IBJ8mm201LdivaZ6AcdKtJEnQ16M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709484917, "uuid": "e11a856e-1f86-4c1c-a80a-73787d857db4", "value": 2001407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709484917, "uuid": "1d4fa5eb-2292-4825-9ba3-103b17bb7b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484917, "uuid": "2a1dee64-8d68-417c-be38-a217aa177e64", "value": "a67f060da7dbb7ed46c0e48079ab0121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d18075-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465007, "uuid": "38b63aef-d3ee-43ea-866e-b0340dffba27", "comment": "Malware payload (Mirai)", "value": "9a0ce45315c6c3a498b05e69b594837e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465007, "uuid": "43bab781-2bf7-4da2-a9b6-c88b247a995c", "comment": "Malware payload (Mirai)", "value": "72571f3e08306028c4f23cdd5a734015600686192b80d707817769b3dc4cdddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465007, "uuid": "0ee574d8-d7d5-49a0-99fb-87b4bba96f9f", "comment": "Malware payload (Mirai)", "value": "2b4685c5cba50e1101102f1bce3da6fad7ef6324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465007, "uuid": "7aadd075-591c-47ee-b42b-08029e4247c5", "comment": "Malware payload (Mirai)", "value": "4114268186aa1c19bf768d16155896181dbf070fb2ddc6ab27de551d59606c72ecd8a5daf660d9f8a00ad24ab4428a90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465007, "uuid": "7d4f9320-f62d-480a-af3c-ffb760b6e194", "value": "T12573AD33D1686DA8D0668B75B9988E309B23A28416933EF6D794CB784013EECF505FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465007, "uuid": "46ff9a28-34b6-40e3-930a-9eed8c61e05a", "value": "1536:9aD/MEGvbwt+i7EhH/Jn8C/0rrnmFWlrKkNGIkFgCJl2c:9OkdzeEhfJ0rjblOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465007, "uuid": "de86d4ae-4a8e-412c-94dd-b7d6034f6f44", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465007, "uuid": "55383525-1749-4559-a530-d79efaac05f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465007, "uuid": "b41227cc-b386-4da5-a1db-86ca0622b338", "value": "9a0ce45315c6c3a498b05e69b594837e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59a9dcb-d98a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709490107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490107, "uuid": "d52d1adf-f1d3-4e95-a8a8-4795f9476522", "comment": "Malware payload (RiseProStealer)", "value": "a3dc205698519d6ffa7e18ff98dca6ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490107, "uuid": "66ea2aa5-f73a-44d8-96af-f9182c072005", "comment": "Malware payload (RiseProStealer)", "value": "7458cd87185f80358d350fa8dbd4a9efcc072df17654ea87d93127fd598c3545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490107, "uuid": "f5169302-3e47-434b-aabf-c8a9ad577752", "comment": "Malware payload (RiseProStealer)", "value": "bc6a193dd89f666b948f87e59a0d16a2599983d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490107, "uuid": "64d0335c-62ae-446c-bb74-0088aae5d132", "comment": "Malware payload (RiseProStealer)", "value": "e213223f10de04f07da0df3060f5468c473bc7907d1fe13933b8f7a5944c574725d4c8b989e0569ddf37b6d483ad0467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490107, "uuid": "5a94113a-d67d-4118-90f6-5f1d18400b6b", "value": "T151B533DE39580A08E7C13039958A4BFCFAE750C065A5E3C7B1CE1ED21BE980DA85DED5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490107, "uuid": "eb615a57-70c1-44fc-bc2f-39c79cfb06e7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490107, "uuid": "b3ecafe6-1e3c-4042-b1c3-516097a4e796", "value": "49152:47xRMd7o1qptkbvfgox/Kk8HmE5O7UvBpGqkADDh:S7LdvoaH8Syrks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490107, "uuid": "ea632dd0-375d-413e-a253-8d0a461e8dcd", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490107, "uuid": "747ed627-92ee-403e-8cbe-3914c4fefa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490107, "uuid": "04b14b16-6e9a-45ad-af4c-8ee9b4276327", "value": "MSBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c325074c-d96e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709478023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709478023, "uuid": "5aeea085-f71b-4204-84a6-8cd10f2670fa", "comment": "Malware payload (GCleaner)", "value": "a133e50062dc1460cc38f281f6209403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709478023, "uuid": "29195a0b-fbeb-4042-a092-cb616e291587", "comment": "Malware payload (GCleaner)", "value": "74b316db9c08f5eb7fe8f336eb9d85274048de7596b0b42bf20eea995c4ed4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709478023, "uuid": "1c858dc3-1cd8-4681-a1fa-f87db2181f77", "comment": "Malware payload (GCleaner)", "value": "80edf2fa87fd06dc2e70c88bf44673d32ca5b36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709478023, "uuid": "1b6996d0-9bc5-4cf0-a02c-a5c7f0a5132d", "comment": "Malware payload (GCleaner)", "value": "dd1b93a02b71bf388031b4fea13e7a72c9cfddf1db071256e8904b0261d0ca587e97d993aa8eb9ae4d5d11ff18ca7bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709478023, "uuid": "f414b6e6-c5d0-4ae2-af61-a6067b96b650", "value": "T125363331E3A57018EFA1E437EC5E74C49FA352205B8E7DD2964B630F8C95A43E0226DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709478023, "uuid": "f2391b81-1d55-465a-ad31-39a12fdcd121", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709478023, "uuid": "6996d1df-a576-4f1f-826c-e7eb8299039f", "value": "98304:Dbo2uA3UDoNCIbuTXjKPh6pFkyQc9F+HzLrBfu2gEY/1GEjnZ49KdmRVziIn:DUlDoN5buLjK87kyQc9F+H7OXZ493VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709478023, "uuid": "a688fb7c-5815-41ee-9a28-d5d126dcf407", "value": 5237850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709478023, "uuid": "ef5a13ca-4b0f-4019-85b8-072831f6c157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709478023, "uuid": "398d7402-2810-4af4-9104-02be81da6359", "value": "a133e50062dc1460cc38f281f6209403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b7d5c6-d97e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709484767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484767, "uuid": "91bbaf1b-e147-4aef-86b3-60d5e1fa7aa4", "comment": "Malware payload (CoinMiner)", "value": "6fa71cf205e41cb2a2b34fd9ef306d16", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484767, "uuid": "0622b9d7-81c6-4f17-9575-dec043f15bfb", "comment": "Malware payload (CoinMiner)", "value": "7636a9c970b9f730fd6d7dbff1c5b9463052528dbfd5813517e7de461c374cfc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484767, "uuid": "deac6901-2e2f-4f74-abda-002945a074d6", "comment": "Malware payload (CoinMiner)", "value": "4dc86165a39292d135744b16a4d572f0e3358ac0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709484767, "uuid": "0a3f6483-3e05-44f2-b15c-9dbbc5e8c80a", "comment": "Malware payload (CoinMiner)", "value": "fa7500d25f1ae31f1fbbe2055dcf9a56aad2b7f51eb6dbd60036d14ab53796a64a2a06eeb285712658c9f64fffd84894", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484767, "uuid": "ebd0de1d-0503-420a-a452-73468059b2b1", "value": "T19F95336CF25BF51DDC32913815C2E7CE782810AADD9393FF4CD4D5A19A8A81192BCD3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484767, "uuid": "29567e52-e9f2-4a99-b785-08017b34ef91", "value": "24576:64ytFs1+R3TwVrWmFJLQGzd20J8KnnLJJJ0PWCLyqYXVtRwn9vj/fH+1umPi7AwA:6LwD5WmFJLQGBv8QzY3d9b3cuZp3Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709484767, "uuid": "98faf989-a316-4ebf-81a9-99428ee2cd7a", "value": 1902456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709484767, "uuid": "eb050e95-5770-4d92-99b6-f4dbf30d4f51", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709484767, "uuid": "45c9a6c7-d865-4d07-a3bd-c95c74a6bb57", "value": "redtail.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c925771-d95f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709471409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471409, "uuid": "5c8f3957-401e-4e52-b918-193c34e76a67", "comment": "Malware payload (DCRat)", "value": "80a7a47fe58565122f30d589ecfde1ce", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471409, "uuid": "c09d14db-f02e-4178-b8f3-2014c2c85784", "comment": "Malware payload (DCRat)", "value": "7844a850ebcd3e06f1eba438b8a45469c436c3e133ece1ec050ed8cd54b16b61", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471409, "uuid": "5dccadac-d3f2-4c08-99d7-40b4d6a2c408", "comment": "Malware payload (DCRat)", "value": "110a8179a1b7ae528e605d8a85c562bad7103146", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471409, "uuid": "6a566b92-62dc-4740-b790-3d4f56a63707", "comment": "Malware payload (DCRat)", "value": "1beb833afc4f38a75c3053c75cafcff3c60655a62943ac5a1d05afa5e40ab9ae47893d59a79013798d3e382e2b44920b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471409, "uuid": "a6b3f032-ce6f-4145-8da1-6ae3b66c681b", "value": "T1A035181039EA1136F0B7AFB159E5695E87AEF9E37B168FCE304042CA8712780DD5173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471409, "uuid": "4b4bb15a-c866-4ed5-93d1-af95b101290c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471409, "uuid": "4e083563-643f-4651-92e3-a3e116e6a136", "value": "24576:2TbBv5rUyXVR4X+NT2pdDyb3i7l/mDA61+p:IBJWX+YHyb3ceO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471409, "uuid": "cc634739-8ea5-40cd-b25e-a23f09e96c98", "value": 1073354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471409, "uuid": "8d9cf298-9815-4a95-b3a5-13de9e79e6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471409, "uuid": "e2f0d641-a889-4124-86f8-e207ad5bf738", "value": "80A7A47FE58565122F30D589ECFDE1CE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e17773-d98c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490670, "uuid": "2980051b-6098-476a-bf41-f4f1667409d1", "comment": "Malware payload (Mirai)", "value": "b87fb2630c46da7d6089202ee61c3783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490670, "uuid": "3304db86-117f-4a4f-85d8-2719cee4283e", "comment": "Malware payload (Mirai)", "value": "78a790cdadf09d2445bd7af612275f517826366b9c915a8190f9621f5726993e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490670, "uuid": "cc565f22-a831-47de-91d7-7562c6e7e2d3", "comment": "Malware payload (Mirai)", "value": "ecabbfc5c399733045380749b1c82594e8bdae7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490670, "uuid": "167f8f49-97c8-42c5-b138-c11550e2608b", "comment": "Malware payload (Mirai)", "value": "bdc709e7f63133b6075dce4d9971aaa8512a16e8f104f952eb7bda933ce3499aa9136145cabec47e384ae2e5664010d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490670, "uuid": "23baac39-aa1f-44da-aacb-90062acb3924", "value": "T1EC4339C1F54BC0F5E86308715036F73FCB32E5294076C65EDF9AAE2ADE23641A626249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490670, "uuid": "1539aaf3-43b2-4188-be3b-f9f3396852ae", "value": "1536:ALIYVM+iBXouF0K6C2dULWMKnsVKHKWCIvByma:AUYV2BYuF0K69dnznsVKqW1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490670, "uuid": "ff1d9979-aaaf-4d4f-870e-97296508b4a2", "value": 59120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490670, "uuid": "5b60ddf4-1669-4bcd-814e-2cdadbc2d399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490670, "uuid": "78e60cdd-a9ae-438e-a9e4-9e0d818594f3", "value": "b87fb2630c46da7d6089202ee61c3783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5726722a-d956-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709467534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467534, "uuid": "fad0b5c2-1eec-4e12-8a74-c3af73683e0d", "comment": "Malware payload (Mirai)", "value": "d99e356a8a90d2ec869fe910008d5076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467534, "uuid": "f911c998-8562-4df8-8b48-8d0cbe253375", "comment": "Malware payload (Mirai)", "value": "7a024331b1d877c7c88498795f3529def55d214b0c32f8f011122405adbc7135", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467534, "uuid": "63f27886-b7e7-4176-b965-9d63261edeeb", "comment": "Malware payload (Mirai)", "value": "4174d0c28390ce88c030b07014056303f29b7d4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467534, "uuid": "59bd290b-ed6f-4aa2-9bf7-3b9fe78ae36a", "comment": "Malware payload (Mirai)", "value": "de4e02acc49fc68958bb5f6e92db8e3a075fe8daf1261a4a8e6fd71ebc011aa8f15870c6d3dc0d8c986406193391d2d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467534, "uuid": "810c1bb8-6209-4fbc-a566-e722e4e96464", "value": "T11473C71E6E218FEDF769873147B78E21A39837C636E1D681E25CD6011E6034E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467534, "uuid": "1cf73384-178f-4150-b246-cec77074063d", "value": "1536:IMqgA2jBna39tk+AGPYHxLm5ehXehsGhdesHsFwP5Mh0DIu3eUCoM:IMqgA2jBnaPk+FPYHMZHrP2boM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467534, "uuid": "4ad456bf-c088-4eff-b11f-dd1f6d355695", "value": 80580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467534, "uuid": "6d27d7a2-3c10-4790-a1be-0b58641bc33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467534, "uuid": "e6117a19-dc80-4206-bb92-d28d4be25342", "value": "d99e356a8a90d2ec869fe910008d5076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b660bf01-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471130, "uuid": "c530a0da-9dd8-49e4-9993-01684ad0b0aa", "comment": "Malware payload (Gafgyt)", "value": "5e962d36b4af4b282f3234d9fb7f743c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471130, "uuid": "cb0a59f6-b198-4643-b32c-a9310c57d074", "comment": "Malware payload (Gafgyt)", "value": "7bf1ba4c5536f27ba7c4c317bb8003ab6f65354f1890fd24728ed2f467ee1495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471130, "uuid": "042920b1-900d-4c8f-9cf2-2f61c91a2937", "comment": "Malware payload (Gafgyt)", "value": "63e30630e1c23e4a8b0aa7a7368ada16a22ddf4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471130, "uuid": "7a412503-c5d0-4ab0-baaf-59b975ed6b18", "comment": "Malware payload (Gafgyt)", "value": "41241fff8cb37b0a8073bb3dda223c05a0f55903ada3585ad7facf4b5b43ed60e4f9c6bdd6a5513f6a4b93ae52a11de9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471130, "uuid": "07032951-a3bc-4924-b985-936fe755a1ca", "value": "T1DDE3966D3A11AF7ED26CC2310BFB6F70D35521D626E29355E29CD7481EA038C9C5EBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471130, "uuid": "987c9786-c59d-4bdb-aded-174c7e80a959", "value": "3072:Gyik9SZ8Lyjl5lpKD5hXA0z2WhA3rMsBRTFCj4jM:O2SZ8+BTkD5hXA0z2R3rMsBRTFCj4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471130, "uuid": "6238c3f1-ab92-4f43-a335-69b4d48680f9", "value": 153082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471130, "uuid": "f675acf0-f088-4bba-821c-e44e80fb7200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471130, "uuid": "bce1ef20-3d8a-4988-ace0-c28a61365e40", "value": "5e962d36b4af4b282f3234d9fb7f743c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903390ef-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471066, "uuid": "44c67d84-7e3a-4744-bfed-1a89453dc1af", "comment": "Malware payload (Mirai)", "value": "00c4df9e5d1430f2384847070c85950e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471066, "uuid": "f3ca639c-823e-4e97-87e4-e001f6b074b1", "comment": "Malware payload (Mirai)", "value": "7e2f228acb6a0f3fb559a30bba1e3771505817251f3e57b2d9ce0ddf7b9956dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471066, "uuid": "34f2f8a5-f6a6-4f45-8c8f-2d747047c6f5", "comment": "Malware payload (Mirai)", "value": "968bc3d7eacdfc816ffd26173da3e488e132ebc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471066, "uuid": "36386977-afe7-4b72-8afb-a1a6282a7a97", "comment": "Malware payload (Mirai)", "value": "723b7e6ad29eda592f611aedbeb34fe0ec8e47830f6338300cca2394731e42548285e79f93ed90a8b918a8613c80b4cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471066, "uuid": "e4cfdae1-1d7c-49ce-bd5c-a00039f73e8a", "value": "T1AC53093E2B171F63C4C9017145F30335BAB6E71978BD8B53E8A06D686F06A98345A3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471066, "uuid": "6cc1c521-1a75-49f0-ba45-5940ffc6302a", "value": "768:eT5koYmNi4SjduCJmAeWqWyW80osBd4X4YwnyO+Eee4My0A9XsvPChA6be:e57PKvBGX4YwnwvhXsnue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471066, "uuid": "ae7c88bf-a49a-49ff-b138-88829192a6e7", "value": 66465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471066, "uuid": "db088dc9-e888-45fc-9dec-2886092a63f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471066, "uuid": "e8ce90d3-84a1-413a-9f95-089a6184f6a5", "value": "00c4df9e5d1430f2384847070c85950e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f74e61-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471055, "uuid": "eace638f-224f-48c5-8701-6dbee15d0016", "comment": "Malware payload (Gafgyt)", "value": "1b6702d406b8e33db41a7f759239276e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471055, "uuid": "2c803fe7-f003-4f8e-8175-5a63d97c959c", "comment": "Malware payload (Gafgyt)", "value": "7e3cd889cbec5f96f624cd4cca32ded06310b18c02f8a17234247da30cb9fe27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471055, "uuid": "6f07fae5-407e-42f3-8875-6d626440e9a5", "comment": "Malware payload (Gafgyt)", "value": "c000d10ca9d2237a0caaa3d9a15188f0622806bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471055, "uuid": "6294fb14-f619-4477-a130-d98cb3b76793", "comment": "Malware payload (Gafgyt)", "value": "c6cccf9ee65f80b86e2b3130a39884f306eb0451537c4485f9dab188a7a5da6718d35ea0cddbc0264eda62e3c1d6d3ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471055, "uuid": "750048c0-5bbe-4bfb-a06e-f6bc065fde2c", "value": "T137B30905E8408B27C2D267BBEB9E478E7B3597986F9B332256295DB02FC17483E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471055, "uuid": "b9ef81b5-c840-4c05-98cd-99e664ede99b", "value": "3072:dHrcUt7q0dEK52a0auUOC4O3y7Kce5h+CeZNc8NpoQA3llEShM:1rT4O30re5h+Ceg8NpoQA3llEShM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471055, "uuid": "996abd6b-85d5-4372-8bc6-592b494664c5", "value": 117461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471055, "uuid": "5faf9ab8-34f9-48d8-ae89-0e4827a8031a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471055, "uuid": "3f10e66a-4dd7-49c8-8ab4-f4002b9b5684", "value": "1b6702d406b8e33db41a7f759239276e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0967de60-d949-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709461820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461820, "uuid": "d1a95b40-e635-4e3f-82bd-f04a24f0abad", "comment": "Malware payload", "value": "b9fc9f350e148ccff6f2d493e3ae97d6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461820, "uuid": "18e984a1-1748-4ed8-9255-b943cd66973d", "comment": "Malware payload", "value": "7e5662e38938b77d6de25ff86504b5c61f7cb7f4c77f66108a06456976cfb28b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461820, "uuid": "5be360ce-eb4e-4f00-b3fb-89b3d8c757ba", "comment": "Malware payload", "value": "fe6aa125ff3d22975fc41784144fe154e8d9bfc9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461820, "uuid": "de15815c-1671-4090-95c0-984f45d98f9d", "comment": "Malware payload", "value": "80b4c2ed3bafa57dc65265287976b205db801e2f9bebc0c67d4c93fd90121a1a35c84cb36d97c737eeb84a280f57ac06", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461820, "uuid": "608ca799-1d7c-44dd-b019-98a57dec2e64", "value": "T19CE02BD0AA351B43E0670D71A1F553A3C6FF807B12547D5E111B64195DF3A700A40685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461820, "uuid": "be6fc805-fdd3-4a4d-ad0d-a10339429974", "value": "6:5jG4AzVtBpIcu9imeF3gel5iGCLJwFAD2l8WtBzVtBEt+lRlX:5j1GTmcu9ipRn5i91lazRTEtaRlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709461820, "uuid": "b5ac5238-567a-44bf-b76a-a44b65f75bdd", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709461820, "uuid": "daf2a584-f3fc-4ba5-aab7-ab2118a875ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461820, "uuid": "b7193f6c-0c0f-4309-b0f2-e3c3a79e2c01", "value": "b9fc9f350e148ccff6f2d493e3ae97d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0796555b-d957-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709467830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467830, "uuid": "7a4d4f78-7eb1-488c-bf3e-9612dfaf1990", "comment": "Malware payload (Gafgyt)", "value": "96184e16543d01fc2812fddf6ac5a3c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467830, "uuid": "cbfb46ef-64ef-478b-901f-113597b04ea0", "comment": "Malware payload (Gafgyt)", "value": "8045a4621ee542633a04a90e26d1fb853fda0347ea4c7621677c8db748f9f1f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467830, "uuid": "1a0cf452-2ef6-458f-918f-8c00381a70ae", "comment": "Malware payload (Gafgyt)", "value": "b7f81efaaa11a84ea944e41f59bf509a051b3f03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467830, "uuid": "dc0a6ad9-a49a-4d7a-919e-0591bdb95f7c", "comment": "Malware payload (Gafgyt)", "value": "63d2a36e868878e755d40bd9bf42c2fbed810755d336758e77b1014f3bd3c51de2dc38c092d3fab087fc4498eb4bb7e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467830, "uuid": "baaf1baa-10ae-46f6-a6b9-8ff0f8d6c613", "value": "T189338EB3D87A6DA4C14887B0B9358EB42B53E194C1972FFB4956C2799043DACFA093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467830, "uuid": "e22038f7-f0d8-4be9-9ace-3d56a360b509", "value": "768:KOwtD2H3x/qKU8601soDkQ/CK1rKtxD9raMHa6oQW7iCxISdUfl5n4I:KOwtDGvrt1z7/LKtxDQMHadX7iCxK54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467830, "uuid": "8cdda8a3-6d18-4018-a825-461ee3509258", "value": 54472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467830, "uuid": "1f6f1921-ca2c-4837-b61b-d5270febd70f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467830, "uuid": "620fc5b4-0785-46e0-8e52-c668fcc7e4b0", "value": "96184e16543d01fc2812fddf6ac5a3c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8690b1b-d94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709464691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464691, "uuid": "1f353329-52ff-4a07-97ab-8e0f63d056aa", "comment": "Malware payload (Mirai)", "value": "76468aa9c08f3dcb0e7780cda4242480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464691, "uuid": "2162612c-735a-4ad0-9065-49ca3ad63d71", "comment": "Malware payload (Mirai)", "value": "86036011c85fb22d9e2732f04648a2a4d35264696f6fc3dea57ef35f23937ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464691, "uuid": "a67f5e24-babe-4a0d-af4a-4b664cca0f96", "comment": "Malware payload (Mirai)", "value": "3eb72e3c2237486deb935c4087756b9ab69bc2b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464691, "uuid": "177337e0-fa8a-4c3e-8aab-5e17c1dbaf94", "comment": "Malware payload (Mirai)", "value": "5cd12a0369c82191aae1a427dfb53679fb0a84ccbf2cb4d4ed3896e53aa6f83b0131e2ae392c2586123d8182400ac766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464691, "uuid": "82c031b7-c040-4da5-bcae-cccbb9f9a20b", "value": "T1D6735A01B3584A47E5A61EF4393F1FE187BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464691, "uuid": "a203d247-08b1-44e9-95d0-488bdff57419", "value": "1536:DNpp9RXI1vgi0uvL8zomzyKRyxOReqpNiSejOjNfXM:Xp9djCiomzyE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709464691, "uuid": "ab3f6cb1-e39e-4843-a79a-5ddef212cc5e", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709464691, "uuid": "75124b5b-7a54-47c3-95d4-f060d4ea5f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464691, "uuid": "ed2b6f11-7f03-4b6f-bf24-f2556f422c04", "value": "76468aa9c08f3dcb0e7780cda4242480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a0b9c1-d914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709439339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439339, "uuid": "1a9e6734-6d33-45c6-b9fb-b83b7f4357a9", "comment": "Malware payload (RedLineStealer)", "value": "0e0225b03f164fc9cb9689a284a5c785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439339, "uuid": "b2b3b4ef-eb54-47f1-b4b1-e1b01e19cd23", "comment": "Malware payload (RedLineStealer)", "value": "88dc09b808718d7f9f1d32246c5a1db18effa7886f4bf8866ea18dd1cad9835b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439339, "uuid": "0b160aa5-57b3-4325-9262-658c2a6a0092", "comment": "Malware payload (RedLineStealer)", "value": "63fc22c1797f3b7e0f71e411344ce4c878f2a530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439339, "uuid": "a39bc8e6-6a05-4d28-b078-a4f75a740e96", "comment": "Malware payload (RedLineStealer)", "value": "2d4ba79a512a8b539a31c7d1624f297a59a6e37211f303d7a0bca93561f280dc6890e6e7bb474edbb0f829489c7f91b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439339, "uuid": "62bffa2d-bdcf-4301-bae2-74e065bf7f47", "value": "T135641250939BD53AD84988B06C03521673B6F30C5F278F5B188E31EA5ADB70F57C56A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439339, "uuid": "1fd48f91-3dd5-49f6-b5f2-d5cd8de51063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439339, "uuid": "86b04069-aa0b-479b-b0ac-d35a3a7c5990", "value": "6144:wd3DjlOjCz244D3asXcLfb7qsxMDfPe2HrO1QlyJmkJ0O6:wd3DjlRFmMbay+kJ0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709439339, "uuid": "9700dd86-c4c6-41f7-9ad8-30b9e84d84f5", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709439339, "uuid": "4953f617-384c-4d94-be9c-58c1cfe71d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439339, "uuid": "92f5d0a8-fcef-4437-8d42-d86a0e7d11f4", "value": "SecuriteInfo.com.Trojan.PWS.Lumma.125.18832.15020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4500b70b-d9ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709504870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504870, "uuid": "5c156565-e922-48d5-8a69-46c4a2a0e0d5", "comment": "Malware payload (Adware.Generic)", "value": "5e312d3b677e7e8c699b1d724f8cadfa", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504870, "uuid": "c79d9992-443e-462e-8f0b-82242049b214", "comment": "Malware payload (Adware.Generic)", "value": "896bc923098c0e59a04d004c83812e487870c370ae1bd19e1841afeb6f204366", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504870, "uuid": "6d2ed328-f058-419a-9a4a-a9cb7a6bab41", "comment": "Malware payload (Adware.Generic)", "value": "5acade5bbf96d43cd212e2379ecbd4923d0dd44e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504870, "uuid": "2885fefe-9db5-4696-bf3e-676cb20a8e94", "comment": "Malware payload (Adware.Generic)", "value": "2ef3a8830e71c868ba0ff4fa7d94d3d0dd3051d7c342c199a7307b14e368dd9b98cb2bd265dda8577f6b3fd5593dc756", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504870, "uuid": "e5edbf11-fc61-4ea7-a3f4-1ff2c962decd", "value": "T1B906F13BB658253ED9AE063246735750DD77B6A1B4268C2A1BF40C0FFF265300E3B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504870, "uuid": "b417a5de-46d3-4df8-9737-08005fada78f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504870, "uuid": "d8ad1c1e-2044-45e3-b4fc-11490eddcce6", "value": "98304:8kLZGLloT7QYTRRx5yNUjlMJ2KWd+8BprX:7ZmloTbTRRny4KWvBprX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709504870, "uuid": "7080190f-87d8-4ef1-bc37-243ff82068b7", "value": 3844243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709504870, "uuid": "2985858b-193b-4bde-807a-2f39e1372272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504870, "uuid": "9262448c-14df-421b-97e1-78b16d785fd6", "value": "SecuriteInfo.com.Trojan.Siggen18.24073.25338.14836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d551b3f-d939-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709455116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455116, "uuid": "04fc23c9-3b8d-414c-8db7-3b0b63bb7c5a", "comment": "Malware payload", "value": "0e3be3e373dfc389c07e52806dcc0bd8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455116, "uuid": "ec45b01f-45a7-489f-88c2-e74aa614c527", "comment": "Malware payload", "value": "8a1a55e957f7afe3e37807008f0f1b026ca0e8f88f67c0d2381b0f825eeb5c2a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455116, "uuid": "2b663cd0-6065-4dc1-b62f-3d04c7adf391", "comment": "Malware payload", "value": "5635ea39ae1ad9cc466a248fc8c8908e65a435e5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455116, "uuid": "52156ecb-e000-436f-bed0-2b28f909addc", "comment": "Malware payload", "value": "3c4c82ce20c96fcd9ef8ba77fea6d84ca64798e3c422fa86782253efa19836e5a86af7b8a1ef9428bef2b391fca89dfe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Jocker", "colour": "#EDE6BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455116, "uuid": "968c748d-7c04-460f-9a7f-2dad3e2ec05c", "value": "T143962393E3ADA45EC8F6863646B9556206A20E608617E7D3394DF27C2BF39C09F45FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455116, "uuid": "f76e8c33-f6a7-440b-9d31-ec8465688699", "value": "196608:tMjL/BrvAuVwhp9gCB7tSlcfSzYsfLblVw09F:tM2uap7Scfkfrwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709455116, "uuid": "73c4e9e4-0d24-4866-90d7-e13899a3ff30", "value": 9211109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709455116, "uuid": "87ecfd54-5a72-4904-9642-2e6197fdb1bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455116, "uuid": "42534c22-cdba-4bc9-843d-787f6e68da17", "value": "com.gameschill.theLittleMermaid.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482dbe95-d9ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709504875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504875, "uuid": "24528b85-c847-47ce-9956-40ca5cc55077", "comment": "Malware payload", "value": "82b2a7cb8bcc8691b155a66e59fa478f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504875, "uuid": "13bf473f-3206-4fdf-86be-fd962753fdeb", "comment": "Malware payload", "value": "8aabb51fecc97e319b4fe279d9117f51ac3e136ffab222802aa0cce29ae5e8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504875, "uuid": "7275ec68-c1b4-4dc8-b9a9-1fd14ce01aa7", "comment": "Malware payload", "value": "69d363357684d8625a1283582a33728926c0823a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504875, "uuid": "ae9c9ceb-3963-4a2d-84c1-dd3ff518678c", "comment": "Malware payload", "value": "cd06808abecb499b84fc618ed2650a544f636512d483213d9a55b3389097e91d109018ebef19c5cb561916430ca244bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504875, "uuid": "125ace7e-c85a-4859-9842-fd6899819af2", "value": "T1AC07333166C57DE1C575003F16A8EE756764BC784EF98ADBAF9C2C4A6831E801238BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504875, "uuid": "721b122e-449f-4e7c-9301-2dcbe847286e", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504875, "uuid": "192a7b4a-09bf-4d92-89e3-c8598470aa58", "value": "393216:sEXH9qpTynOa3r91rrs0e83cEl/PlCvQ0uQ6c:7H9aWH3r9C0ec3Cvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709504875, "uuid": "733c5003-c87b-464d-b05a-b8fc6d491caf", "value": 18023608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709504875, "uuid": "80335c57-d8a5-422a-84b9-710f8c8985b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504875, "uuid": "2f26e826-799f-4785-b033-3e94ecd0186d", "value": "SecuriteInfo.com.PUA.HackTool.Crack.19459.6225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ea0332-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471071, "uuid": "a3195023-b504-4c99-b8ad-8ff17bb570c8", "comment": "Malware payload (Gafgyt)", "value": "77fdd2fdfad7a2470ac99f05b9a6579e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471071, "uuid": "eb069846-e63a-4757-8ca7-c85cf66399d1", "comment": "Malware payload (Gafgyt)", "value": "8cd60b607f65b9c53daee913f717a408d30caaacadc189881a5f8dc10fc29bd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471071, "uuid": "3173bc9a-da7e-4d82-b2b6-b34f129334b7", "comment": "Malware payload (Gafgyt)", "value": "f1b15881257d37cc56dda7692dde4e61365db126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471071, "uuid": "4654afa5-c1dd-4822-a8c0-3da3be103f5a", "comment": "Malware payload (Gafgyt)", "value": "83aacfe067ed2a613401adce9aa2bf7e26e560d8cb1fff2ad118bbf8e8438d1832ed51573cc0ff5d3f16685d529db603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471071, "uuid": "9f542ac1-7403-4cdf-90fc-2803aa61dd2f", "value": "T154934C81A640C6B3D09F0BB9019B5B012533F6BA6A5B9D67F31C6CF0DA07881725AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471071, "uuid": "2ae17c43-e40d-4198-b53c-8085349bd58f", "value": "1536:0yXDP3BKU9UJfaTxkC/Qdk5cc/z4d7J2cNU5mZ5hfv7w8h2PM37K8PN2UrYe:vXjUU9UJKxLQdScc7M7JFp5hfTw8h2Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471071, "uuid": "8a1c23d7-59dc-4546-a0c3-e7b643330a95", "value": 95107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471071, "uuid": "829a97eb-939e-4252-b0cd-a9cf78f30e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471071, "uuid": "2748f3e0-c3a2-42a1-aaf5-2a4300c0ac92", "value": "77fdd2fdfad7a2470ac99f05b9a6579e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b019f67-d91e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709443596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443596, "uuid": "7f932c40-6b9d-4bef-9788-166a980884cf", "comment": "Malware payload (Mirai)", "value": "ae23dad230a463bd0c44fa49742a26a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443596, "uuid": "c209787e-e2f5-46ff-811a-864c56c18f7d", "comment": "Malware payload (Mirai)", "value": "916c7d69455e63554f6cd468114e72247904d45c48348975d60a301c36d890f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443596, "uuid": "87ba9d62-d7b9-4cd9-82cf-38af22618eaf", "comment": "Malware payload (Mirai)", "value": "74a071a0c25e337412349272275a2d5e4a185cf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443596, "uuid": "3ed1ac69-e8e9-4b90-82ef-a004fb1df4e0", "comment": "Malware payload (Mirai)", "value": "3ce230ce187119eca42a19a26c4c3c2f0adb635cab57245948ecae56d2586340bb90ae189ba9130dc290d938c9f7c87d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443596, "uuid": "6eb1af79-537c-4f87-a0d6-b164f79e98ed", "value": "T113533B51FD819612C6D122BBFB5F428D372A43ACD2EF32079D266F11378B81B0E6B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443596, "uuid": "3f9eec48-4875-459f-8f2a-14c744b42637", "value": "1536:ZuJ1QqwOogIM/rFa7trRWgDkD94EwQXlJN1qI:Zuo+D7j07ttWgDlEwKZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709443596, "uuid": "80e1e734-30d3-4797-96aa-7e78a3cd6d03", "value": 64144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709443596, "uuid": "3c27f19a-e248-438d-b493-360c77592cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443596, "uuid": "bf6a1bba-d7a2-4e54-a0dd-b04ccb9c347c", "value": "arm5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09e00a-d977-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709481983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481983, "uuid": "1033df14-b834-4135-a6dd-7ee094f1d3dd", "comment": "Malware payload (Mirai)", "value": "ee857bedae9dc65d4981e01feb47087a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481983, "uuid": "96b9ef62-4780-4bd1-861a-c48b3daa9235", "comment": "Malware payload (Mirai)", "value": "92954ed3bad13fb4ccabbefc4455fd4aca25dec509cfc10faca1671b1b15b0c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481983, "uuid": "0a8ce9d2-8da4-443e-9a45-c77a36df5126", "comment": "Malware payload (Mirai)", "value": "55000ebe85a500246a1786839f4134e30d45c2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481983, "uuid": "a10f69d7-cf3a-4ec7-bbda-8987175e0396", "comment": "Malware payload (Mirai)", "value": "a582dc6c862e9827475c36c6190b34066ff5cd030d09d9b83448e5269fa016b5263728392690d929799f7a4e723f5faf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481983, "uuid": "65be1522-fc1c-4643-abfd-9aa03e6bca7f", "value": "T12E63820ABF600EF7FC6BCD3746E91B45248CA41A21A93FB67974D928F60A14F05E3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481983, "uuid": "6e4df776-0194-43be-8c7f-ca560e6f9070", "value": "1536:k4pR18v0ow8WjUT56EmuIN2LN0ZjdvK84:f18v9w8wUN6MN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709481983, "uuid": "353de5fd-93c4-4e01-bcb3-d86f2b73166e", "value": 71772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709481983, "uuid": "f96a7f58-0bf6-48f3-9822-427fae9ad1dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481983, "uuid": "4f6591f2-40f7-433e-a227-bb392625d687", "value": "ee857bedae9dc65d4981e01feb47087a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424a6168-d934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709452896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452896, "uuid": "2d5fc2ef-6f7a-4abe-8280-d6f7ae581c27", "comment": "Malware payload (PureLogStealer)", "value": "098523957ff28febcc2176c42c8fa0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452896, "uuid": "26c44318-4f66-48a3-809d-70444114cb39", "comment": "Malware payload (PureLogStealer)", "value": "9550a6cd9df1fd705a7cfb4b8458a9d1e29dd01f8e2ff3233a6f8b786ecc15c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452896, "uuid": "b2175ec5-704d-44f7-a479-9107c6e8aa13", "comment": "Malware payload (PureLogStealer)", "value": "b1cb65cd9f6c28ec5a9626edc5169c4f176385a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452896, "uuid": "327eb029-0681-4b0f-bafe-d0b16427e31e", "comment": "Malware payload (PureLogStealer)", "value": "af724c1a5ef654f5f4aed9a4bf0d2faec0d4453462ad3102f919bdf58eccb300ad4ac939e8583bb4566d3d43bb6e5f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452896, "uuid": "8a989d29-60af-4bc8-80ca-e2e53bdef972", "value": "T1A9A4BFB993ABA336E7EC03BCD095090763FE0D8AA552F715A45410F05D2B7C896336FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452896, "uuid": "7fcd5293-a472-4b69-884c-10c19447563a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452896, "uuid": "18ca1cfd-f4f3-4fb0-b3d2-dc464dfc08ec", "value": "6144:QGRndq2pIYhcdYlk7CbJz/nHCblQ/c0RA2GOOrmKFSfpSLHp9V:7HhcdFYKqVm2GhaKFSczZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709452896, "uuid": "e2c216c5-3d3e-47bf-a0cb-84376576f50d", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709452896, "uuid": "19f40529-11cc-4b8a-8c1a-90f2e08b7e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452896, "uuid": "f9705536-0714-4525-91c2-8570d33a84b3", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3785b2b-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471125, "uuid": "3c714b60-8549-4b0c-ae26-c7e21a5885af", "comment": "Malware payload (Mirai)", "value": "f96d76a109d678a7553bda8cd077c7d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471125, "uuid": "6d3700da-93dd-4bda-855d-134ba76c629d", "comment": "Malware payload (Mirai)", "value": "968324b33948ddc6e121a32104429beec9c51b2a48243c04adef64bd810d2e49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471125, "uuid": "5f9e83bf-9ec6-4c14-ad71-bee764a4185a", "comment": "Malware payload (Mirai)", "value": "2e26efca2a9dfd0880375bf93a6eda48d050f270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471125, "uuid": "fa300508-0cea-43f9-a3b5-3a8253b26d30", "comment": "Malware payload (Mirai)", "value": "d4e2a0cff03399d0ac7bfdf37a5094697a36fc893f3e292cfbca689eeb06dbab234678322503c798e73b17a78667e2e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471125, "uuid": "3609ce01-83d3-43e8-92eb-a32b0e1223a7", "value": "T15FC34D09F7404B57C0E127BAFA8F424E33239B4477DB331A5A289BB43FC6BA94D25515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471125, "uuid": "0ba35084-fd82-479d-a1a0-3124b26cfff7", "value": "3072:JT40AkRYrZtLLXLg/DcK8Sim7NM/9q2yF:Js0AkRGrLLXLgLc8imxM/9q2yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471125, "uuid": "4e800627-d38b-4f91-a55d-19b7a0e96936", "value": 118201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471125, "uuid": "10d54f08-d71d-4cf9-89cf-087c34c4c57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471125, "uuid": "7f0eb8b9-1c6a-44f2-8a74-62feef055e89", "value": "f96d76a109d678a7553bda8cd077c7d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ee552c-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470678, "uuid": "138d6cbf-f003-4564-b747-8d4f2181c084", "comment": "Malware payload (Kaiji)", "value": "1bde967dd6a2e8e29d709798ac8b3fc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470678, "uuid": "c84068bf-a1bc-4f94-924c-e0d4f22275ef", "comment": "Malware payload (Kaiji)", "value": "9698c680ba23b8e6f4685b8ecbe37768d839be88a131400eb151dde16f45c2c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470678, "uuid": "7f74a314-0531-4b89-b2eb-ee94e1234929", "comment": "Malware payload (Kaiji)", "value": "5634b81320ad01b2ebf49825b466f46e2e7700e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470678, "uuid": "699ed295-9ec3-4f33-a369-ef67cd89f584", "comment": "Malware payload (Kaiji)", "value": "d12f178e24946a791d45ba4168f819a067baf6edc2d7238785c449e34e25c26f8b1368daa2f66d9570382329f86cb119", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470678, "uuid": "0572eee0-080a-427e-b4da-aebc5c0d09b0", "value": "T103364C87B8924682C4E4367ABC7D41D473B34EB99B9713666D04FE3C3ABE1A90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470678, "uuid": "ea1fc3da-4397-4038-a158-056279ccbc0b", "value": "49152:94hW9DuzBB1Lf5bQN4m9DkLLkmopv1ktVI1h:94hW9mB1Lf536kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470678, "uuid": "65139306-560d-48db-ac86-19160562e584", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470678, "uuid": "9eac3ebd-409e-4344-a858-cf82e7e9cb6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470678, "uuid": "45d73155-0c7f-47f1-bb59-3c60f138945f", "value": "1bde967dd6a2e8e29d709798ac8b3fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f955ba72-d920-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709444614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444614, "uuid": "70743d62-9ece-4ec3-b4a3-40d7562f6c36", "comment": "Malware payload (Mirai)", "value": "89600d5b5f868c7dffa6008bec356bc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444614, "uuid": "7da901bf-1a01-4e31-872b-197361a8a2b0", "comment": "Malware payload (Mirai)", "value": "972e99ec1f16b326c2b8d02e6a7b9b0e3924104c10797473032f8590f900181b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444614, "uuid": "1d9465ef-05af-406d-99c6-42350f8d4685", "comment": "Malware payload (Mirai)", "value": "e84407d339daa11379d22cd368358db000bd67cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444614, "uuid": "e5c1eca1-cf9f-44f8-a7f4-ddb85d16f0ff", "comment": "Malware payload (Mirai)", "value": "c24971dbef916988fe1842c4a124426c451d3d5ed26a6c9f48d98a652386e9b7405261f72c4196ed69c66851a42c44c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444614, "uuid": "c6a69b9d-eadd-44f3-baab-f25d6ee6ee9a", "value": "T12CE32A56A7408B13C0D62779BADF42453323AB6493EB73059928BFF43F8279E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444614, "uuid": "e5103675-e394-49a5-aed3-2c66ecae39e0", "value": "3072:cP/GDzDXyJTa6p1qNR+krXJH6XTOEpELIz0EdM/9QxVfb:cP+D3XcTa6p1qj+kVHmTHbz0CM/9QxVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444614, "uuid": "78ba4e38-26a7-4b85-8401-fbd9e98033e6", "value": 149655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444614, "uuid": "eabbfa81-b9d0-4779-9e5e-08b320800d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444614, "uuid": "4107cef3-d296-4673-bbe5-5e35fb8715e2", "value": "arm7.nn-20240303-0543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90db0a19-d957-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1709468061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709468061, "uuid": "66c404eb-5a1c-4766-8297-17add9c702e2", "comment": "Malware payload (DiscordTokenStealer)", "value": "56aab633c6e3f53a2b3d5e2af91a33ec", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709468061, "uuid": "cbeaf790-b861-4c21-9262-3983d17396ec", "comment": "Malware payload (DiscordTokenStealer)", "value": "9847b3c6c0f151b8d16b4e167a21fd485c1224cc82ed96d3c6d08c16064d4d55", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709468061, "uuid": "32c65839-e223-47e2-919b-d51ef4d0e53b", "comment": "Malware payload (DiscordTokenStealer)", "value": "1f6ab4d3611ae9260a4ee2e844c408ded86c0146", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709468061, "uuid": "c6a28127-5e1d-422f-99db-8bcd7836ae06", "comment": "Malware payload (DiscordTokenStealer)", "value": "dc5b0d403230372697d031c6d169f9bb52ce847aee917afec0bc904e2e59ee5887adfd67362b5e36be44211b299f8c98", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709468061, "uuid": "bb55a98d-158f-4819-aa7b-1f94ee0c42d2", "value": "T1F9868C03F85565E8C6EAD23086358252BA707C891B3037D33B61F7B92A73BD46B79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709468061, "uuid": "9679a52c-a8d2-4fd1-83ef-847256ede602", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709468061, "uuid": "2537c057-adf9-4133-ada4-de216cffabef", "value": "98304:Yv3OeIVTBgdn3WAIEunLxKYNuVTatB7pWUDV3tR76EP3zVANjlo:Augdn3FYLx1v7TBijl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709468061, "uuid": "9d79afbf-ed51-462f-b613-7efab2064dc4", "value": 8454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709468061, "uuid": "d79e82b9-8620-4809-80de-8d0740c64bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709468061, "uuid": "aa732842-bf8a-4e3c-a5dc-758f83d3500d", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca14279-d939-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1709455195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455195, "uuid": "80381f16-6729-44c7-9620-4abebdc9ea45", "comment": "Malware payload (Cobalt Strike)", "value": "40635be83e3ed7e7ec12b450b2058b71", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455195, "uuid": "93ec37a5-031a-4911-8b7c-6bd2b0686255", "comment": "Malware payload (Cobalt Strike)", "value": "9902e3e04ea1339cfdbc79e565e438e489efdb84f2cc4cb227544082498c1a0b", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455195, "uuid": "b2a9fe55-cd95-480b-996f-212995da38bf", "comment": "Malware payload (Cobalt Strike)", "value": "6cbc78a8fff707a3b897edf5c9b8d5e6780e68d0", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709455195, "uuid": "9e311eba-3513-427d-8185-5325f2b36ffc", "comment": "Malware payload (Cobalt Strike)", "value": "c5b95fb527f8d86e36c8dafb89b0d577bdb824565b7f2aed3ea997a982bf90a46a177d346afa3c04510548581b204d34", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455195, "uuid": "59c19444-082b-401f-a5b7-b4559ac6d2d0", "value": "T19C573318A6D1DE7DDF231AFDD08E48EB6A6E8E9307C9407317F085C6CA146D1881FE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455195, "uuid": "039d4d43-89ee-4e8b-a9f9-8cd9b8518584", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455195, "uuid": "62100712-3462-484d-b0ff-3756989018e0", "value": "786432:fpfjAZD3BbPPKwDE7elaEtyG7O36we3Fi+/B80DX:fpfjED3BbPTtakyGG6weVimBLDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709455195, "uuid": "30668b7c-c10b-44a9-ac21-4432439cb9fd", "value": 28440136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709455195, "uuid": "75dfad5f-3bdc-4b76-bde9-cc85bdd68a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709455195, "uuid": "010f26ef-0656-4135-9943-7a299d7a3868", "value": "SecuriteInfo.com.Trojan.Siggen19.3578.9894.26344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441d219a-d9ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709504869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504869, "uuid": "ccb62934-2bf7-4c23-aa67-d7ff5f6bd8d0", "comment": "Malware payload", "value": "bf3305c50d362b3528f2e53365c4d262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504869, "uuid": "8832dd46-c064-4cd3-a9a2-32c06e837834", "comment": "Malware payload", "value": "9ad04fe6ac9ee601b2e26c5ccf4d34b68e51500021bd7ef5495013812d7b20c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504869, "uuid": "056a933a-817b-4ff7-bbef-cc279ace32f6", "comment": "Malware payload", "value": "42adc6bde08e494f5c70df99f93faa14a2ae2626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709504869, "uuid": "6e9a066a-7aa3-4515-8912-29ca944755b0", "comment": "Malware payload", "value": "6697522f0e4bc6840061edecdb7856da489bab483ccc375220d86ace4ecfe3208b119c7c1ed1395971a4fb7e5643abb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504869, "uuid": "081898b9-df04-43f0-bb74-888606db1419", "value": "T103352A1BE2A345E9C52BC0748657D772AA70BC690134BD6E2EE4DF333E21D509B2E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504869, "uuid": "434215d6-a9fa-4d7b-8803-db18050ca3a3", "value": "ff8633607c5c2c41501e64519e50f139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504869, "uuid": "ebfa8697-6843-4b4c-a8de-45ea95052dc4", "value": "12288:3F17vwmdfnarWPp/f0jWB+s3TwVRLQ8iw8m+5uS2siH:3F1vwmdfnarrRLQ8Ot2si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709504869, "uuid": "04cba633-77b6-4d83-a16a-1f0df479d3cf", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709504869, "uuid": "2c6a43f6-2a51-44ac-99ea-ba90207ebb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709504869, "uuid": "e6095722-bd38-4563-825d-ee464acb92e1", "value": "SecuriteInfo.com.Variant.Application.Miner.2.2229.14992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c4edc6-d91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709442131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709442131, "uuid": "425a89b7-7f87-4cf1-b937-9aa27c425c2b", "comment": "Malware payload (PureLogStealer)", "value": "af00c05a5029f7fd7dac013bb01d220c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709442131, "uuid": "c9361ab6-0168-4a9f-a649-cff5c050dd8a", "comment": "Malware payload (PureLogStealer)", "value": "9c621294c689defc4b76da675ded71aa710ab5fa20498f1d4dfa6fc1d4bc2455", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709442131, "uuid": "f58db443-3f56-462d-bc3d-33eec6e1ed6f", "comment": "Malware payload (PureLogStealer)", "value": "f862ca3da392e901baf29eff5daebf57466cd62f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709442131, "uuid": "6e616728-3bff-49da-8d32-800208e759ea", "comment": "Malware payload (PureLogStealer)", "value": "42e6f259c32fe9e3a8a2ccd5d713f9f40576219af0bd157352224675b9355499c0f392262171f8159284e47ecefaaf03", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709442131, "uuid": "8e17fe30-a6e2-4359-a9c2-4b2021f8f599", "value": "T1A4C56B8BBC9044F5C0AE933589629596BA71BC440F3527D72A90BFBC2F72BD0AE35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709442131, "uuid": "e4a36935-ad20-42f3-9850-2aa6850987a0", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709442131, "uuid": "2ca860a5-efe1-4c7f-b1ac-c653ba91d5c4", "value": "24576:W3TZV5M5F3tiPNMtPcp3MAtjkwbOo9JPWCcSodJKsUpOLrF6qiz+q/pGzELEVnQx:if5G3G+tUpjjzCo/rXgKfpOLNdcWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709442131, "uuid": "5faf9658-3cb0-4070-9308-ec0d19841c2c", "value": 2653184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709442131, "uuid": "5ffa4cce-0691-4f2d-9edc-82403981239b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709442131, "uuid": "0cbe5446-78ed-4f2e-ac37-01a8b3ffdae4", "value": "af00c05a5029f7fd7dac013bb01d220c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67320a28-d99a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709496767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709496767, "uuid": "dfd108ed-6628-4e3a-b8ca-ff1c11f9fc22", "comment": "Malware payload", "value": "d1f523725c2a5799c3f8417c99ae001e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709496767, "uuid": "4b2a3ede-f58e-4043-bec1-adb39c8e6f68", "comment": "Malware payload", "value": "9d5adbadf02e4da93c1a344f2a16aa547c4524cd38cc8ffc01500f023464c2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709496767, "uuid": "67980b45-907d-4995-9747-302a9deed6df", "comment": "Malware payload", "value": "4e32634b36e8beed54b54ec38d552506ca159f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709496767, "uuid": "3aac05ed-bbb9-4b8f-863f-df71cbc1cb47", "comment": "Malware payload", "value": "8d146b7e74d51366451eabcdd97c8ca68896c3990eec4624acf726f6c1b996a94e2cd0632fac26caabd0c4fc323c9f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709496767, "uuid": "ab8e4829-bbba-440a-918c-7620938ee292", "value": "T147A78C0673E60198E1B7D1388AA79507E7B3B8161730D7DF329C02692F77AE09D7A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709496767, "uuid": "68b293d2-4255-42e5-ac6e-524b417854ac", "value": "60119ed42f111b2c92d08284871fdfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709496767, "uuid": "ac2008bb-2c11-48fa-9134-b251b2052795", "value": "393216:FyT3YGojrsBEnP4XrqSFM+FcrONRtgZJ93AEMQu58EISEhoIaE2FShMzTVA+BDEG:FWeBZ6QxhUDE5JO26rsxc0SDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709496767, "uuid": "78256922-cb8c-43b8-8387-bedf35b20c4a", "value": 44437543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709496767, "uuid": "437893cb-8b70-4d41-bb7d-7bfba065c430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709496767, "uuid": "64373171-8036-4e03-afd7-810171aef17b", "value": "SetupLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc087cc-d93f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709457773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457773, "uuid": "02cf77e9-abdd-4829-b351-8df4ea99366f", "comment": "Malware payload (Formbook)", "value": "69ab3a7336f29f7dddb882bfa64ecb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457773, "uuid": "77502963-5bd0-4c00-bdc5-a13edd337756", "comment": "Malware payload (Formbook)", "value": "9f1122dca134215377858274478f891e80951892e78211ac6da0aafe39de699b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457773, "uuid": "3533c77a-b915-470b-8710-f6b21f6b4da9", "comment": "Malware payload (Formbook)", "value": "2fd5088ddd881e3a7e3fce59c40750d183658e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457773, "uuid": "c6117d53-fb3f-4425-9450-a6f04867ba23", "comment": "Malware payload (Formbook)", "value": "f8ef66713b25a4043bde104ae2bc774871b8ee1e633afeee4de234bf8814cc8acd6565399da1800117f0745d141a583d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457773, "uuid": "19869261-2528-402f-b222-04deb74c7a37", "value": "T140451212FEC198F2D173293589399B61A93E7D300F658ADFA3D4652DEA321C1D232763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457773, "uuid": "2a1af7fb-e6ad-4eef-9045-e40c6d8c05e1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457773, "uuid": "4ed7a483-a8d9-4417-854a-677c3707eb93", "value": "24576:TTbBv5rUDAbVkNXBFbilTlMhPk70EMlk0XA5YJeUIrVsTzrS:NBDePkMSYEMlkmA5YwUdHrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709457773, "uuid": "5af12f90-54e6-415d-9d75-e91159ee34c8", "value": 1220012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709457773, "uuid": "29aa2a01-a1f1-433c-9826-22b0b64dfb0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457773, "uuid": "325b6a54-c5e2-4de1-b06f-aee364e816db", "value": "doc2802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9683fa7b-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470647, "uuid": "1ce9f33e-8aaa-4180-960f-18c687658e35", "comment": "Malware payload (Gafgyt)", "value": "1ee624c87f0ff2bff08c86264aa86d39", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470647, "uuid": "569dbad6-6d2a-4b9f-b6df-04198cd82ab4", "comment": "Malware payload (Gafgyt)", "value": "a108ff340f5256cc17c1e8345aacc3cf6c91987a1884957ea75df6d23281480b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470647, "uuid": "fbfe8e72-3a9a-485b-a2e5-04a8d0913e54", "comment": "Malware payload (Gafgyt)", "value": "399092c73ee190c1c97c8e1ded5b93b8c96c6a14", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470647, "uuid": "407848fe-87ee-4c18-ac82-74fc92e615a9", "comment": "Malware payload (Gafgyt)", "value": "f008957c247d23664c0497dbf3decd59f59aac23257b9efbd36e0f01bed615c3ab4dd177d0a5f6db13b7a1468510d65e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470647, "uuid": "c21911f7-7419-451f-b245-1d60cf594d68", "value": "T15343283B2A92C96EC49B57F52EEBE562D423B83D1B33A00277D47D299F268C41D4D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470647, "uuid": "ca872de7-d15e-4975-be20-485a008f8a3e", "value": "1536:NPRM/iltEWk+BEawI3Svk60hZufEqquJSy:lRM4tXMI3SMJZu8qqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470647, "uuid": "13b8f9e1-6df6-48d9-a8bc-3ae567e095bd", "value": 56653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470647, "uuid": "2f7b7835-adb9-41db-bdfe-6778d1e229f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470647, "uuid": "427d5ef2-834d-4c15-b562-69c09f095208", "value": "1ee624c87f0ff2bff08c86264aa86d39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b943d081-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471135, "uuid": "df172f12-6067-48f0-af38-36f0643094c6", "comment": "Malware payload (Mirai)", "value": "c3d478db67c6d0b04511f52bf0f308ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471135, "uuid": "8cbcb155-bac2-453f-85d9-abae0804c02a", "comment": "Malware payload (Mirai)", "value": "a12c0ed963f5f10bbddc02d9718531efc38a0c7332822a0c3112cbe7090ccbd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471135, "uuid": "fa04f150-7607-4601-9fd6-c2a86b1293b2", "comment": "Malware payload (Mirai)", "value": "9a38d137d6bd12324354faf7b11d849b52ce1e78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471135, "uuid": "bda7beb6-064c-4d02-9733-0d8c9fc28cc9", "comment": "Malware payload (Mirai)", "value": "29a56f0625bcea5fdc0bc862aa534caff62b3ced05b77a9a0c4820dc6dd66e3a1d7f659c47c1c51d1a60d916e2e8fb22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471135, "uuid": "41ff445a-d340-40e2-ab42-7d65115229d7", "value": "T12A53E904F951872BC2D277BFF75E439D373A1A58A79B33116A382EB43BC67642939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471135, "uuid": "500b956a-b25b-447c-8f42-d24caadf03ab", "value": "768:ucN0oU367QOf6Qte/HPfF55Jcd1+pSrLFFJ01jwQVkGXsjeqoDlgy+8hhrfr9+c:VhUG7fOHT5Jc7DvFF+viGe5oDlgy+47h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471135, "uuid": "510616c2-ae88-4019-969b-b77402bfa889", "value": 63711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471135, "uuid": "c8efba49-318c-4d8e-9fdd-2d27cc1eba77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471135, "uuid": "34b6f851-751e-459e-bdaf-7e63c144533e", "value": "c3d478db67c6d0b04511f52bf0f308ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28243c0-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709470667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470667, "uuid": "66beec99-1e3d-49d3-9a54-40dc5bce2365", "comment": "Malware payload (Mirai)", "value": "e2f9159a0857c3c04f9f24919649ff71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470667, "uuid": "30fed7c3-cd72-449c-ae8b-99bd9b275a0c", "comment": "Malware payload (Mirai)", "value": "a12c3a1989949c83a2a62bbfc96401bf33f1abccece2978d6a0c3eed70c981c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470667, "uuid": "4c30b171-9113-463f-8e6d-1e42aec977ce", "comment": "Malware payload (Mirai)", "value": "3a64be329b9d54ea74fc86d31d059b818bce7e56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470667, "uuid": "03a116b7-68d8-4342-8c28-3c5133e2c59f", "comment": "Malware payload (Mirai)", "value": "a1d152197a038ab3411ebef35e5b35f7d2f3183a24334ffa600ff6f520298a7f0ed98009b0036346af7dbcc4c39220d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470667, "uuid": "b7b61b1b-5c5e-478e-bd4c-5161457e9d44", "value": "T13A53E904F951872BC2D277BFF75E439D373A1A58A79B33116A382EB43BC67642939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470667, "uuid": "e7207a64-fdda-4cb4-96c2-e8e6c2881fa5", "value": "768:McN0oU367QOf6Qte/HPfF55Jcd1+pSrLFFJ01jwQVkGssjeqoDlgy+8ehrfr9+c:jhUG7fOHT5Jc7DvFF+viGz5oDlgy+b7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470667, "uuid": "b3510f43-3618-4c58-a028-c9603b3beb9a", "value": 63711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470667, "uuid": "533259f7-f5e5-4f7a-b4ec-92d0c9950734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470667, "uuid": "b8150300-5187-43ed-a176-eaa81e7a619c", "value": "e2f9159a0857c3c04f9f24919649ff71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc82327-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465025, "uuid": "3fd62a1a-eff4-464c-8fb1-7b30baefc75d", "comment": "Malware payload (Mirai)", "value": "3b92255c1c1c7c7e9371a9656662679e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465025, "uuid": "b61302bb-5611-479c-8e23-735fc8f5d215", "comment": "Malware payload (Mirai)", "value": "a38dfbcdf569408a560b518fd4102e55249f4f47bcea3b797004d8c05448c9a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465025, "uuid": "4dbad716-294a-4290-ad44-f9a0d43cf43a", "comment": "Malware payload (Mirai)", "value": "a1dd41d04d2077405309c0b47f73cb7344ac1184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465025, "uuid": "5a28ef2a-c0a6-4634-98af-bf8bf6d84154", "comment": "Malware payload (Mirai)", "value": "d970514ff7b732e4a690f5ee4eb88f38d719cf76704688d0d531bad009eb359617e4d0ed4b47a63d72827ba10ff990c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465025, "uuid": "469df3ad-b14f-4bba-a480-62eff866455e", "value": "T1A4F33C46EA418B13C1D71776FA9F414A33229794E3DB73068D286BF43F87A5E0E17A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465025, "uuid": "837a1d91-ce42-4d1c-83d8-23f219ec8d8d", "value": "3072:1rESqsihvIhMp+KtKXaRGLKW3Sfz8azYEBPFsleM/9q+tM:1rZtihnXsXaRGLKWCfXDBPFsQM/9q+tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465025, "uuid": "a7ed3c8a-4c49-49fc-b329-c00682e4af82", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465025, "uuid": "c67a8e72-2858-4b7d-8db7-05678840e387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465025, "uuid": "46f88729-af5e-43a4-ad0e-5167203ce7c3", "value": "3b92255c1c1c7c7e9371a9656662679e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5896d3-d920-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709444619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444619, "uuid": "e3adcbce-b7f1-45af-80b9-714f248ff041", "comment": "Malware payload (Mirai)", "value": "790fa9e1f72ca88f87ea6d55958e50c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444619, "uuid": "6e151fed-9f75-4f09-aa07-45f74eef3b8d", "comment": "Malware payload (Mirai)", "value": "a3d25df12b0e8c763137f2ec88ffc91ce440b79326f591a503507da101bbf338", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444619, "uuid": "7b4f23f6-59ed-4c1a-9e82-8ff11e6bdf46", "comment": "Malware payload (Mirai)", "value": "46cf6d1b702bf330d7db03dc11236a565fe81305", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709444619, "uuid": "0dc3a994-afaa-49de-bfef-01c0df192457", "comment": "Malware payload (Mirai)", "value": "de732ac19098c05d288146a785bd810bc3a3aa4c6fd1776d557511d3b7790ede370a78f7300987f05c59ef477ef5e473", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444619, "uuid": "bbb146af-3f97-49ad-b7b3-2b88c6b5acc8", "value": "T185533B51FC819712C6D122BBFB5E428D372A43ACD2EF32079E266F11378781B0E6B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444619, "uuid": "0de03ef8-bbbd-4b5a-a8d6-8c4663afbb44", "value": "1536:GVuZ1QqA+ogIMPQVa3yrRVYARzJ4EwQH9RN9iI:Wu4+D7YE3ytVYAYEwiZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709444619, "uuid": "4bbbd405-cf6e-4479-b100-41044b828125", "value": 64160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709444619, "uuid": "112e89e8-da8e-4c4d-a20d-539d2a656388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709444619, "uuid": "433051eb-94a4-4768-b276-f48a689dd5a5", "value": "arm5.nn-20240303-0543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f06143-d949-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1709461816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461816, "uuid": "d59376d4-f13a-4394-879a-31389812f762", "comment": "Malware payload (Amadey)", "value": "2a4c2174b44bd92374f04ff178c8b1c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461816, "uuid": "25b2bf27-088b-44ff-b420-30f0fb06a05c", "comment": "Malware payload (Amadey)", "value": "a409b5632d06548466f0cb90aafb1ff853b8d1dfc275f3b942b0a9fd3bf523e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461816, "uuid": "f6de2dcb-1907-4a1d-b693-0d007a279d74", "comment": "Malware payload (Amadey)", "value": "490508537dccd6e4c4e168b8814a7993c57b4ac8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709461816, "uuid": "1b2b7c6f-e57c-4334-90ba-e8ee6cf1aad1", "comment": "Malware payload (Amadey)", "value": "6f66da36e457289d022c444f1f95ee5f80e9d9361723b7713fdd4e0daaabbe6d42b49f74348774704ab4ab75a0c789c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461816, "uuid": "163e5d97-74bb-4b80-aa9b-1736898be796", "value": "T1BD8533D48480DDE6C5388A7D4D4E9B38BC77A20101433BA0F98A75A96B373E7AC593F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461816, "uuid": "956c5e48-4748-4929-bb9d-261886cee6a7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461816, "uuid": "333d43dd-6796-4b70-85f2-78d9d83f0d33", "value": "49152:H9CqQReEqx32QMlCDvPH+AyXQ/cnDbDCnCSifdwAWg:VQRen3zbznyXQknDPCWfdwAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709461816, "uuid": "d5a522bf-c965-4d81-b23b-af362dde004d", "value": 1859072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709461816, "uuid": "aea1089b-e415-456a-9b17-61169d095274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709461816, "uuid": "788cc3ff-aed5-4968-bdd6-d5822e601a7a", "value": "2a4c2174b44bd92374f04ff178c8b1c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d45d9e1-d933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709452485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452485, "uuid": "1f286e57-7009-40cf-ae67-b387a03537db", "comment": "Malware payload (PureLogStealer)", "value": "53faa49317393d13c91b1c95b0f99781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452485, "uuid": "5932840d-272e-473b-8539-212479a11aa3", "comment": "Malware payload (PureLogStealer)", "value": "a7280711eeca44e42613084aa5b1bd8853d44ae5425bd47c27a69e330ba2edfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452485, "uuid": "4e270161-f726-443c-b7ca-769a2437e2a1", "comment": "Malware payload (PureLogStealer)", "value": "976886b88a88962d69c0d23b40008d6de677c946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709452485, "uuid": "8a86ba6c-8408-4bda-8151-4f01a0512415", "comment": "Malware payload (PureLogStealer)", "value": "3638ec891598f1851adc79fb003f48e79d1c1594163132154f930e6ae5b79907b5e6714402185b9ed1c25db74e4c9221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452485, "uuid": "c7eaba68-474a-4de0-8285-e3ab1b750213", "value": "T12705F1B953AB9362EBED03BC9096090763FF0D46A556FB15A48810F05C2B7D895332FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452485, "uuid": "0c8df32d-2fb5-4061-8d04-61297d6c14d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452485, "uuid": "1d84a539-d5f7-4a76-87eb-e2ff011309c6", "value": "12288:aCFK/HwPE+zleBpFnK5D/W4GAAwosJFD32pb62tYYnRSbfZGUCUQgYXuR:JPEwleB3K5DnGczFCpb6LbfZ3ogs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709452485, "uuid": "69c1235a-f1f0-4702-a2e2-b235d7a82fa1", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709452485, "uuid": "22cbf0ff-4f6e-47ed-8598-d25b2c14f50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709452485, "uuid": "3593a93b-8bec-4780-a57e-a4c91bbe89d9", "value": "Bypasser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfed248-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709471116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471116, "uuid": "7f1ad8f9-c0f7-4250-89be-d7893853b509", "comment": "Malware payload (Kaiji)", "value": "9d64b4c9c6c8daa62c5fd2b47234cf50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471116, "uuid": "9587f7ae-7d8f-41af-8a91-74473fae0274", "comment": "Malware payload (Kaiji)", "value": "a8715804e6f577b794ff492af1f708a07949436accf25284375de5dd175e792a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471116, "uuid": "fb1cf08a-caac-43b7-8b56-6656323806e9", "comment": "Malware payload (Kaiji)", "value": "b96a5b237cc699df3d3769ec132460dc5baa24b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471116, "uuid": "e1f59816-9f25-4358-9a29-1a1753edf8e2", "comment": "Malware payload (Kaiji)", "value": "126a76807fff0ae47b87418d804daba33edbd664019b7a9fe6e58260deee6f615b47f002fb2884b886463e0899480dbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471116, "uuid": "0a6007de-4a78-4d1d-a98d-d23a7612fdf1", "value": "T14E363C5BB8824A82C4E4367ABC7D41D473A34EB99B9713666D05FE3C3EBE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471116, "uuid": "843f1a88-b34d-4afc-acba-6882d87838b8", "value": "49152:oQdGkSpsqkVpXGi8TEeK1cam6lr0wSHyeVI18:oQYzpsqkVpXXeKTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471116, "uuid": "dc86e344-9e1f-4297-b319-42fcb7293125", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471116, "uuid": "edab0e16-bd7f-4a7e-8784-fdfcba9335b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471116, "uuid": "fced958d-9245-49e0-a003-8f862ac0f172", "value": "9d64b4c9c6c8daa62c5fd2b47234cf50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77792ec0-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465012, "uuid": "4c61bdc1-bda8-470b-9ff5-8377ee25ce6a", "comment": "Malware payload (Mirai)", "value": "093369625c553bf4163f4e58cedccd5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465012, "uuid": "bd32e081-8c3b-459c-98bc-ceb027d1b6d4", "comment": "Malware payload (Mirai)", "value": "aa388ba72b49aa24529d6ddb4b1f57f2eeb0af3aa128ce3ffa6c01c871337d05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465012, "uuid": "f0969e84-bd89-479f-847d-352f56ade694", "comment": "Malware payload (Mirai)", "value": "2b88e147e64f0389ea1bcdcd313cbaddd9ebf73c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465012, "uuid": "51f19afb-4c57-455e-a84e-651f1b895360", "comment": "Malware payload (Mirai)", "value": "5d122ee5b723b1f3dfd02c7747a9df588257412887795778f68d2d943f7a790b3e366f6d9f2fc63513286f06a9eab420", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465012, "uuid": "393f5757-032d-4db7-98dc-22428572a400", "value": "T1CC833881FC41A622C7C11677FE5F018E371553C8E2EA32079C295FA03ADF95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465012, "uuid": "542d3ded-c1e9-4bdf-bf64-049f5ef50549", "value": "1536:ROEdOGfs3JoOCjCa33eZt3p3KfSH3KsUHcbvn:ROEdOG9k63wGfS6J4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465012, "uuid": "9b87a956-4ce9-49b3-b4ff-cecc6c237489", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465012, "uuid": "4b3cbeb7-9e77-4fd1-8a15-7e1061f1fbf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465012, "uuid": "db104ecc-6643-4781-a347-877c0a619f9e", "value": "093369625c553bf4163f4e58cedccd5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5f99a4-d928-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1709447971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447971, "uuid": "a711c169-8cc2-4487-a9f2-80186025faa0", "comment": "Malware payload (Glupteba)", "value": "85276523fa7614812ace42681f304179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447971, "uuid": "50c8fb71-5b2c-41c5-8029-db7040f74dcd", "comment": "Malware payload (Glupteba)", "value": "aa6b00a8870f3ed1ee8b64aa5eaff7cd2e080218ceba9299b1b5279ce388d0b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447971, "uuid": "5bc50189-85eb-49b6-804e-dbecdfa3fa35", "comment": "Malware payload (Glupteba)", "value": "1e52a0a6f6beb881b73e7fb6e8630c490d3755ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447971, "uuid": "5ffd8829-4022-4b9e-bc89-c93416f17f05", "comment": "Malware payload (Glupteba)", "value": "7df7840ce678e52e594b19e50d4ddd25e1e088409b68ec2bed443186ba032dda89d62bfdec76b5c21d203b298621a0e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447971, "uuid": "d476297a-b539-4dea-bdde-e81358d8baa1", "value": "T149163303E6F0B872E6DB88350C11E7F91F39BD04F975CA47B39876291DB16E0AA1611B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447971, "uuid": "639ff892-9478-44c2-844b-4b645409b149", "value": "99a932f0cadd6d26123940658eec1af9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447971, "uuid": "a9438355-4385-41d1-9677-c379c78331c9", "value": "98304:iZC6n5cbozJoUnTjkSKUoPlP63Pa0yhsUioa6SAJb1T:T657JoUTuPF63ParhTc6SAJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709447971, "uuid": "2386f0be-9997-4af8-a79e-a63c79eb3603", "value": 4335000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709447971, "uuid": "47b7e511-cf4c-40fe-8851-3427acabc0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447971, "uuid": "3e4af94b-2c35-462d-acac-cd5bf860ed82", "value": "85276523fa7614812ace42681f304179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f352b-d979-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709482493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709482493, "uuid": "0cc3f8b2-3991-4fd6-b5c0-30decaea26d4", "comment": "Malware payload", "value": "e8db8ff27254fea269113c71266d3c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709482493, "uuid": "dd784c40-e228-4100-bb62-1390292812a9", "comment": "Malware payload", "value": "abd4cdf2db132cf8ceb1fb7d142d84221dab619ea25bd8527cf568600db51474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709482493, "uuid": "ffe04f49-185e-4a26-a6ad-c7fd3d51220d", "comment": "Malware payload", "value": "8c8ac2486be3cbb0940017173a0d5b8fe3a3aaec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709482493, "uuid": "7347c127-3846-46ad-8e2a-936166d2cf0a", "comment": "Malware payload", "value": "2645c3ded857507fda17b3447bef27ef673c31b0a01b22a65674a0939118feb8586ec848b687180c9ce553fd0bfe3958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709482493, "uuid": "6378ecd1-8790-4100-abf8-df9aa23ccb94", "value": "T1EB63BE11E390C073D5B25331683B2BB75FF6992652A49B0343907F2D7CA2681E91FBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709482493, "uuid": "406a6b43-0d51-4a7d-8dc3-de43be660c1d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709482493, "uuid": "66e7eb68-adcc-4933-97d7-d9eec5c1ea68", "value": "1536:rferrLkSRoe8C4UZsys0Dh1duq4Romu/7qgFNFI+Plm:rfi3k+oWDBDh1duq45Lg2Wlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709482493, "uuid": "11c4c912-c7dc-45d1-af07-38fd9d64ccb3", "value": 68759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709482493, "uuid": "1820b520-bb31-45b3-8707-f1255a2e6cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709482493, "uuid": "31ddbde0-36c5-4813-a116-d41c2f7ad2ac", "value": "e8db8ff27254fea269113c71266d3c77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bec7136-d956-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709467542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467542, "uuid": "4bf8d50c-383d-4530-a61f-cf6625e6de9c", "comment": "Malware payload", "value": "f8263ce9ec9d390de1c6b13864bf163a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467542, "uuid": "841ad64c-1edf-4028-a284-7ed52af2e888", "comment": "Malware payload", "value": "aead971e5e7ff6cfbdd3ee1f1d9e1571f609c307289b66c0ecdf4f030c8aeb3b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467542, "uuid": "3f599228-5f4e-4a24-ac63-2b16d211c636", "comment": "Malware payload", "value": "9da5e79d8e3e25fc13eb5a398455afeac3039b46", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467542, "uuid": "6d961cc6-3bf2-4de0-bb19-f46761ead943", "comment": "Malware payload", "value": "c1cbe49e0cbce09968ebd561ab065f098184c2a595a9983bb2541db78d895d5cfdd17b79d5ba9ec61b64f473e95236f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467542, "uuid": "9942573f-5f6c-41ad-ad43-45ca8c6ba2af", "value": "T158E02BD68D712F43D1A70D31157563E3C67F807A12547D1E141B64D15EE39704985686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467542, "uuid": "352e01e6-5f32-40ed-a111-302a5a84b4ef", "value": "6:5jU9ZTAzViCXDVIcu9imeF3gel5iGCLJwFAD2lG9ZRtBzViCXDgt+lRlX:5jU9xGiJcu9ipRn5i91laU9vRiZtaRlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467542, "uuid": "9cb7e8d8-2b8e-458c-bef4-91118a7a0860", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467542, "uuid": "093bf1d0-e0c1-48e1-ba9a-6eb50edf84f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467542, "uuid": "ff7f551a-f763-4f24-9a95-b47e823859b1", "value": "f8263ce9ec9d390de1c6b13864bf163a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f933fa9-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490339, "uuid": "acd8e337-b2d9-4f11-9a5f-b7a8c54f944e", "comment": "Malware payload (Mirai)", "value": "ef96870cdf09dd50c798d96de3adb335", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490339, "uuid": "3c764251-ac96-4507-9540-37d31059016c", "comment": "Malware payload (Mirai)", "value": "aec65eb21ef7a244afc4109a8882c6fb0ba738d8348a8d6d4950040584d4a61a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490339, "uuid": "c10ad58e-5e49-4a53-8d42-35eb78474478", "comment": "Malware payload (Mirai)", "value": "70a063b81a5ce5734cff19d49bda6c8bd831d9a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490339, "uuid": "a9d17b6f-e9f3-42e5-b2c0-91d35e3643a5", "comment": "Malware payload (Mirai)", "value": "0bbb7117ee0499835f9460388344cfaa3f9b2b393fb4adede0d0353a06f0b023fdecfa6624fa19897afbcf46af7347db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490339, "uuid": "371116c4-2bb5-4c3d-83dc-e4e01c374fc4", "value": "T133437D73C92A6E18C68D85B4B4344FBA1B63F058D2471FFA0969C36A9057DACF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490339, "uuid": "f057e64e-a8d9-41b1-9fce-cac10f2eb4ba", "value": "1536:bNvZRzSoYjiq+FjKJC9unKYICBLmULLuiI:bNvZ5SoDFGJzKYIQdXuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490339, "uuid": "844dda98-f2d2-451c-82e9-e8574f4494de", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490339, "uuid": "c7bd615a-82d9-4998-ba07-ab1a856220b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490339, "uuid": "7518b9dd-c8aa-4387-ac76-ca674b44f769", "value": "ef96870cdf09dd50c798d96de3adb335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7f0d35-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470657, "uuid": "a9b97ad1-7047-468d-88c2-9c08bc6e960c", "comment": "Malware payload (Gafgyt)", "value": "a8883cdae2755fa72dc2ed3c7e4aedb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470657, "uuid": "caa7e689-031c-489a-8c52-8a55226b261d", "comment": "Malware payload (Gafgyt)", "value": "af5e4587b849eecd603ebfade9ef24e821ff185011f61434bb7c6d722e89cb88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470657, "uuid": "74f9b998-c4a9-4feb-ae7f-d795ab30366f", "comment": "Malware payload (Gafgyt)", "value": "e4f5763f7a08dc51d3738558720032e487c4d243", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470657, "uuid": "a83be7d8-17fc-401c-b9ff-ee4e2f09e337", "comment": "Malware payload (Gafgyt)", "value": "a658dd495fc4c12c5b5603c64616be5488363327a869578856d4264ab874e9cf63bf33fa4119edade68efd50b5a2274b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470657, "uuid": "07a500c0-9b15-4cd1-99aa-e85dd99c60e4", "value": "T122C3C737A7D73D13C0D5A83302D30A617976DA6424BD0393E5A0ECB52F2AD643662BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470657, "uuid": "502569f2-3787-48bf-9e80-23afea03e97b", "value": "3072:x71gpiAVON8sftIphajMRqV+KLury0UqTM:xBgpTI+zphajIqV+KLury0UqTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470657, "uuid": "ed041031-c0c0-43bc-984a-327fef3ab6e1", "value": 129347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470657, "uuid": "85ebb593-20ed-4bc7-bda5-b288ec1e8465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470657, "uuid": "ae62b032-358b-49b5-ab43-c50b455fad4d", "value": "a8883cdae2755fa72dc2ed3c7e4aedb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad144dd-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709471111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471111, "uuid": "3e401d21-122c-4373-9cc4-3e1dd744ae46", "comment": "Malware payload (Kaiji)", "value": "e13bbada29f8d014204f10b0fdd01c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471111, "uuid": "ccc0a26b-eb4f-46fb-ac1a-8fac4150b8ea", "comment": "Malware payload (Kaiji)", "value": "af80cdbc939114101d7bb5ae47912e44a6d70b17626582cc8b6c75be458ea3e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471111, "uuid": "5abdf535-181b-4c15-b917-7c553893257b", "comment": "Malware payload (Kaiji)", "value": "6910e54a0f2a9c7935eda0e354c3cb4a810d40bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471111, "uuid": "570ffe8b-4d51-4b92-accd-6dc4515b33d4", "comment": "Malware payload (Kaiji)", "value": "fd5c1fb9351aadc2c536cf6440a55f35106379ae6bf2850ac9498667fb9815c7512c60f8fadd7e34fce9940f2f8fc24f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471111, "uuid": "1c1ae8e5-2a7e-4e68-b761-f3ea6cd024b9", "value": "T17D56F805ACC82BA6C06D5B7485EACE6163B41D085AF14B362654FFD8BC762B4BF07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471111, "uuid": "5b585a3a-5a22-4598-8af1-9d5a109306f4", "value": "24576:avocWXZYzv15eZ6kh9wZhZkvhKRuZBAPZJqh9xZH5xJloaRgkZzILs/1ppAp8epW:KtztascbyLs+YwpZcG00mWU1I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471111, "uuid": "8da8ad8e-defa-425e-a1b1-e5941564886e", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471111, "uuid": "b56854d9-eb2b-490c-9fb2-19fa36a6fd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471111, "uuid": "b57bcf5d-4253-4584-9a6b-5a64c6a75653", "value": "e13bbada29f8d014204f10b0fdd01c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029bb4f3-d994-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709494021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709494021, "uuid": "e5f438da-0ae0-486d-9eb7-ef2dc36c308f", "comment": "Malware payload", "value": "c81cbfd03e90527d3fd3d55408c40529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709494021, "uuid": "a94e6e3a-18f0-4ed2-b149-564409cfd35e", "comment": "Malware payload", "value": "af985ec54de3697a411f07141bb8771a824929dccc35bda46558dd3f93a01af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709494021, "uuid": "a2d7c9c7-2a6d-4e80-b395-6b12f191203a", "comment": "Malware payload", "value": "87c47cbc62f1c01565671dc820dfcc531c01e225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709494021, "uuid": "2958315f-6e58-420a-bed8-808698e135b0", "comment": "Malware payload", "value": "12c17a2d3c0d5dd7b977cca72dd2b8ffbb9dcfca35ac9f3c7cd074e7c80ebdc6cd9f2a5918984f3bec4f77409b8040f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709494021, "uuid": "910c8d62-7071-4efc-bed6-ea990176c67a", "value": "T1C6553399729AA547381018F4DE97012B7131DEF0A100FF867B166288F4FB5B399EBC1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709494021, "uuid": "0d60ddac-db18-4745-ab4d-890ef3618650", "value": "24576:mhB8QHm35GZyZxkyMnBSPkSCMbz5Aj618aPq+YmCzpFoM81eiT0HMfD:gDW5GEZxTMBAkSN8618a4pFoVd9fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709494021, "uuid": "415a2451-b2b2-42a7-b655-af1dcb50691c", "value": 1280648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709494021, "uuid": "fd1785cf-57f0-4792-87db-f57bcb5fe971", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709494021, "uuid": "426cfe37-0b56-4076-a175-81e6e65b98c2", "value": "SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.30722.9422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a92459-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470672, "uuid": "2284bfe5-55c4-4d3b-ba19-07446046f445", "comment": "Malware payload (Kaiji)", "value": "0a5e556d8ce8c5a4615d6677ea0788bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470672, "uuid": "50920304-2c8c-49b6-beb2-c2b339af6722", "comment": "Malware payload (Kaiji)", "value": "b0452d64624129d8306f4fa2a9d222124cb4c3b5db5cf931b9739417af4c82e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470672, "uuid": "13d8526e-aa62-4555-9036-d0e4612e34b5", "comment": "Malware payload (Kaiji)", "value": "5352a83410c282faec8977a75f91b757be97027d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470672, "uuid": "d4075be9-8719-4646-b313-6d0e85668bb6", "comment": "Malware payload (Kaiji)", "value": "06312d22197181206bd01d0eaba81650aed697f39976e4a5f3e5c1a8f46fd3a961848f0fb5baccd8ad240c1b589caecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470672, "uuid": "206ebd0b-131e-4e90-b8af-629e5cabdcd3", "value": "T1BB562915FD822B66D1CC037446FE666666603E485BA1072323A4EBB83E7773DEF4684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470672, "uuid": "e21f897b-1aaa-450b-a234-bda8a7abe2ea", "value": "49152:pZb/LNaWMXioziIZ4MvLRjco8bkVP4KXx4iFfnWYhtR3KI1:pljNa3yo2IdtbhvdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470672, "uuid": "8d504e0a-7194-4fad-b025-c3cb3ddd846e", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470672, "uuid": "ee9179bc-04fd-4d41-8934-2fa807224c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470672, "uuid": "e8f519f0-b626-4fdf-979b-f0716107285a", "value": "0a5e556d8ce8c5a4615d6677ea0788bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78ac6f5-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470702, "uuid": "606ccf53-94e7-47b1-b95a-42ccd97e94ca", "comment": "Malware payload (Gafgyt)", "value": "9fa013056c1a113372cd30857f7ce2cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470702, "uuid": "bbdda27e-0493-4376-a932-d03aaf6e0b16", "comment": "Malware payload (Gafgyt)", "value": "b17074c278edf8eb86d2669bc329ecbb2cc9354fb0831ef6db60ebcf5e4c67b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470702, "uuid": "8a426733-875d-43dc-8894-9862d33b859d", "comment": "Malware payload (Gafgyt)", "value": "a973cc4701d4cb78b9b81481bf63e0bb12392703", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470702, "uuid": "55d13f64-4134-4f75-ac68-8730d6e37e9c", "comment": "Malware payload (Gafgyt)", "value": "2e54be646ba4b5ecbc832156975b3e317396ed7981da2eb17a587245b619040261fef772dd05052682b2bc256e707515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470702, "uuid": "41fcdfbe-bd6d-46ac-b655-8c97dc4e3629", "value": "T165041A09D6408B13C1E2277AEB9B434B33239B94ABD7331656285FF03FC27996E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470702, "uuid": "22a8cf0e-b0ee-4244-80e3-c95c69ef3664", "value": "3072:IuJ2XrhIrTJhmFXSo44jattKm3gUwK398W4rqTO5hzgP2SNpM/99FWwsmowhbRWd:ITS+jattKmQUwXvr15hzW2SPM/9/JsmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470702, "uuid": "c262ad67-4a48-4443-84a4-b8788d26a637", "value": 179633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470702, "uuid": "a304c7bc-664b-4c0f-9d49-68623e094cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470702, "uuid": "ac2476b8-85f9-46ad-afca-befa433ca189", "value": "9fa013056c1a113372cd30857f7ce2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f62386-d98a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1709489938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709489938, "uuid": "3e432fe8-7575-48ae-9922-7826a837f032", "comment": "Malware payload (NanoCore)", "value": "206547178c018a7f4db353375eb0f8e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709489938, "uuid": "fa033e60-3927-47ec-9ffe-85315c18a3fc", "comment": "Malware payload (NanoCore)", "value": "b2865f04239ad453c02b1baa8aca4f44e9e5d3326c6915056781cea7c0bc733a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709489938, "uuid": "4e0eecb3-ac78-4a57-9be8-87cc47a09d4f", "comment": "Malware payload (NanoCore)", "value": "c020381a40331f586369ce39a2f0086d7a4c79e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709489938, "uuid": "355e699c-86b9-4019-8cf5-8fa15e70d923", "comment": "Malware payload (NanoCore)", "value": "f6a199b6b015dfa1e824abccf0071b48c3b61786a5a9738cc4720efe3d8990b0c784ebbd94da1e47eb6d186378fc4e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709489938, "uuid": "269754d3-da2a-4d83-b82e-678eddb9a5ee", "value": "T1F914CF1537A8892FE2DF867960225252937DC2D3A8C3F3DE28C455F78B667E10A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709489938, "uuid": "ffd4159f-88ab-47cf-9ea0-4e105d32ed10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709489938, "uuid": "df5d7f63-2749-4d85-869c-6ea326ecbdc0", "value": "6144:gLV6Bta6dtJmakIM5w/vsYvaC5tdNHydik4:gLV6BtpmkH/0YvaC5tOUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709489938, "uuid": "f2510dd1-abf6-4dfc-a022-8e7cdab5f5b2", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709489938, "uuid": "71a2cf28-ff5a-402e-860c-a70ba40c059d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709489938, "uuid": "03790e67-52c0-454b-a6bd-b93e8b3075be", "value": "anyad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9d5683-d905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709433021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433021, "uuid": "0cd67ae1-aaf8-40c8-bcbe-58119bed85a4", "comment": "Malware payload (PureLogStealer)", "value": "c1ccf8d9906984b81c192e97685e502f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433021, "uuid": "50748573-6d28-4f54-b8c1-7f2a1048a656", "comment": "Malware payload (PureLogStealer)", "value": "b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433021, "uuid": "c588a20c-f3e1-4e0f-801f-813ee0abadcb", "comment": "Malware payload (PureLogStealer)", "value": "59e728cf9787584efe29d291b8a3a2f9704fdbbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709433021, "uuid": "025f8f1a-32d5-4207-94b1-e3788bf4fee8", "comment": "Malware payload (PureLogStealer)", "value": "40db2598a342e03cdc472f0ffdb8d546057cae964039842b3ca7a6c53657e67b9db7642a5956b67bd5d6b1203d0f83ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433021, "uuid": "a6fce0fd-88da-4b41-a514-160d2a2a5418", "value": "T16E33190273FA6B2BD6BDE3F819B5540483B4266F2253E35D5DD198FB2228F009561F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433021, "uuid": "16e7251b-3138-4e38-b3e4-cb837dcb4cd4", "value": "768:3mybF54g7iZn3VM24isvhkUvwbOLn0CfJz3NNW26gd3CoojXAD5MeEsw8PfgGqpu:WyinFMn0Qz3NNW2xd5CYIGqpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709433021, "uuid": "064e920a-bd95-4658-a11e-c98ba3453e5c", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709433021, "uuid": "4d583dd3-c662-468b-b80f-d94031f133ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709433021, "uuid": "45c66731-126f-4fde-b816-42f7623b431c", "value": "SecuriteInfo.com.HEUR.Trojan.MSIL.Scar.gen.31023.19000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0ebe2a-d91e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709443595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443595, "uuid": "0a89f4e4-9b24-4ce9-96df-67ab87e29948", "comment": "Malware payload (Mirai)", "value": "a5269c41f0417dcb0a7badef3e42d19f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443595, "uuid": "f50dcf1f-9170-4897-90cf-c5d19f2e8831", "comment": "Malware payload (Mirai)", "value": "b3d338941b5333a962679fa404e68f73062674cbaf3808382702c744570ca87d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443595, "uuid": "a687fe05-3e80-4d03-aecf-c58471d04922", "comment": "Malware payload (Mirai)", "value": "4429e696e02043787daa37fdeb579b6dbdd55eed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709443595, "uuid": "7fe67116-1807-4e4c-8e8b-fd9979fe24da", "comment": "Malware payload (Mirai)", "value": "3e0fc9eb92c91c770f3e856549a97f42f48d98d5f60acabd3bd218d1c045c8400342518f108930a21fad83e27d2c50e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443595, "uuid": "431b6bc8-80b7-4ed3-8552-5646a184c9c6", "value": "T16C731956B9819B21D5C112BEFE1E118E3313077CE3DE73229E24AF20778696B0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443595, "uuid": "b4b53e30-ccd6-4beb-b8d4-31cd129ede9b", "value": "1536:h6nSv2e6lvKCxmp0gUxAaRI+sQ/M+iWc+oq8g7+a5ZYGQ9j:HvB6lSJxUxAaRbc+oq8gqajxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709443595, "uuid": "7fea5dc8-7ef1-4d97-b5f9-0e07b61810b2", "value": 75660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709443595, "uuid": "3f3dc774-1797-4785-9c0b-9e4f789e4a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709443595, "uuid": "0c531fbe-20d8-467c-888d-b8af8486f428", "value": "arm6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e57e67-d98a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709490072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490072, "uuid": "f95de3a9-d712-4128-a1df-60e2c3ec081c", "comment": "Malware payload (Adware.Generic)", "value": "67a470d04f288bd36cbd71b496d0db18", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490072, "uuid": "7f89d8f9-ec25-45aa-a326-62c37e55b3d2", "comment": "Malware payload (Adware.Generic)", "value": "b4a43d415fd5a2c769303c37e6b0f67eb92b317b71e8c5b064dbbed04338eb33", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490072, "uuid": "13efde29-834f-4b24-92ae-88638883da8a", "comment": "Malware payload (Adware.Generic)", "value": "53e36eec36812faf49138e68ccae4c05bd696026", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490072, "uuid": "f23e64ad-9f18-40e7-b04c-cd18ba2db2d9", "comment": "Malware payload (Adware.Generic)", "value": "7dae7d233c9e054c948fe4fdba0b6c9502a26a21ad6bf3e03e7b8182d62c52d303cc021d0b180faed1d24bb1733ff949", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490072, "uuid": "e0ed758c-e46a-43f7-abc7-ac96d83ac891", "value": "T1BE26013BB268753EC86A1B320573C37099BBBE61651A8C1A07F45C1FFF364601E3AA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490072, "uuid": "0b916970-0d43-47d7-b7c7-af2de1d9af75", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490072, "uuid": "62e32a84-03ed-46bf-b541-e606437a2ec4", "value": "98304:dkL3Oj6MduExNVjWmxCsGrBhD0kXkqUQOkfucdBpRtrcm9kSkr9o:u3gxNVIrhZkRQp1Brtom9kZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490072, "uuid": "aacbc4c1-6248-4161-b62c-128ada560b31", "value": 4480485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490072, "uuid": "130c07b6-32ca-489a-9797-d1c08b629a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490072, "uuid": "25d23a2c-ca28-4cc1-b749-7de90da0b7b2", "value": "SecuriteInfo.com.Trojan.MulDrop25.1292.5076.11426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd73420f-d95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709470310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470310, "uuid": "63897eec-59b2-4db1-9f76-45e69b1bac0e", "comment": "Malware payload", "value": "676fb462dd2431b2280c1b62462e2d56", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470310, "uuid": "9f77b6b9-526d-486f-b897-eed47a363e05", "comment": "Malware payload", "value": "b61b1f594bbc1e801e7b73fb6ac98213edf3e8dfacd02239bd81027eb76db74e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470310, "uuid": "05ff25ac-b40a-49af-8602-44bc7ea826c2", "comment": "Malware payload", "value": "806c1c69888621a312a86416158ac3eb1db261d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470310, "uuid": "a7a5f6cc-d955-451a-9915-267aaa805e53", "comment": "Malware payload", "value": "05979a87ca51dd915ac97c4e856079ccaaf98dc29918fa2e920121509712c1510ee2ac5669f7079d6e9fcb7bf08b024b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470310, "uuid": "caa29cec-56a4-4ef6-ad49-f63f525d4bb3", "value": "T1C1E02BD08D711B43F1671C32717557A3C6BF90AA1A547D1E141B69317DE78700980BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470310, "uuid": "ecebec8c-a979-4b2e-a75f-2267938d4a24", "value": "6:5jHAzVmURXDVIcu9imeF3gel5iGCLJwFAD2lDtBzVmURXDgt+lRlX:5jHGmURX2cu9ipRn5i91lalRmURX0taz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470310, "uuid": "5d56e7a4-722c-4231-8459-7b96e1d209d5", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470310, "uuid": "58006b99-2ddb-4a38-9335-9482ea2d82ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470310, "uuid": "818e88c8-51e6-4534-b79c-0a7477825a9c", "value": "676fb462dd2431b2280c1b62462e2d56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16e7dec-d9b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709507602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709507602, "uuid": "721bd72a-b775-4b19-922a-d0aa4fd9d8b2", "comment": "Malware payload (Mirai)", "value": "ad3cfb4984191946453083b84f0ea331", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709507602, "uuid": "5e574c2b-27e8-4e67-b191-9737f74861c4", "comment": "Malware payload (Mirai)", "value": "bb2c20e994ddd2c9c459b0a7558e61736a89b23afe3d20dac931567c0c7cc699", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709507602, "uuid": "cdc5e31b-32bb-46f7-9551-5a097f8b207d", "comment": "Malware payload (Mirai)", "value": "fed1e37f9c6c3c87c78e9d8024c6202eacde4a95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709507602, "uuid": "4e375e0b-ecc4-4942-a707-3fe8206ec483", "comment": "Malware payload (Mirai)", "value": "3cb1a1ba90f0fe949b7ac830995f75afe89b7f44c9c114761440fb8778d84592ed5d054a507a9dda8ecb158e0ecc3e6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709507602, "uuid": "421b3bb6-9a18-46ca-8e17-4b09a4c10308", "value": "T14FE340A97A31BF6DF56C83314FF71FB4D305218272A0D292D26CE6188EB035D598E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709507602, "uuid": "6a4ded5e-2b0f-4897-9aa1-1d1738b29e34", "value": "3072:H6mMIKGpkfnfOEqhLqJRY1cTouhVzuItpxwGlbN/PPKwWNXY6UEI8t+z8dM:H6Nouli9tBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709507602, "uuid": "8d9040f1-1d94-48a8-b765-4c9853984161", "value": 147580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709507602, "uuid": "30db6c0b-7de6-4471-b2dc-2ea038b8e47d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709507602, "uuid": "91d5fd12-bec3-40c8-bd9d-7710195cbea1", "value": "ad3cfb4984191946453083b84f0ea331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871663dd-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709471051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471051, "uuid": "701b9e6f-f31e-467a-a06c-be4df31233f1", "comment": "Malware payload (Mirai)", "value": "e88f810b620bd4cfc7f1c40f7374c52a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471051, "uuid": "41c3ed77-d58f-464c-bfd3-23aca8da8e51", "comment": "Malware payload (Mirai)", "value": "bccf92f5eaf9adf3fb20779682ab20c816ffbce7133c95a623a95c3f0f5c40f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471051, "uuid": "b04f8a70-5151-4808-93b7-b830b54b4af1", "comment": "Malware payload (Mirai)", "value": "6c04c719d7f18bbd04c962c48a3e55041733bbd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471051, "uuid": "8c052e4b-c8b4-479f-8735-57b6ab1f244d", "comment": "Malware payload (Mirai)", "value": "d72a3214601542f546a28b27aff2bacd0b0913ea75d266925e8501125cbbab44422d3639dc6d9f8f815ee201e18ff78f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471051, "uuid": "795ed387-db4f-41f4-ab43-59a05e5dfdee", "value": "T1AC231A02B541D6BBD44327F592A78B211331F93A6B538D2AE3183CB4E717688B29376D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471051, "uuid": "87e3a59b-52d0-426b-9622-148eeec9548c", "value": "768:AtwecFJoggyU3mq5IujF0AToPIZ8BxaTo1WNLp3SIGWQbFW:Atw92jC8uGoPIZyxaTo1WNLOFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471051, "uuid": "e35ba5fd-ee56-4b97-81aa-b4749c40aefd", "value": 49169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471051, "uuid": "2ae10177-2e6a-471e-9bb5-fec073baf7b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471051, "uuid": "4616495e-eefe-4bd4-ae9c-24fb56a8f297", "value": "e88f810b620bd4cfc7f1c40f7374c52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d78afa-d93f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709457768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457768, "uuid": "e82cea97-2a25-4677-9618-5cf6b8982be5", "comment": "Malware payload (Formbook)", "value": "648b4fced14ce26d184a31002a201e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457768, "uuid": "c71d1e35-b905-49b3-ace8-7201a5746aea", "comment": "Malware payload (Formbook)", "value": "bddcce49e362dfee4d32dea7ef2055a3d0004dc783afe9182b70747a9381d685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457768, "uuid": "25cad451-2cd7-452c-a763-b0663db18d8f", "comment": "Malware payload (Formbook)", "value": "bb0829196cd3d2d8340b992f905661cb96519e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457768, "uuid": "db1edf0c-8cd9-494a-b5d4-1160ea769351", "comment": "Malware payload (Formbook)", "value": "f50e349c831f76332338de716912127e72a820ed47830c5ce71a60f18e9dcd4d66eb50525056fd2da7db98c5303b1009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457768, "uuid": "b1acb2ed-8407-4acb-8b74-61f0e4cf4f44", "value": "T163451202BAC588F2D572143159399B61A93D7D201F718EEF93D83A6D9E312C1C2367AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457768, "uuid": "40f9b9c2-4d7a-461f-9773-17a3acb6836f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457768, "uuid": "3a33dcba-675c-4aac-bf7d-f5d493831b01", "value": "24576:TTbBv5rUDAbVkN0BFbilTlM+UNMIbPeni+rfQifbAZP+vPM:NBDe+kM+ObWr4CAZPOPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709457768, "uuid": "0ef996b1-a7ea-4367-9967-7eb4acd6bf2f", "value": 1208323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709457768, "uuid": "1a1a8c8d-844d-449e-9283-bfb8167a8b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457768, "uuid": "7cc66cfc-d7af-4209-82b4-4605516734dc", "value": "doc2902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a659f8-d963-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709472978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472978, "uuid": "5202f7b0-9f86-4f56-b125-be4d0b3e3668", "comment": "Malware payload", "value": "05957d98a75c04597649295dc846682d", "object_relation": "md5", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SimpleTea", "colour": "#0FEA5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472978, "uuid": "31ea51ea-221c-41e5-b96a-573b4b63d71d", "comment": "Malware payload", "value": "bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b", "object_relation": "sha256", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SimpleTea", "colour": "#0FEA5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472978, "uuid": "ee486976-be2f-40b6-bff3-96b319aaaf3c", "comment": "Malware payload", "value": "676537b0f7707feae0130bbcbdc881f5b4eb3f03", "object_relation": "sha1", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SimpleTea", "colour": "#0FEA5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709472978, "uuid": "3e81244b-c76b-4b01-bc18-21ec8651a4cf", "comment": "Malware payload", "value": "a3ce7138baa33e6abe8e97ce1b7aa5328a1f1f048312ed2770ca79b07f5bb5e8a54cc2552108449c8e1d15b460d7c01d", "object_relation": "sha3-384", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SimpleTea", "colour": "#0FEA5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472978, "uuid": "f9f5f940-6ef0-44f2-92ba-b80abf1c0f77", "value": "T164043A43FF481807C8C4813D6AB947024167F2567AA6D3BF2754A71CAFAD3D5731AA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472978, "uuid": "de6e0fc2-4bca-4ee2-bf9c-9f7d151d0bb0", "value": "768:+D4IjR+m+k5C0E6PTz8WXmonko/Sr63jaPE5LJImKGeMCpiA5Ndnk1Qdmw:9n6PTNOKjaPILJ6G9EJdnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709472978, "uuid": "2fdfe9d4-fda0-4a51-8e4b-91c7f0e912e7", "value": 173792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709472978, "uuid": "db155ad5-1661-4427-ad08-944c2f2aabdb", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709472978, "uuid": "e0d900f6-f48c-48b1-997e-644c1b449983", "value": "os_helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660b771c-d9b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709506214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709506214, "uuid": "5734aa9c-894e-4f73-bcb6-1405f5488668", "comment": "Malware payload (AgentTesla)", "value": "ae4a2fc900ca8ee22a8045770f439e64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709506214, "uuid": "0653c618-4e29-4e97-8794-4f66dcdfaaa8", "comment": "Malware payload (AgentTesla)", "value": "c1497f6f045f7995902da86b25fb7669cd0514317ccf92a428b5f121cf7990c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709506214, "uuid": "628ac7ec-63ac-4160-b685-1eaf779f5de9", "comment": "Malware payload (AgentTesla)", "value": "7319321cdb009a2a164f98c5136144fbf4a2e77d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709506214, "uuid": "bdfde044-2007-45f4-9bf1-69f70ea7110d", "comment": "Malware payload (AgentTesla)", "value": "87e8a9a79f749d16ba9f3e6d47b33a502e754914d388613df02e4545446e0a77d2b9085392cc3f9c15796ba9ceacde44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709506214, "uuid": "3dd260b1-f617-4eda-9b0a-fd9b67e4d858", "value": "T16D340F037E88EB15E1A83E3B82EF2C2413B2B4C71673D60B6F49AF6518516525C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709506214, "uuid": "9f943ce0-48f5-42a6-be61-85775e5aba63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709506214, "uuid": "878e8491-3f39-48c0-ab5c-649910bc7d78", "value": "3072:s/XvXfqzV44QrhBiyL+wo32r85M59UIeEJpN4jt:s/XvXfq642hgySw62CKeEHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709506214, "uuid": "653c6120-7d48-4942-afd7-38e1d4139a81", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709506214, "uuid": "71380b14-833e-48f9-a90e-340ec8bbd77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709506214, "uuid": "7a7e9ba6-6336-4280-9760-fa38f597697a", "value": "ae4a2fc900ca8ee22a8045770f439e64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8752fcfe-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470622, "uuid": "b08675c6-2256-4a4e-9536-52df8b464cd6", "comment": "Malware payload (Gafgyt)", "value": "d4c40c66c5e939d82430b8c8aa0e46ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470622, "uuid": "49793d24-617b-4f70-8660-371ed479d984", "comment": "Malware payload (Gafgyt)", "value": "c2bc677627dc1c48507e5773d83e3ad7e5e315a2d3011c07fda8fea96f626998", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470622, "uuid": "3cb07819-c06f-4c95-b137-dc72ef8a7723", "comment": "Malware payload (Gafgyt)", "value": "900f57c454745466982282838825a76eed8215bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470622, "uuid": "ec2f95d9-e21d-4642-8b76-473aef93245d", "comment": "Malware payload (Gafgyt)", "value": "59bd600fcd86f5154d4ede2c523dcfa9139414d6c11273903857f0e1d660721c065ecf4e24b5394201330e9ab89d83cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470622, "uuid": "5320cacf-a57e-4eb0-9699-2bd1eacdc932", "value": "T1DFC30A04E8408B27C2D267BBEB9E478E7B3597946BC7331256296DB02FC27583E3D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470622, "uuid": "e581790f-c26f-42fe-8318-b09f379112dd", "value": "3072:AHrcUt7q0dEK52b0auUvtUepFgZszM5h+qeBAZs82E5QInMqEi/M:8ruUenxzM5h+qeBf82E5QInMqEi/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470622, "uuid": "a40f74ba-1ac0-4e35-a58a-8fd7d4b8050c", "value": 124039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470622, "uuid": "8062db97-afd5-4ae9-b21b-7fc93f24b584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470622, "uuid": "6c5751dc-2e7c-4936-b7e8-0f6c8e0ef83d", "value": "d4c40c66c5e939d82430b8c8aa0e46ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214d051e-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1709490207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490207, "uuid": "7d543e19-eebc-4b57-97d9-169c98d9156e", "comment": "Malware payload (Glupteba)", "value": "56be22204458d144a3e51d44aadbcda4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490207, "uuid": "704b96ef-d691-4b45-b475-64c880ab9075", "comment": "Malware payload (Glupteba)", "value": "c50b307c9a919289e33291fa515f789077c7dd021cea4b2b2a5078993d2b6aab", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490207, "uuid": "ffc168cc-e3ab-465a-a8b1-8ca6e478d838", "comment": "Malware payload (Glupteba)", "value": "525885edad6939af1cc35c9c347c0192a685d27b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490207, "uuid": "e7cfae86-1375-4410-b2ac-cbd9194b08a7", "comment": "Malware payload (Glupteba)", "value": "aa6fc6bffa42bcdece1eab5c1c71122b53aa750bbdca45a40a05f9daa66c12527d1198a4e79f95fb0cf9c69d528cdb34", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490207, "uuid": "984e8ed3-c55b-45eb-afd2-4833bba7594f", "value": "T10B1633B75D80D4FEF64360716603E6F22A7BB956135884430BD5CB3F283B7A29511A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490207, "uuid": "a5285376-5b4f-41b6-99c3-3f1d9d424a98", "value": "71c1b0708070f63fc1b5923ca888032a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490207, "uuid": "425b6e8d-ebdd-4138-b003-451c8448cc8f", "value": "98304:I3pq46IRc4BabpvEwkDKwmY7UmG82ut1mWH52q:GR6l4GE5DKNYM82uBH52q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490207, "uuid": "5befe378-2bb1-4265-8144-d8ff028d8460", "value": 4324752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490207, "uuid": "faa2ad00-7bdf-4121-abf4-632632cf9f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490207, "uuid": "00685608-9419-4d2a-92b1-3c2f17c36e09", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ad590d-d926-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Zyklon)", "timestamp": 1709446809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709446809, "uuid": "c0f015be-a000-4b73-b822-f697c71eea22", "comment": "Malware payload (Zyklon)", "value": "3a7a68764cd8137146a946fdf2c5bb12", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709446809, "uuid": "409e8888-c4cd-4dd5-b8e3-17582c285e9f", "comment": "Malware payload (Zyklon)", "value": "c66f8297ed4b1a4c41d009408ca15ddb0ecb33cfadd354ee872668b3ff8fb687", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709446809, "uuid": "008d2dea-5b26-4b87-8efc-b27018ebc205", "comment": "Malware payload (Zyklon)", "value": "21454bda82e70990ea426d9fc3ca9d013642675b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709446809, "uuid": "b6a0b300-a5ec-41a3-ada7-2bab1d4e7207", "comment": "Malware payload (Zyklon)", "value": "9b1c4d5ac5bbaec85251ef4b185d91c66559c3a6d6738b1ef814e10df50f085c4061c69287ff7acf0bb88b98f26af9a3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709446809, "uuid": "1ca54324-4d8d-40d3-b438-90257fd68fe1", "value": "T1E04188B206FC9658F1F377284775637E4223FEE0E439928C58921E1D4FA1B084129BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709446809, "uuid": "969bc664-2d7a-4588-8242-2047af404526", "value": "48:vWlLoMmlmlmzmipmlsVIqcNfzQifuzVv2KhlyYpdWm8fAyXFFLN:IBCCmzmipCsVIqcNfzQiGzVv2Kzymt8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709446809, "uuid": "d4d2edad-17df-49c6-b37f-2f0a236a40b2", "value": 2100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709446809, "uuid": "de74411e-71b5-4ef8-a4eb-ffc4c535a7f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709446809, "uuid": "04b00083-a11b-412c-a19d-1bc9cd2bb03e", "value": "document03324,pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f216845-d990-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709492378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709492378, "uuid": "95eba933-dfda-4b85-bedc-7667405f16a4", "comment": "Malware payload (njrat)", "value": "a028bef15a742cfe213b5ad5e4630858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709492378, "uuid": "0b4ff212-6372-42f2-8ce9-a971b5d3aebc", "comment": "Malware payload (njrat)", "value": "c7b4072d1237617b13a7613c46e5a4b63bd8e09b7c9eba9409133fdd0aee7b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709492378, "uuid": "e3f3fb12-bd98-41a8-b2aa-8c4b106a1561", "comment": "Malware payload (njrat)", "value": "ca8340a2f0fcad2bf868935bf78cc2f36993bca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709492378, "uuid": "aecbe341-2509-472e-80b3-a1425a1dd0ea", "comment": "Malware payload (njrat)", "value": "822fea30f59894c748122ae59e678f53b5fd8b807a185323dd713c96621ced55b12434b619914988202bcadf4fe3573c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709492378, "uuid": "123fa17a-1839-496d-8ff7-a3a1b62d7f3c", "value": "T16C032A4D7FE18168C5FD067B05B2D412077AE04B6E23D91E8EF664EA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709492378, "uuid": "2fa43728-e20c-4b88-b551-883be9a23e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709492378, "uuid": "eff331f3-1b95-4198-a86a-de7b583c5bc8", "value": "384:rmZ+vEiTbZvpWNcZ0y8f1CRDX5CLk6SiUrAF+rMRTyN/0L+EcoinblneHQM3epzs:K+dTZ38f1CRDcNSHrM+rMRa8Nup2vtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709492378, "uuid": "6404b233-d088-4819-9d79-5d87adb5fd47", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709492378, "uuid": "37a261b5-ddad-40ce-94a6-49e2fe827e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709492378, "uuid": "7448e3d0-b388-4fff-a574-1d10cf107a4f", "value": "host.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a945c5d-d96e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709477767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709477767, "uuid": "38bfcfe3-edad-4c08-bccb-85f23836c881", "comment": "Malware payload", "value": "f72f063babd357ccdc6c346191a305b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709477767, "uuid": "accd3e57-75b0-4c1b-b936-8917f05ed991", "comment": "Malware payload", "value": "c90d23214088641431d2a93b6e3dfa26e6f5149bc8028449b7ce2f8edb2a6dd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709477767, "uuid": "e67ff044-c862-4365-8020-7677832eabf1", "comment": "Malware payload", "value": "a7794664194a9087cbf9114d0c33bb88e9ceacc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709477767, "uuid": "387ccd3f-6740-40f5-a363-7550a40b5849", "comment": "Malware payload", "value": "48e695fb1884b11a1d615618b7dddf476c24b3b59ca7c0be0a0ea71d2acb64e6909a3eca2ae8998af59ac7dcf9de1730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709477767, "uuid": "b6627249-4d29-478f-ba59-d2b24678766d", "value": "T1C736338DAB926FF7D244FA38A78868953EAC191B648C7A213D4DC74D0B7D2411EB3F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709477767, "uuid": "3d348e82-5b8d-4298-9a0e-b4be66ff78a2", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709477767, "uuid": "d8a80247-789d-4948-bfa8-37712fe5f438", "value": "98304:NxI7qGEiHBIf+0OgrqA5uillvHsO1733e1pDoEnIVWQd5jZWEFx:nIuGThIfVOgGAIillPsiruDXIwQ/Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709477767, "uuid": "204e8668-4194-41a4-a21b-29e49eef4885", "value": 5014528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709477767, "uuid": "589f9d26-df28-4f38-9bb5-9ff4ed82fc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709477767, "uuid": "07bff0a2-9f8e-4741-9abb-5bcb0b3fcfbd", "value": "f72f063babd357ccdc6c346191a305b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd53952-d98c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490656, "uuid": "029626df-fd8c-4930-9835-240c02a7a9af", "comment": "Malware payload (Mirai)", "value": "1556201f55bbb0b970fd6eeacdc909f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490656, "uuid": "6b1be90e-5581-4a44-a56b-11c216ba19c4", "comment": "Malware payload (Mirai)", "value": "ca03072c053dde5920eb111b56f9b5429f986b89bfe970d4f157643d139bb77e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490656, "uuid": "43ff69cb-3839-4e0b-9d82-fd5f5e02fe15", "comment": "Malware payload (Mirai)", "value": "8afd512b817a1783ca2da5029f65996e2ca811b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490656, "uuid": "3b771cd5-737f-49c2-a9e4-5ca40b545a00", "comment": "Malware payload (Mirai)", "value": "5d96d2116f818b0a309a05da28032f08ded58fe4a1cede5f95fc560907f7a291b071979ab46abb935e2f570739078a00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490656, "uuid": "c9132a67-4c08-40d6-be8e-1ad571c53307", "value": "T14A634C32BA751927C4D4687A61F30725F2F2839A24AC8A1F7D720E8DBF6465072537F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490656, "uuid": "8e28023e-8626-404a-a59d-032f8bb826c6", "value": "1536:rDfc08yfhWZtpFctzLlH5RJrGmQGVht6Vk7k9t:vfcq+tpSlLlZRZBSK7gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490656, "uuid": "5e9f6581-6c57-4719-bbd3-c3862a87a3da", "value": 71712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490656, "uuid": "8bcf6fd8-d6d2-4941-b611-983c4f31f9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490656, "uuid": "ffddf769-93be-4c3d-a059-3bea5b53de98", "value": "1556201f55bbb0b970fd6eeacdc909f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fb9eeb-d94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709464705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464705, "uuid": "30c01b2a-6125-4003-96b5-2d33391a4b4b", "comment": "Malware payload (Mirai)", "value": "bdbc86c29fc28943546fbedd300730d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464705, "uuid": "10bd11ba-5875-4015-89fd-137497bee7dc", "comment": "Malware payload (Mirai)", "value": "ca121b26cc256ddd08cf65af12134fd861969193090a0eabe20f3948055341e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464705, "uuid": "3ef6d4fd-f2c5-419f-b3c6-b140280ee603", "comment": "Malware payload (Mirai)", "value": "94202bee8a9ac0d38219ef881a8242280337b889", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709464705, "uuid": "c59a37ed-84fe-401f-9767-60ff590b181e", "comment": "Malware payload (Mirai)", "value": "ad04e9f6923fef2ed8cd5f5e6ac9d8159a7b375fe7b9a6a706031d9be1c64cf29370ded60f0e011fbd1bed0a79177e63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464705, "uuid": "500bf29e-6fd9-468d-ba8c-875e77614033", "value": "T1BF53E781BC41A629C7D11777FD9F559E3710A3C9D2EA32138C240BA07A8F94B0D67F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464705, "uuid": "902b0fcd-27d4-47ba-99f1-976ea05ee51d", "value": "1536:qmg+V1yILr6oJBOP3SSBPCkXM33eZtxot/gHh:qmg+V1yILrfchVU3woMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709464705, "uuid": "c1fe8a1a-a1ed-415e-a33a-873ee904fa8d", "value": 62908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709464705, "uuid": "fd65990b-3eff-4f6e-98bc-da44f862220a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709464705, "uuid": "31d3afbb-bd1f-4381-9c5f-fa46196fead6", "value": "bdbc86c29fc28943546fbedd300730d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba2632b-d9b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709508156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508156, "uuid": "433db95b-d638-4629-beef-3a4a5a124c17", "comment": "Malware payload", "value": "c05811b52a174972320839a442b36700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508156, "uuid": "76335116-ca02-483e-b9bd-47bbf87e21b4", "comment": "Malware payload", "value": "cae08fabda56592a072445fea667826827f786caa83c5fe6c238d623d31b8d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508156, "uuid": "e27db3e0-afeb-409f-85aa-87bef03ba74d", "comment": "Malware payload", "value": "2aa5480b3619d2817219bbc0bfab6e06a65e6dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709508156, "uuid": "e31e55a7-13fe-4b11-aaec-0acb65d8473f", "comment": "Malware payload", "value": "52e19d66d35549973c49026e9df9159d0dc53f5dd6cb04f2e160e8f6b7020e41a1bd2d2fa13a6759ef433581b8b8b1b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508156, "uuid": "254b0991-ba2c-45a5-a649-2d1ca66e27e7", "value": "T177A23B2AE35609FDD5A5E13DC177191BE2B1FA452B3042CF27E444BD0E322C1AA7DE82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508156, "uuid": "fbd3fa71-e9e1-4f8c-a423-2e84eab0bad8", "value": "8b6f2db896982d442aeeb4ee5e983095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508156, "uuid": "773e949f-d70c-42b0-97bd-1ae4187b978e", "value": "384:K3gRYqZ+IA6DFkzfLG6/lLzMaOAxfHOpQSiPpfWBeo5cN/1:L6k+Eg9AaOGfuIRfocN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709508156, "uuid": "8b64b85e-4e46-45d6-8771-9e0cb853e275", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709508156, "uuid": "7fec9bc3-0bf9-40d0-b2fd-f8a4501891f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709508156, "uuid": "d0873d61-3a7d-4056-8e8b-a9a21d3329a6", "value": "SecuriteInfo.com.HEUR.21067.8049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c90a07b-d927-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709447276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447276, "uuid": "a169e9be-c2a1-4af4-bb64-56dd935040c9", "comment": "Malware payload", "value": "968cb7f8265a8ea393149c23e8a8d0a7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447276, "uuid": "974f94a5-42cd-4e16-9cd6-0f4e846fb331", "comment": "Malware payload", "value": "caeb22252fcfcdd19a56aeb15098e07f3f83965526f8e462acae0594d608a15a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447276, "uuid": "a7581c8a-2451-4c70-8a8c-0316659630c8", "comment": "Malware payload", "value": "dbcf1fe4eb2fb2c5338856c24f97cd91d8528341", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447276, "uuid": "23e6e717-f21d-4973-8fb3-67dcbf9d8392", "comment": "Malware payload", "value": "3243e90cc14ab6786bfa98ee6a66b8d18c3aabc8126b02028dd2f780a542fa89efb61b922bbeb9f79a6aaf82ae170b33", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447276, "uuid": "1005ecc3-557d-47ba-85ac-b1991aeed9e5", "value": "T12A8723D7F7384E2ED877417B494E123A2A664D15CB83974B2A08772D38B36E40F45BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447276, "uuid": "8a6105bd-aa59-4601-ace7-9235ad31f2a3", "value": "786432:rzU1jZQaL+EQ5Gz2nhGD+G/M62HfiGY2eXc6gt4SxIp6QF/:rzU1jP+D5G6nCt+fiGfeXAttxQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709447276, "uuid": "2d42ec7a-6479-41fe-abac-017f14705078", "value": 36710290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709447276, "uuid": "0859523f-515f-4c6c-a5eb-214f8cb24c50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447276, "uuid": "962a58dc-7266-4af3-a9ff-9ac2066dcb7e", "value": "TVE Mobile_4.2.0_20230822_mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2438f1-d986-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709488402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488402, "uuid": "89ec1cbe-4ded-4fe1-88c4-508a47d7fa08", "comment": "Malware payload (Formbook)", "value": "dfd0f762fd0542dfb8c6155cff5c4e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488402, "uuid": "d393ae98-2393-4d69-b415-a548a6bf49e8", "comment": "Malware payload (Formbook)", "value": "cf722cadc5cd807f450ecd57785c49a4bd1909970bb883adaccadffbe945cb30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488402, "uuid": "bcf2f34d-e0f7-4ff9-bc8b-2f46175573ee", "comment": "Malware payload (Formbook)", "value": "733846f769a61f774e786846c3c5da51250dbc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709488402, "uuid": "242cc4f2-40d4-4609-abe8-925d18a164f5", "comment": "Malware payload (Formbook)", "value": "1b5d7c22b2d4c5f44b899cac279d70d04d2083776dbf36f51fae32d9b0c3c164444bca83c518f4c8ddaff42a75785a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488402, "uuid": "3504e205-33a2-4307-a816-04f1dec36028", "value": "T19AD423207B4C5E33CB2E257A69F1234603B013A7D75AD3DDAEAD47AAC0867CD5B42352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488402, "uuid": "47002fb6-bfb2-4728-b4ae-84ad3a7ace03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488402, "uuid": "02a2232f-40bc-4fca-8d68-a040db43ce3c", "value": "12288:3/ScVvTEazpgOSN2WURS4EDUugrUuU2couM84IgpFrggaIJf9npIe:vSOFzpgOPP6OdUVZP9s2IJlnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709488402, "uuid": "f26fe6d9-b706-4bed-aa73-f8659f4dd225", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709488402, "uuid": "bed2d047-fb6f-4106-bdd2-3412fef611d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709488402, "uuid": "7252b667-47d1-4467-852f-672fcf3a47e6", "value": "Documento de solicitacao de pedido No 158645080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abba6ea6-d93f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709457798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457798, "uuid": "25aad0f2-eb1b-4175-bc04-ae38aaebcd06", "comment": "Malware payload (GuLoader)", "value": "7a761d2aa880f46f3d41e45b439746a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457798, "uuid": "4aa00c6d-c5a1-47f7-ba27-9e405c0e9939", "comment": "Malware payload (GuLoader)", "value": "d123fb453fd6867f2a50d05fe6fd4225e9bb9f5ccb3cd143312652b3ed45dd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457798, "uuid": "b98fd9ed-bef1-4277-89c6-c534dce960f3", "comment": "Malware payload (GuLoader)", "value": "c73ab2f0817e527f144049dd1e6eb78ff616f95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709457798, "uuid": "75464d0c-786b-4eb9-8ea4-019c81069bcf", "comment": "Malware payload (GuLoader)", "value": "0d3b1f244d03292b3ae2baf47458c8a99f0c7e52b3fbce9101d3806238e8416b6eaebc80bd5855c7a7147d8b1c4bd314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457798, "uuid": "aa54a7d4-896a-4ac8-8149-e60aa4a8ffd4", "value": "T12C05DF23E768C4C0ED835A746D2D74806756FD8CB439A7FE192CBC60AFBB6B10D64609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457798, "uuid": "86dfcda9-300c-4ef3-b171-6ffb3b3d16cf", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457798, "uuid": "9fd6fc0f-2ab5-4780-bae2-9d237d7b97b2", "value": "12288:aMhSAxk0NhDcNgXbAs7MPzwpsmmvD7/2OiBo3TOdxSCCgZ9K:bhSNYCyJAP4srnjiBo3VuZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709457798, "uuid": "d4cadd1e-3743-48a3-9084-104848b1538b", "value": 796872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709457798, "uuid": "69b4d2d4-e544-4ff7-9b26-7d96211f8510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709457798, "uuid": "20da298c-67c1-4ed4-8f20-6c9add2d1f26", "value": "HSBC Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fb6ee3-d914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XenoRAT)", "timestamp": 1709439338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439338, "uuid": "40ac049b-f07e-4585-b897-f2a9cf3a2d33", "comment": "Malware payload (XenoRAT)", "value": "a126e3f5fea3c084f6c1d2016e5bd8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439338, "uuid": "c2e4e686-4a9a-4046-8bfa-633a7807af30", "comment": "Malware payload (XenoRAT)", "value": "d46c6abe67f46697485c15d69ac0a3713cfaff30877242634ea57f5d68401415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439338, "uuid": "59c29a9c-c789-4af8-bb59-578e3bdae078", "comment": "Malware payload (XenoRAT)", "value": "43766ebbb1c472e5e88a12e93eada56b2fe55d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709439338, "uuid": "bb22784a-5079-4d3e-b612-40dfee43d1f0", "comment": "Malware payload (XenoRAT)", "value": "8f1f1f523ac14346eab858589af219f7b1cba3fe43710445a221db3144577d626c7b8147662467305611a4f6979a8458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439338, "uuid": "6fcd9af5-f047-489f-ad8b-2a08a4984f66", "value": "T161240D2A39EF015DF3627BB957C8746F47AAF6FB1B3660BA2B021B050722E449C51335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439338, "uuid": "785dce32-8744-4138-9ca9-2286ba5193fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439338, "uuid": "85acc4a9-51e7-4164-a0c9-4f104a31da7c", "value": "3072:Mblannu+d+TRxsjOwfkdI7SKsVf4HqBr4+:Ph+SqIeKL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709439338, "uuid": "7f4030b3-8a3c-42bc-bf22-37f9ffbd4a0f", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709439338, "uuid": "2336faae-4101-4687-9423-3e4b003f20bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709439338, "uuid": "ceabce8f-7d61-4232-b693-e6379c81ae61", "value": "SecuriteInfo.com.Win32.Malware-gen.26970.14504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c275c0-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709471121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471121, "uuid": "c4da874d-57be-487b-9ee9-315c10ba82f0", "comment": "Malware payload (Kaiji)", "value": "2765e83fde00d7ecc10f34a8ce6bfdd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471121, "uuid": "c2e0e8c7-2425-463d-ae45-43e49f429617", "comment": "Malware payload (Kaiji)", "value": "d546a2070bd57c50365ad2f55f8e10bd2bdee3e7317dc44715b11ffdcaca3534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471121, "uuid": "c01a47a8-dabb-4b7a-b014-c76009ba70d8", "comment": "Malware payload (Kaiji)", "value": "1859f74450a1063f10a2ae641dcf621d749bb9a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471121, "uuid": "3eadf643-abae-4bdb-a71b-e859e6e98f73", "comment": "Malware payload (Kaiji)", "value": "ca1d1dd5dafa804566dc0f641ea5fd5ccb46f4556d05b3a9c907cb8b92cc89cb6153655c133ed8aeac339db41de1250c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471121, "uuid": "bf06da86-c31e-4d23-bb43-1e37a0af2729", "value": "T1EC364A50FECB44B6E9031E3154ABA27F67319D054B24EF93EA14BF6AE9376910D3220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471121, "uuid": "db97cfe6-b55f-4ad7-8264-c6c2b002d239", "value": "49152:Xn7PeM/wNyWyHKjl6CKIWFNLTlPCM4So2eTXYy9VrFKpZy1I1:XDNgCqjgCMtnte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471121, "uuid": "d21a47dc-cc41-4785-8778-f0d7ed2dfcfb", "value": 5206016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471121, "uuid": "266b5d73-6fd3-4c73-aa67-4a8c86dd78bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471121, "uuid": "f76ec423-7c53-4deb-83f4-a5bd7e46f679", "value": "2765e83fde00d7ecc10f34a8ce6bfdd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef0d594-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709470688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470688, "uuid": "1eb3e115-e0de-49e4-afcc-2b4f78a88433", "comment": "Malware payload (Kaiji)", "value": "9d9637fba909a9518f7b6c51f2e805b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470688, "uuid": "b54af198-fe69-432b-b1d9-1008091ef3bf", "comment": "Malware payload (Kaiji)", "value": "d5a4811feccf6db806904d74c5e987ba7a661bce80f261156df7f4f78a8df3ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470688, "uuid": "9fde1148-9874-42e1-b1ff-0ea5c136a043", "comment": "Malware payload (Kaiji)", "value": "9c881b74ad9baf0afeac94e04c58647099dd289f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470688, "uuid": "3c89c03c-6eb0-497b-acda-7519cf6ba2b3", "comment": "Malware payload (Kaiji)", "value": "169908c0c2eeb5a3aef277e66828a9dd8d5e08f9e28ea4cd040cc160a9dab2bab54fa56adfc8ef2e3aac99c4b486fbac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470688, "uuid": "54837d5b-1418-4144-8b16-74a71830bd81", "value": "T1A6560912BF48DE0BE29431359AE7C23833D57D0986E021379652F71D2EBA2B49D1BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470688, "uuid": "ca79b62e-4369-44cd-9e0f-d9f98f3dbfe5", "value": "49152:hf0hwH+TnnP46/u4iUTLWbqtSWQ1wRp7:hfzqFZ0Wuwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470688, "uuid": "2cf9c72f-d261-4cf7-a90a-dbca10dbd66b", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470688, "uuid": "7a2518a2-cdc4-45f5-948b-6d6597fa4e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470688, "uuid": "b61acd1e-e55e-45c1-9a8b-0031e39ac06e", "value": "9d9637fba909a9518f7b6c51f2e805b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f15949-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709470643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470643, "uuid": "b9793f54-5ec0-41c3-974b-4a70d43d17fc", "comment": "Malware payload (Gafgyt)", "value": "1d6cb40361742025fb36d6fbc758b144", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470643, "uuid": "36171759-73f4-458c-9fd7-04e9b4e7ce97", "comment": "Malware payload (Gafgyt)", "value": "d63b487e303a6a68290df9add9aa447df1ffcf5556c50d409ea6a141cd3edcc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470643, "uuid": "02772a6a-4bdb-4fcd-b532-89a11dba2bd1", "comment": "Malware payload (Gafgyt)", "value": "731a4cdd65c98bce5ca0bc8ddc92661f1674f747", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470643, "uuid": "e3458d8d-642d-4abe-ac2e-65ef139e5f69", "comment": "Malware payload (Gafgyt)", "value": "8fa2f86b527d602706a0493dcaf878084997fdd7b5e1230ab0e7a811e0dacaa10c2154930b374b8747b26f9f0c49a8fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470643, "uuid": "7e44296f-5a19-4087-b884-573e79d33bc6", "value": "T104B30ADBA70C0743E4DF97F81F673BF047D9B6A212AA15866009BE8047E3B781522F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470643, "uuid": "4b77c734-b728-49f2-948c-62694086634f", "value": "1536:pb3PzECGwr6EPMQjRry/GkrCko1VI8gz8y5hgq3Y5LJ+K7uTPjWUKGM:t/9xnmXCkN8S5hgTLJ+K7uTLWUKGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470643, "uuid": "ce146e57-0a4d-437e-af5e-403381094b0f", "value": 113123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470643, "uuid": "3563d2d2-b441-4794-a789-e5ccd9e8a04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470643, "uuid": "be04efc2-a0b5-4983-aebb-e05488e9d404", "value": "1d6cb40361742025fb36d6fbc758b144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe806587-d977-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709481988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481988, "uuid": "1a860ddd-7cfe-46e7-af86-98213e66563b", "comment": "Malware payload (Mirai)", "value": "10ebf68a66b056f208b187d69946ba58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481988, "uuid": "d8a0235a-3993-49ac-bda1-233c25bc6319", "comment": "Malware payload (Mirai)", "value": "d86bd99248426aa4bcd5b79924cadf4e250935a8dcb7391062642d6df6e13f5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481988, "uuid": "741970e3-50fa-4322-a584-89b0827fa70a", "comment": "Malware payload (Mirai)", "value": "3cee970964429d23d70950695f39c97631126cfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481988, "uuid": "ccb7f886-46b4-494a-b134-235c6342f009", "comment": "Malware payload (Mirai)", "value": "c8d76832bce8759ef51a06a108c26000d867981a4fab3c4e8d59aced2a755d7fd55005bc1db090b70574ed5e9a587f64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481988, "uuid": "b70360eb-91e9-46bb-a5ba-9659c7689545", "value": "T13363A40E2E718FADF76C873447B78E31E658239226E2D640D15CE9111FA034EA45FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481988, "uuid": "84f66b0a-3a6c-4032-a9e5-116a35160d14", "value": "1536:WXH5isssgae+7Boo70DhvyvETDu/LkIatqGn/PzvP5K:aYI7Boo70Rqo/bvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709481988, "uuid": "6ddebfe3-47de-4866-8c3f-10fa1ea37826", "value": 71772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709481988, "uuid": "3200b1d4-c77d-4846-82bc-c2d6e1462587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481988, "uuid": "dbc14d46-a81d-4b18-a76a-a84cddac0cd8", "value": "10ebf68a66b056f208b187d69946ba58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e775eaec-d929-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709448449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709448449, "uuid": "62cb602d-099f-484c-bc32-16271041aaf3", "comment": "Malware payload", "value": "eb1597de2fdee5afea42c4d951fab034", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709448449, "uuid": "41ac33a2-e23c-40d2-ab07-e1c9fe50a340", "comment": "Malware payload", "value": "d8ebffa11e59cb9df8cde819395a5932e585fad9058b88a440a67ecd2178c32c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709448449, "uuid": "110375b7-ff72-45a0-9a91-1c0767ea339e", "comment": "Malware payload", "value": "9ec906bbdb8fd8fc8307aaffb6555007704d1cb9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709448449, "uuid": "6b70be51-df7f-473a-92a3-82acd3d7b392", "comment": "Malware payload", "value": "7d32be368f35ef5994302bd36ed4490e97844e598dc2620a7c299abc277bd6ef1916765fd5c7cb32849af65c8189a64b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709448449, "uuid": "3d0a227d-b3f4-4fef-a248-a398bde56dfe", "value": "T1BF373315D394BA2FC973C0338BB24B5A4A92DC46DA43D6A38551B33C5AB7AC46E43FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709448449, "uuid": "938ab2e3-2a14-4457-a8d0-e2662b4304e6", "value": "393216:sqSW7KrmvuPxvio+rCbjJMqAeHJSjZLPLpcnTSwFALDTI279lOm+e0OOckv:sDW7KqvuwoYCbjibeHIjn0TSw4DTdlBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709448449, "uuid": "a1386365-081d-40be-a9d0-40fbe5c11e77", "value": 23767141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709448449, "uuid": "83e0334f-cf82-4dfb-995c-fb5d12ba5b14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709448449, "uuid": "b79cad23-299d-482a-8ce6-59ace1584307", "value": "HULU-TV.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e00829-d950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709465002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465002, "uuid": "42f356b0-95d3-4a46-9cf9-9b3e5477b51c", "comment": "Malware payload (Mirai)", "value": "a1874c01655f95a0b1122a25a6fdee32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465002, "uuid": "642ee38d-2884-4a03-bfba-e4e81053ce26", "comment": "Malware payload (Mirai)", "value": "e35775b13985ef3b82e84a42973f4468fed812fe3f33ca16fc3ad173b21698a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465002, "uuid": "7162ff9f-dd84-4f3b-a593-dd04882050b9", "comment": "Malware payload (Mirai)", "value": "73d28841bd67f505cc8122f2cd58e98809e52848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709465002, "uuid": "62b32ace-dfa2-42e7-8612-c9ee1f1a0b76", "comment": "Malware payload (Mirai)", "value": "27f7aa0e2d06a753083735e898972885d5058c6b2c978547f8d6f1c047981e033310b2c24a0eb0531c7c00352ccf76da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465002, "uuid": "7f5033a7-da71-49ed-a5ae-e28c2c512b86", "value": "T19F735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465002, "uuid": "81003acf-b207-45c0-a489-c992c54468f7", "value": "1536:b/DYQYs1ZokODichtx15UzOHIt09QfsH18ruUGDKVQSi:zDhzUkODicht9Uzk40a0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709465002, "uuid": "44671d8e-eb86-4756-a433-40f3cc6588ed", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709465002, "uuid": "0a4527be-e403-4579-9bb0-83a7d372b209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709465002, "uuid": "37ac036a-9a94-4689-98ba-5c315007914f", "value": "a1874c01655f95a0b1122a25a6fdee32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b3f2ca-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490354, "uuid": "417c0d18-8f4d-4452-9f44-91553dc91bac", "comment": "Malware payload (Mirai)", "value": "7ff49e57fa82e4b9e85bd9d3500a5ade", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490354, "uuid": "af0ea5b3-c089-4447-89e9-c34ed84dd1ed", "comment": "Malware payload (Mirai)", "value": "e6567a05e3843632061595c20b48f897b027a6860496cf8c5ba8188f64843fdc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490354, "uuid": "fc73a198-70af-45da-a050-30274cc280ee", "comment": "Malware payload (Mirai)", "value": "f294b586351c4a302ecd9ac8cb189ae1c205db1c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490354, "uuid": "0dc72195-0fd6-4939-b869-898b2ac1e2dc", "comment": "Malware payload (Mirai)", "value": "23132e75f28ceb2cadef4fe96afe0b35218c583c74406ca0920afe3e0f8b52ada19add348dc80ac103ec877b1b57972a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490354, "uuid": "0ca7a891-72ce-4ff1-82d3-86566f917d95", "value": "T145534A13B980C0FCC49AC178476BB63AE933757E1239F26967C4FE2B2E59E261E5D500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490354, "uuid": "75704898-755c-4e38-a939-9f1d5888ee15", "value": "1536:bbf+cJPS+wDq0LgZOMHToMP16jFOJ050EKti3RGPHLcd:/2aPSzcZVHDP16MJ0509i3RGPYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490354, "uuid": "2a8e10ec-2b02-435b-bf0e-f9513849fce0", "value": 62080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490354, "uuid": "b98bb05d-ae4f-44b9-b033-fd0118694b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490354, "uuid": "ca124017-bf5e-4ab9-bc06-5bd4bcfc589c", "value": "7ff49e57fa82e4b9e85bd9d3500a5ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a916a3-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1709471080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471080, "uuid": "e087d860-87f5-40ff-9527-ef02539e47e3", "comment": "Malware payload (Kaiji)", "value": "6aa67752e3a01974f8d17eb7ccac7408", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471080, "uuid": "d69a0e2b-4400-454f-861d-9bac81ee52ce", "comment": "Malware payload (Kaiji)", "value": "e7ddf5d67ff227ea98aa4066fdfd841465bbbc89c5aa46e5e160173ed5759057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471080, "uuid": "81d8df98-406a-4cb9-92e1-1072651e23ba", "comment": "Malware payload (Kaiji)", "value": "7ca0ebe05cff3038e80318c4c9fb7d22c979be3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471080, "uuid": "a5ac3478-fda3-4258-a6f6-9793d0dd469a", "comment": "Malware payload (Kaiji)", "value": "ab5829db88ef165fb85da5ae15a9535f55f583415735a6ee5b910960a2224fa1ec8dfe49d55bde5a8000ad0449bef5fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471080, "uuid": "57e870e0-4035-49f8-8b65-33ffa707f834", "value": "T118362A87B8824682C4E4367ABCBD81D533630EB9AB9752576D05FE3C3EBE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471080, "uuid": "8bd5286e-84fa-4125-aef6-7296c4fab0fd", "value": "24576:f0hITSaxCsmLTRScFkLwYgib6kEVtQ2gLApZf3vrTXKWXDReUHxeR7j81v9oT19S:GsLSjzCX1H9qzaiKRFjUIlkK1VI1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471080, "uuid": "dad0be27-c883-42d0-a11f-bcfe2f912058", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471080, "uuid": "43802ebe-f3ab-4e26-b30c-193a4d14f7ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471080, "uuid": "87211a2b-d09e-4033-92ec-b45b9c261483", "value": "6aa67752e3a01974f8d17eb7ccac7408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9127c9a5-d971-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709479228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709479228, "uuid": "7fde1b96-13cf-431c-8ac7-0f51581a6a79", "comment": "Malware payload", "value": "c61260095e8524ddaaa54f88d56426ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709479228, "uuid": "7fed9d64-0faf-4977-8ddc-01e37b29cac5", "comment": "Malware payload", "value": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709479228, "uuid": "a4c6f98a-a05e-4381-8ad3-faa213851fff", "comment": "Malware payload", "value": "ef98ed86e85a2856ed4e3961596704916bfa3776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709479228, "uuid": "b2d48c8f-0981-4479-b2e3-8c2dbaaa38db", "comment": "Malware payload", "value": "8a0f1414ba488edb714d100ec1ed6b1363aa0f0e338a8f0f04c184e0220e2566359f6487c68e93addb839ee41f2fac77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709479228, "uuid": "48569d28-61ca-44ac-9095-d7602ffdec82", "value": "T17C46233D613C8B81C208E930D4B506E2BAFF2E6F470E1557123F7D527AA9B89E7851C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709479228, "uuid": "bf0a0f91-200f-477a-9707-3879fe4007d5", "value": "2fa0cddd0b1cd8a8a65f44e018e469d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709479228, "uuid": "c96d734a-0351-4b11-92d5-d04b4d90eac5", "value": "98304:TbT5MkgziflQoz5i6B4p5Eiz3wF8io5GBntE8HKw2OnkeShMsgryOo8bNK:TXaZzifWoz5iv5XfhGBtEm2470Msg6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709479228, "uuid": "58ad99d8-3dd4-47e7-9cae-9b9a0df18bc6", "value": 5640712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709479228, "uuid": "5a5dbda7-6015-44b0-aa52-46687d509bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709479228, "uuid": "5520a700-28be-4cb0-a81e-9beb1b97ebd6", "value": "SecuriteInfo.com.BScope.Trojan.Tiggre.24145.23961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a037d9-d982-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709486436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486436, "uuid": "b8350fb4-d50e-40b7-93b5-1a1f54dce793", "comment": "Malware payload", "value": "1a915dbdcfbf7a208d18b45bd8f05609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486436, "uuid": "423fbef4-e6f7-40f7-b850-03ca07b4adde", "comment": "Malware payload", "value": "ea3d0df165550f5c7e413d06589e2de50bfe4c7965ad830bf3c0a3176cf4e74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486436, "uuid": "8085f1c9-df35-40c9-97fa-7b529fbefa2f", "comment": "Malware payload", "value": "bbcaea9b528e144be8aea5b548b44f5065dbd9d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709486436, "uuid": "8b2515b2-16f4-402c-be34-e9b9a4e37dfb", "comment": "Malware payload", "value": "4d661bbe21f8a2248b82fe5da0ab85efe423d632744c9cd0baab7d0a21c116b566380afac88632c05a837bcf61f7eabd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486436, "uuid": "3c530827-a7af-46b3-a252-35126b801652", "value": "T1D4A53357540EFA12D008EA3EEF24AEE4112C3D927646AF733825EB48C57A6C5D61E3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486436, "uuid": "9a8178b6-f70c-4ea9-b497-eb2f13f40543", "value": "3522b9bc4745e0c9ba72665f520a6966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486436, "uuid": "cf0c3725-7193-47a4-9f2e-ff92a1e05730", "value": "49152:0RGcOjFmUc0gZ283KW6VUbWseBfgm0MbI7ARqCvD77yE3O7l:4Gc7UZUnIBftMER7rnyE3O7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709486436, "uuid": "ba01eaed-3425-46c9-a2b3-4ba621434489", "value": 2155392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709486436, "uuid": "7231e6ad-55d9-4f73-aeb7-2f6d4426ded8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709486436, "uuid": "b543995c-7b23-4b73-bf35-21861b160bf7", "value": "SecuriteInfo.com.Trojan.GenericKD.71760020.21266.2062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c3536b-d98b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709490344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490344, "uuid": "b6f86f09-4984-439d-88a3-b721ac64eace", "comment": "Malware payload (Mirai)", "value": "efc0aa37f190645f87cba48124078073", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490344, "uuid": "ab8d72ee-2a87-4822-b5b8-759bd74897d2", "comment": "Malware payload (Mirai)", "value": "ebc870a6829208c21422b1b904af9501f6019034997eecbada8e220826e94574", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490344, "uuid": "2b39d6f2-7a6f-497d-84d5-cbf4c764dcb2", "comment": "Malware payload (Mirai)", "value": "82e82d25328f4f0f678d66287b84ee6b960c8220", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709490344, "uuid": "f0c73361-8b4e-4190-bcba-413b43ba03f4", "comment": "Malware payload (Mirai)", "value": "1c9de8340c30de77189350256ed9fb964c366a6873aa3e0196c55bb3bb1bed6d8c089e8c5ecf182080326d91bd47c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490344, "uuid": "9b57ed44-1879-4c50-9576-5fb48d079833", "value": "T15A535A17758080FCC099C274866BE636D573F17E03B9B25C53D4FE2ABE89E211E2E546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490344, "uuid": "5080c9ef-7c04-472f-9288-7f2070669ea6", "value": "1536:wi0W7nAFY5qRqzmzqkQXVdCb1L32Hx8igyR41RHrYSo4o:t0EnANWqqk6Wb1qR0yR41xESo4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709490344, "uuid": "aace2eb4-ee96-4d91-8a41-051f69135931", "value": 65856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709490344, "uuid": "79580fa9-1f93-44a8-b984-ab49845efac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709490344, "uuid": "712261df-930f-4734-bd7e-01f5215975f5", "value": "efc0aa37f190645f87cba48124078073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b86b6b1-d997-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709495405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709495405, "uuid": "691d1470-efb1-4f44-a758-1beb73c0243d", "comment": "Malware payload", "value": "263b62b9c9e0c280e94ddfefade84e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709495405, "uuid": "30bf4bc7-3625-44e3-923a-2a07e4238bc8", "comment": "Malware payload", "value": "ece53681bcd97cff2e8c288f1a660a2eeb7cea6a238760d50e29ef3e2640ca57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709495405, "uuid": "a3e40491-dc38-4e05-b10c-6d659cf280b7", "comment": "Malware payload", "value": "4b1b715e53dbf19651f765706843e30302f9b8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709495405, "uuid": "7da7ebaf-0092-4cfd-8951-436afd49a971", "comment": "Malware payload", "value": "1863e5e73c20b0f74604864e2afa8830cda24d81d8db69aae71d9e27097fbced6d1563be46f70ae9b889646dca79b4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709495405, "uuid": "0f5e36f8-70ba-4436-ad1d-73961329a826", "value": "T176183393886C6AD9FE959BB2C3EEC4622F381210580BD7EF90855F3B98D022B155D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709495405, "uuid": "1df484bd-4760-4960-9006-e6b2938c8cc7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709495405, "uuid": "2e723269-89d8-4f72-a657-59a7cab78bf6", "value": "1572864:9/WHHr90/uSksdBUkKa3tiUXUT6WqTq9gwBSt2adudZKDPo7:9/8L9EuSksDpKa3t3E9AzwkOZKs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709495405, "uuid": "b607cfcc-e525-4fd1-8e61-2d34a35eb82d", "value": 86135201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709495405, "uuid": "8c56b69b-2ebc-4682-a68c-5acfc9a5de56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709495405, "uuid": "c3758f23-f94f-468d-a858-c1ea7a844f68", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0190078b-d978-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709481994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481994, "uuid": "5552db7b-2890-4071-80e2-0e51554e66f3", "comment": "Malware payload (Mirai)", "value": "6f5668f38a3797d404c39074af6eb6d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481994, "uuid": "c34875cb-88c4-421c-9bb3-ea961233f894", "comment": "Malware payload (Mirai)", "value": "ee1fd484b3513361e15d2debf6015edd7d667b8908a68ab1ba86491ce6ac33b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481994, "uuid": "514965a3-718b-4dc4-901a-baec969d13c6", "comment": "Malware payload (Mirai)", "value": "b87eae7680a627de38c2a7908deb5013d9d81f4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481994, "uuid": "4755327c-8beb-4880-95ad-cec4dc2017bf", "comment": "Malware payload (Mirai)", "value": "3fc32d38517fc12990fc5cc6a70de29dd0246d68e96e5c31ddc4e043c4b85fd20a01e6fb88c3d2c134db383d42cb9a9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481994, "uuid": "42cd1923-c2b7-47be-93e8-4fb11e4361bd", "value": "T1D1330685B9869A06C6C0937BFA0E83CD372A73D8F2DE7213DD156F1137CA92B0967152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481994, "uuid": "648dbad0-bd00-416a-9273-bef87e1c4f75", "value": "768:5ozUwh8wb48LzuT2cjn5UoXUoKVo8Gjjdp0UpVV8eLit4N+X9wTMIDjfRgGDnPTn:ezU28wb48LzuTrMfGppVG+N+NQD7jvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709481994, "uuid": "a82c48b5-58a3-4da9-958b-fb1495244eed", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709481994, "uuid": "36012e3b-f35c-4196-84a0-9d4392e42905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481994, "uuid": "5fe40e0a-0837-4c4c-9174-f69dc5537001", "value": "6f5668f38a3797d404c39074af6eb6d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b237cc4-d957-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709467836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467836, "uuid": "c77de036-affe-4a94-9b2b-d88b8842c847", "comment": "Malware payload (Mirai)", "value": "7ca2a32b33a01afe5598d5fc95b97982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467836, "uuid": "86e27aa6-79f2-4c40-afe0-bf35a2707d6e", "comment": "Malware payload (Mirai)", "value": "f03bddff21770ddd98116e42b6f894e5b4bda046e70d9ff447826d542aaa8983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467836, "uuid": "fbddfa85-63e2-4491-90e3-b68a6c16e9e5", "comment": "Malware payload (Mirai)", "value": "70020e44e9eaf6ff287c09c757019033730e7a57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709467836, "uuid": "f27e73fc-8fe3-4d95-99cf-a61f45b85b36", "comment": "Malware payload (Mirai)", "value": "8cc402dda787a2c316c3100fe417d7f269c5f990dbdaa15fcfae1c79afb6e00dce11d65d060d5e3098f4735617342b40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467836, "uuid": "ca1eb754-404a-4299-89b4-74df5963e404", "value": "T13273C505BB650EB7DC6FCD374AE91B0535CC690A12F93B3A3534D82CB61B64B4AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467836, "uuid": "ce6d2873-7cbf-498b-8e5a-85114f68837d", "value": "1536:Is7AdBpz9APcL2tz4uApXQJOFonFnzNZ9B9T90UU:IOIBpz3ixoFonFhf+UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709467836, "uuid": "95612b94-78c9-4bf2-96e5-1cd743059770", "value": 80580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709467836, "uuid": "83110f3d-dada-42f3-9033-d223cdfb4a0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709467836, "uuid": "875fc264-3637-4517-893b-281ed06b8920", "value": "7ca2a32b33a01afe5598d5fc95b97982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80d9dba-d977-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709481978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481978, "uuid": "8727a8ca-5631-4228-9783-77df8fdb3b13", "comment": "Malware payload (Mirai)", "value": "38722a8284d41042bc8f76fb0277737b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481978, "uuid": "aa8b5dda-3eb5-471c-9f71-baf9408a1e42", "comment": "Malware payload (Mirai)", "value": "f3f1ba6fc49db1257f7d5424a0f97688ecea736e1fa87ef6b13b2fd22c1f87c2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481978, "uuid": "566bbe91-1271-469b-8c1a-341cbe4b517f", "comment": "Malware payload (Mirai)", "value": "6fddfb86ed8843865c25b53b96bc39b47b762b6e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709481978, "uuid": "49c38eaa-272e-43d5-80c1-6e4d9a36fcbd", "comment": "Malware payload (Mirai)", "value": "ed1f31780f74af44580f49c17caf058998e4f3efa886b690f7916de3ac8cf1f899443a5702fcb2bad8816631d069f89e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481978, "uuid": "86309edf-950e-42d9-814d-4b31ff153c6d", "value": "T13A332A03585180FDC858C1705E7FAA27D933F17D9231BE4E33947F22AE5AE212A2F959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481978, "uuid": "aca384fa-c874-4a28-b2e1-24f10fc94f0d", "value": "1536:QDPwdyvhsobKDEmlLLbk7UEThy0aH4J84:QDPwIJs2bml/2UohW4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709481978, "uuid": "63feac77-5b41-4142-99ad-99302b111596", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709481978, "uuid": "62191180-2a8c-45fb-afd4-f63a21a7b2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709481978, "uuid": "6e415a25-314e-464f-8177-29a9a11c0162", "value": "38722a8284d41042bc8f76fb0277737b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a575b3-d931-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709451723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451723, "uuid": "dbcf3fe8-b11a-4529-af9a-ced0699de0d0", "comment": "Malware payload", "value": "a4e7f4018a0c9907006691506aebf5a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451723, "uuid": "a5e9c563-9a58-4780-ae35-f96f05f21a99", "comment": "Malware payload", "value": "f58fe457382f9ab6831f04ff5e275bde1393dfa1317b81e2c21170a5d9c3cbc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451723, "uuid": "488007a7-5db3-4a02-bab7-572af0a297dc", "comment": "Malware payload", "value": "5450767e15ee63c944f84d1b2dcf1dac51bf568c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709451723, "uuid": "bf43445f-dfd8-4741-b426-fb83fe8e0029", "comment": "Malware payload", "value": "640cd1a40f14ecc0fbf33c45c1615a87170b76b165eda460ab7972d749dbbe0f9cdd2178bf51b5b5a8a509caa3e73794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451723, "uuid": "9ec3403c-2e7d-4d7f-94df-79d2f4d57bd8", "value": "T1081833136E8DA627ECA6DD3A41970EFE0ED1B46199A04E7EE02CD1579A2CC5CD09F0C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451723, "uuid": "247e4414-094c-4234-a353-2df220a7c794", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451723, "uuid": "1868ba5e-df47-4aea-8328-616e0a029e27", "value": "1572864:aZl+n6pEacyX0ZKVU0pDf1IYiQSRkEv6LJAWld6CSUcwe23c2WQrOptIZV4pB:a6n6pEaeZEU0l/9GkBNADCSozs2WQrOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709451723, "uuid": "d9570096-4ffe-415b-9bff-3e4e83e28a73", "value": 84981516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709451723, "uuid": "7ed2aeeb-75a4-4733-96b0-6e95d91091cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709451723, "uuid": "8c3ad922-28ac-47b9-b270-63b0751f5f66", "value": "Step 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8542daf1-d984-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709487368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709487368, "uuid": "7531add5-ad1e-4643-9836-d7e5e198a3d1", "comment": "Malware payload", "value": "bf59d1adf98485aed3bd64305a9708c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709487368, "uuid": "ab784c6b-86f0-44c1-a21e-18d1b97d4830", "comment": "Malware payload", "value": "f5e35a8b5d97addcff64c0296fecff581f914ef5741965a1fd79aeded9ace3a7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709487368, "uuid": "d5ce53c4-e511-4d42-8d82-71d42de32ed3", "comment": "Malware payload", "value": "a80818754347910d494d131f93b7adb7e4b51e6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709487368, "uuid": "22d4f4c2-d259-45cc-a9e0-7f5b8ccbe4cb", "comment": "Malware payload", "value": "009f432c347a6a3199004a7b47a8e2dd57dc66fe623346fce524a1998b9b5189235e20aa89a1656e42f5bcc5ee670aee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709487368, "uuid": "e829c6ec-2c61-4f29-9192-e61f79a0c4bf", "value": "T1DAE02BE5CB212F43E06B2C7226775FA3C6AFA0AA36747E9E201B54199DD38F00D41685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709487368, "uuid": "abcd280a-e996-43ab-8f3d-c4bbf3ef234a", "value": "6:5jKmuTAzV7VIcu9imeF3gel5iGCLJwFAD2l0muRtBzV7gt+lRlX:5jMTG7ycu9ipRn5i91laMRR7gtaRlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709487368, "uuid": "79743de0-ec4e-4c61-92bd-497db08ac003", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709487368, "uuid": "61085ca8-29db-4f6a-b41c-c46c9226bd79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709487368, "uuid": "d04c7104-48b3-41a7-ac01-fe710abc697d", "value": "bf59d1adf98485aed3bd64305a9708c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822e8784-d949-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709462023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709462023, "uuid": "db88d89f-b913-4ccc-98c8-d48986022283", "comment": "Malware payload", "value": "cb72a553e1a36ab350da1ab13683accf", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709462023, "uuid": "9874e3a1-6573-4c87-8c9a-7830e8030f40", "comment": "Malware payload", "value": "f70a83c49664524f65c4f1c494be508bb04d01d833ef942c948c2b71be08f1a1", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709462023, "uuid": "630f0373-919a-43e6-8e86-2b5f2b2e537b", "comment": "Malware payload", "value": "be543d7a2e93bb5f328c1af2fec96aa705eaa8c9", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709462023, "uuid": "08776e12-cb62-4df9-acca-a7c275cb99c8", "comment": "Malware payload", "value": "92765bd1961d2737b7bf866c4679002c894580f10a9db8dcd945a22b47f46b559422882444e124488733cb9c3a20650a", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709462023, "uuid": "d328b516-2a86-4eca-9241-1c5cc6507456", "value": "T111F00E23E124CAFAF7882EBD1E866A00476842D735BA526060AD043EB21079ACE46F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709462023, "uuid": "5de9cfec-0aef-4bbd-ab22-18d0c6f2954a", "value": "12:whtfsp2so2wL2iJ0Wvu99UaP1pqZE/WS2JaU5HobBP0XFHat:w22sor3Wx9pqZuYagSB+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709462023, "uuid": "eb19746b-8b24-491d-a735-884b3ff7457b", "value": 518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709462023, "uuid": "5cc86ba6-4ca8-493b-998e-3a71863631f8", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709462023, "uuid": "3497a3be-f649-4926-b907-0c9286830f87", "value": "scanfile03324,pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18d38d9-d95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709471095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471095, "uuid": "a4ab1875-4dd6-4b6d-b603-17b2e8e93c1e", "comment": "Malware payload (Gafgyt)", "value": "da3c8cfb6a53df8c34350c291db1e348", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471095, "uuid": "70711182-9b32-4ba0-bdbc-ff544ac72bf2", "comment": "Malware payload (Gafgyt)", "value": "fa4623388e2ba283923b877335f421b2c4deb6e30f42e21bf45b5fa5f4d60630", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471095, "uuid": "888c3487-c0db-46ce-b763-63c6a5a7d1ed", "comment": "Malware payload (Gafgyt)", "value": "89b49eed840a8d730abf6a63752c291a9f22866d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709471095, "uuid": "48feb61e-d4c7-483a-8797-b96f0c5096d7", "comment": "Malware payload (Gafgyt)", "value": "5c8b6a41d89cbb7f7c0c305644da7ab5be151767c7bdb23c72c2ab3e65f55ef507166de0683946cffad85787c0869da6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471095, "uuid": "cbc701fc-7aee-4c13-8de9-eebc76c49081", "value": "T10BD31905D4509B23C2D2677AFF9E464F37225BE4AB9B332256296EB02FC179D2E3D410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471095, "uuid": "95ca0be3-c8f1-48ac-9e66-ae7e8a47a6a4", "value": "3072:aOQxoHQIuTBhmi1mOYaAFft/0rAHpFUtP5haC2ddGKn1XvmyhQaS+pg7J:ajmOYaAFfGtP5haC2JNvmyhQaSGg7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709471095, "uuid": "f5959206-cbbe-4571-bbd3-d96089c8309e", "value": 138776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709471095, "uuid": "c03b5243-3330-42d8-b12e-29f43d31f8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709471095, "uuid": "452bba7d-833f-443b-aa86-dd9b365e2543", "value": "da3c8cfb6a53df8c34350c291db1e348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab18a6b-d928-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709447703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447703, "uuid": "cda023cc-ff27-4d37-8cf9-fbc9261b80ba", "comment": "Malware payload (RiseProStealer)", "value": "a263a25d204194fa5e17f07330b9a411", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447703, "uuid": "202da19a-0b03-40bb-b811-aaab7877640c", "comment": "Malware payload (RiseProStealer)", "value": "faea4ccd802391bf9a6d71bc6052f269b6ca370c124bfe4d2faae55b43a5c0c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447703, "uuid": "1c3eb30e-5adb-4f5f-b3b9-bc9ea28be91d", "comment": "Malware payload (RiseProStealer)", "value": "a1d4f97dd06f2e3bb343a564601a6055e12ebcec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709447703, "uuid": "fc4787b7-5ecb-4c07-bb96-fae4cdee6dcd", "comment": "Malware payload (RiseProStealer)", "value": "8479d44163715326b3405c3cc62abe42f224802577c665b65aa7d4765cefbafcf1d74c192dc90feba6088f539a1c907b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447703, "uuid": "741388b8-c364-4019-b05f-f2cf2b40d699", "value": "T1EF267DA47D4FC19BF2920230CDA89A1D11A89EB81B3182F7F69B770F99559C15B33B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447703, "uuid": "a3b5dd8d-ed5e-4491-886b-b1fe655f1b59", "value": "5e4731b579fcbf2ee2d5b665a7fef172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447703, "uuid": "dc2f72e7-936b-4a1c-a8d7-ebf163d1bb72", "value": "49152:dCXtvRXOhEc2Mgy+uTEGQp8EaQZaFChW7ZaAXN1y61/jQaOM7ZHfrMuEkvqy5wWI:dCxRXOhEc2MgRHTp+fXJjxLSytuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709447703, "uuid": "7dc57665-d86d-46fc-bae6-38c415260d59", "value": 4508160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709447703, "uuid": "7245c832-afbd-460a-b418-87313aade18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709447703, "uuid": "6eff77fc-5103-4819-acd7-ac001910d9c6", "value": "a263a25d204194fa5e17f07330b9a411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffe02a5-d95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709470663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470663, "uuid": "2512c2c5-4f81-4f16-b290-71f39f00c701", "comment": "Malware payload (Mirai)", "value": "ea765875f7bd9a35e26735913c129f32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470663, "uuid": "cb10dce4-ac07-499e-a42d-48195513e07e", "comment": "Malware payload (Mirai)", "value": "fd09b887cbc6365539161002218c9b018ea1f67f3f95ca255409efb1aa6d42dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470663, "uuid": "842ac1e8-614e-4c9c-89d3-f39cc570fe01", "comment": "Malware payload (Mirai)", "value": "9c8e370c1262ad2331aa01bab4c951a24f4e1b65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709470663, "uuid": "dd568204-c6b5-432b-9078-8e7aabb96d86", "comment": "Malware payload (Mirai)", "value": "64ea500c215f7a6afb2cb1277e6a652d2cd621b0d6bfde7fd849470333ad138402d0c1c42fc519e2d5736940bd470711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470663, "uuid": "af518f2b-7c4c-4508-96bf-c7c913e9111b", "value": "T1E673822BBB61DEB7CC4ECD7306AA4501208DA54A12D96F1FBAB4D52CE34BD4E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470663, "uuid": "861196bb-be13-47b6-9131-6a69bdfb7a16", "value": "1536:keTLa6Oym2XpChoUP2gT2k+1T6CZqcqoE5VX2kgp:Eym2XpCrP4h6C2p2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709470663, "uuid": "bf8bcc8d-adbf-4b81-b0dc-ddf7dc455d0e", "value": 79811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709470663, "uuid": "43540ee3-f884-42d2-a8df-45ad52da20c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709470663, "uuid": "f5fabce4-c0da-4e2a-bf67-2f576c369046", "value": "ea765875f7bd9a35e26735913c129f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }