{ "Event": { "published": true, "date": "2026-02-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-04", "timestamp": 1770249782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d3155220-218f-470e-a6a8-0d0f485237ae", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6063bec-01cd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770211872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211872, "uuid": "e1535058-d904-4d5f-95c2-0d847af2d139", "comment": "Malware payload", "value": "4910110128a1d7016d3cf2d3fbdee745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211872, "uuid": "7f06855d-2606-4961-a040-fd441af695f2", "comment": "Malware payload", "value": "0049add445cb61f1c880e977af83ac4c5a8e921e862ca7a93112a0328a201e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211872, "uuid": "8094d0b5-8034-4e30-9241-4da59aab2c95", "comment": "Malware payload", "value": "6d03f13bfd834db94ded5d91cd47c46098d63a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211872, "uuid": "7727aa70-cbd7-4e98-ace9-a48d9724f93b", "comment": "Malware payload", "value": "e8e151667112a5b9f11553e891ad056c5dfa66e5e651659d85c6d79244acccabcb84310575372dbff4881ecbc4795e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211872, "uuid": "4a5df3d4-ffb1-42b0-bcb1-21ca8e7ae451", "value": "T1323523CE963C863E0B6650BACD7B478C4904F2099BA6FF06C44E57D5B24617E6B708F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211872, "uuid": "832437ae-ce28-48c4-9c3a-e58611289ff1", "value": "24576:f+MDrrwfvTZxcPnHe8DV2NPPpH7IifRJS38Us6wTrCGRK0t:2Btx8nH1WpH7bcIFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770211872, "uuid": "7b33d7d7-b4ef-4e45-94bd-4bc85281c423", "value": 1062565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770211872, "uuid": "b59da536-7209-4f62-b2f4-1de4eee61244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211872, "uuid": "5471bab9-1d46-44cc-85c4-f76de9cfccf1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d23a4f6-0195-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770187644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187644, "uuid": "647a5ee2-fb25-4921-b8dd-631be5589c4e", "comment": "Malware payload (PhantomStealer)", "value": "a1d36929eb20659f5c112710b0bc5abd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187644, "uuid": "987a278e-49f7-4050-9316-9bb7968d9ff2", "comment": "Malware payload (PhantomStealer)", "value": "02bfa14c93bb09e666b102bde8dd2c6d5e7393ed34501d92954156e52ef3cc00", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187644, "uuid": "7894a5db-1831-43e4-a9c6-5d163a14bd3b", "comment": "Malware payload (PhantomStealer)", "value": "dbd8693c6c7b324ad361f0ea0546ac4ac9ed17cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187644, "uuid": "aa832f15-ed69-4fb0-9485-ebfebe90aa7e", "comment": "Malware payload (PhantomStealer)", "value": "91d11ada0326bc0c99fc61c3e55214c08fb3a6c15740ed091c4cffe5ecf96b8d11e95020999afc768c39752d8c786c8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187644, "uuid": "49ba7a83-c375-46a5-9b88-734033b31650", "value": "T19745F438327A8DD7DA59B18748D055E5DD08CA33728B2A6D7F2AD6CF910432C8F1B52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187644, "uuid": "bde4600f-e286-4356-846e-46d024d6ecb8", "value": "192:7HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHY:cyDKBSiULMpK3N8TkJei6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187644, "uuid": "8c50e188-ad44-4c9a-9c4e-dc45de9cbe27", "value": 1176509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187644, "uuid": "28ba0c43-8543-4911-8b5b-5d5d6f43ee00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187644, "uuid": "26760b00-ea19-42d4-9c97-e56ee358688f", "value": "PO5463755237.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f51b2e-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168332, "uuid": "d5fcb468-0959-4187-a144-c0885eef2e9d", "comment": "Malware payload (Mirai)", "value": "cd945214aa0148c7cb385d85a20157f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168332, "uuid": "541c3398-567f-4019-8c1c-85339e04e01f", "comment": "Malware payload (Mirai)", "value": "03a77c6a763ed2a1da2589009f4a292dc4fc54a3d2089f0209c1e0d25ede6267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168332, "uuid": "e591be3d-42d1-4ce6-885f-858c6c6304e3", "comment": "Malware payload (Mirai)", "value": "ee51e0a631a77fd24abd9a8fb7c18a9f50e7a723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168332, "uuid": "ab805564-d31c-4eae-964c-458ec9c3c20d", "comment": "Malware payload (Mirai)", "value": "df108c54aeb6d7172d8e7c32cf072c7443003120ff7dc93a6b472c633308cc66dc9d0a2b7827d55386ebd78035c3203f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168332, "uuid": "38dc0ac9-59e7-4ad0-87cb-e61fee76901e", "value": "T1D583A54D6F319F7DFBA8C73857B75A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168332, "uuid": "1b9b0202-b419-4aed-be8e-fdeda712c5b5", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+2:N0bY7lmZH0iL5iNl5GKjVXz32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168332, "uuid": "d0733628-4333-4b2b-bdf6-6985a3370f07", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168332, "uuid": "41e8a6be-b87e-4aa3-a6de-3740952ed8ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168332, "uuid": "597d8863-34bf-492e-8666-ca602248ebe4", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4fd967-01d8-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770216389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216389, "uuid": "fc1bf524-0288-4a30-a61e-ae779983c99d", "comment": "Malware payload (SalatStealer)", "value": "653df0f9efe73537ef2660b4266f65ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216389, "uuid": "953159ae-0073-42bc-987e-e70198cac50d", "comment": "Malware payload (SalatStealer)", "value": "045179aaee95e262e05bdb0de98c6458e825381ad0a76f60fda33f11b854a9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216389, "uuid": "14e91c23-8836-4e53-ba54-2bb792fd49e6", "comment": "Malware payload (SalatStealer)", "value": "4b7e5c834fee44692650db5a0c272a600a8d7ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216389, "uuid": "2fb0b053-0856-4687-9815-2640f03b01bf", "comment": "Malware payload (SalatStealer)", "value": "7e2e1a3d538b023fe55cbfddef4d3f9c77beacee11f1bbcaf63c8b99577ed989abd5a94449eeccf2ef4a2f55be47b937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216389, "uuid": "93616722-211e-40de-a49f-46ab7fd69a40", "value": "T1FBC64A11FA8B58F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681196A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216389, "uuid": "21a57433-e5b9-4065-9f99-805118ca7c96", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216389, "uuid": "c8bdee76-17d0-46b8-b5d7-37126a406553", "value": "49152:E6tw1Zbx/GUB5WBV2LuUjbEvevNRvMzptbMWWjKxNv+1UVzySgUVdAkxTUFxUnkm:fW1Zb75So0WjQ+1k8AdrIeECL+sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770216389, "uuid": "4357b5ff-947e-4cb9-a422-2be8497df8b9", "value": 11670016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770216389, "uuid": "7b8ad111-4ef6-4819-9c83-1b2596fe92a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216389, "uuid": "96008b64-ccc5-4328-bd2e-da858487cb31", "value": "DiscordFIx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9f6c51-0203-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770235049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770235049, "uuid": "79e3966a-626b-4006-81df-7555ce4a3234", "comment": "Malware payload (Formbook)", "value": "040911e5e9cf102ac043bc80990c14e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770235049, "uuid": "6c0d0e0c-c901-4b11-8e82-14906cc414e9", "comment": "Malware payload (Formbook)", "value": "046c2cefcb304a84206b4d598b07b947ffbe7786d6df1048750c2fb08f224352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770235049, "uuid": "8a69dd0b-9e18-413e-9ac8-e412acefb0fd", "comment": "Malware payload (Formbook)", "value": "0e86ddf5f232808ddd4ff967c3693fdd5b201fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770235049, "uuid": "f05b8fef-019e-4839-875f-c801309c7e7f", "comment": "Malware payload (Formbook)", "value": "8553c0c63f6b9170b55e9e3556b59a31846bbc5316ae3cd6b7b8b1c0e4d2c4e5269dbfadc3232d4b597263837945d007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770235049, "uuid": "60eb4eed-e929-417f-8725-2db9da2daf93", "value": "T1DF3512AD2684C223ED95C37C1AB3E67453B50DA9E821C2128FEDEDD77140BCDA518ED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770235049, "uuid": "fa99c154-379b-45af-b554-130924023b82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770235049, "uuid": "bbbb644f-beef-424a-9d9c-c1ff685f5a3f", "value": "24576:Ldd7QCEcg2/cJOSwHIgHeYXzzxEbABCPes7zWq4xII:rEf2/AkHIczzSbKWeUtkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770235049, "uuid": "6e575a53-e83f-4e31-a326-f678774e11ca", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770235049, "uuid": "8a18f9cb-6011-448f-9b4c-7650db257204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770235049, "uuid": "9a8aae39-e696-48ac-b373-54e62592c154", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdaa842-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770176502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176502, "uuid": "658ddb1d-81e4-4520-a9de-6c3e97cc48ba", "comment": "Malware payload (Mirai)", "value": "e9f0596877e61f37120a78255416b8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176502, "uuid": "225904fc-7b20-4870-9314-e7a80bee3603", "comment": "Malware payload (Mirai)", "value": "055aac3cb87b8a8f248df0ecbd298902745a2372ff94226c3570680514a6ea43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176502, "uuid": "ce52f04e-ceaf-4dbf-82b5-f0dc005b3873", "comment": "Malware payload (Mirai)", "value": "4bf77f35534b7603ae7da4b423f97ad66129bd1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176502, "uuid": "66f04ceb-91aa-4784-b194-643b016ee9a6", "comment": "Malware payload (Mirai)", "value": "152702db99d3a3ad8a44f0e3e01a04e63607db1e196c96cbe2a608dd72f94628d78eeddf4b8196ce6d36547a1c6b2361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176502, "uuid": "83fe1f45-6d85-4f1b-a9f6-ae8740a0d445", "value": "T1DDD3E069F0C0DB73C6C616BEF29E16847323076CD2EEB3458D148E31779B5660E2AA17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176502, "uuid": "079ce360-84c5-4ad9-a58b-b7043ec28e76", "value": "3072:7D0ownSrawCY822S/1oMZJAeyJlItJtmVYPEc61Eaxe:7xwSuwjLoqUJMJtmVYPcTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176502, "uuid": "f01b84fc-8f5e-4cc6-977b-3ebdd1e56c18", "value": 142049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176502, "uuid": "ae00c9aa-cfdb-4d31-82f4-6d9f5c4acedf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176502, "uuid": "97e8949c-b25b-48b5-b39b-82d48c94abe9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a4a376-021b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770245399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245399, "uuid": "61898c1a-24af-4f5b-a094-f459964e14e8", "comment": "Malware payload", "value": "215f9329d0f33a7215e9d553be06d32a", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245399, "uuid": "69150e6d-03c6-4e61-bfd7-83f4cfaa8a2d", "comment": "Malware payload", "value": "05e77d64dc5ce8d9642b750db3363c1ec4e2838ffd9d288546ef6a49d05380ba", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245399, "uuid": "d0dbcd7e-3423-446b-8f11-37be71e78a6c", "comment": "Malware payload", "value": "c6c197e61079a0a33108c2c87b5e3c7056a138ec", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245399, "uuid": "2a7177ef-7b0e-4357-85df-3c45fb361e02", "comment": "Malware payload", "value": "534e55b9a75f252f82c16a4525683213ef2aba26a3e252c40f786e52c5f4698d64a2940bc21545c5140f5432a316be0c", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245399, "uuid": "bb496735-75a4-43c9-8f58-5a5f4c4d76a1", "value": "T1692533C4C07C0B8ACEDEE079731457ECEF14D0262AEDB25664F2B0EDA27EA114D529E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245399, "uuid": "fc2296be-3f43-4130-bbb1-d83d29361617", "value": "24576:8SWrZx0Df1f4eWkG/oj25MgGc7lxd7FyLnhq4nv:8SIZkfp4F/MRgGc7rdsnhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770245399, "uuid": "9da10bc7-bf94-4031-9123-1204d1956dfc", "value": 975190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770245399, "uuid": "6be03cbb-94fe-4df9-9817-8bd3d13c4150", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245399, "uuid": "018f434a-d248-49e2-a0ac-1ee2d320873c", "value": "Reclarification on offer for overhaul of 06x WP13F Engine of F7 Series aircraft.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4237993-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189992, "uuid": "e34521ea-c432-462c-8822-8e21328efdc3", "comment": "Malware payload (Mirai)", "value": "e435ad20de5610a020606e6d9b61cee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189992, "uuid": "3e8f6a5c-0aa9-4559-bd02-bfc16a167365", "comment": "Malware payload (Mirai)", "value": "05fc923f9d831515ae156068652a18d94b33b92e995bde3c8bc3e55a984e0e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189992, "uuid": "aa74b003-370c-4eba-a955-e64ce1965311", "comment": "Malware payload (Mirai)", "value": "5f2e6984ab076668d4c520b26c96cfe9219b859e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189992, "uuid": "a887e26e-f1ea-4577-b113-793a0ba7f92d", "comment": "Malware payload (Mirai)", "value": "bb1a8368bcfd1ec1e1587b2e23432e99b3541aa6ba276ae4fceab807d9d2c0c4afb000611a17927c9a077364ed451a87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189992, "uuid": "25c5464d-75b9-4e9e-9a96-b47b4dcb55a1", "value": "T17D831882BC40E626C7C01677FE6F108E331567DDE1EA72429C255BA07ACE91F0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189992, "uuid": "d106759a-a82a-48d9-8c18-5fc70e149183", "value": "1536:sZCGuzEFBkqLPPdE5B3jBjNzVK9B523+JO0W0B8t46/keN7YJlQUe:ACGzBkR3djgROV084okK7YJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189992, "uuid": "f7f9c948-0049-4568-b077-b23cb427d9a2", "value": 83028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189992, "uuid": "80502554-162b-4b31-b7c4-a8f57c687a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189992, "uuid": "f2840fa6-6e8c-42c7-953c-2f7382cc3111", "value": "nullnet_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebb4a88-01c3-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770207297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207297, "uuid": "1e2a2c34-4574-49ce-8cff-79b3a0073616", "comment": "Malware payload (GoProxy)", "value": "d53e2705694ac3ce206b76e0c2580f29", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207297, "uuid": "246c987b-98b3-43ea-9bf4-bc0cc05141e6", "comment": "Malware payload (GoProxy)", "value": "06707805bf330ef197d0925354802592734f0458e29663718196e4abd9060b32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207297, "uuid": "341fc4e2-bee1-43cb-b47e-04f89c5bfb25", "comment": "Malware payload (GoProxy)", "value": "908794028e6bd580c523f117cb210af9278f8054", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207297, "uuid": "ff214a78-382c-4b42-9e6a-c8e269c649e1", "comment": "Malware payload (GoProxy)", "value": "897b438279f0c757398f59da7e755ea6fbcfdf9a95efd38c0defc473dcac27ce22be45e5298743dd3155dc853c1afdd6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207297, "uuid": "15990222-f929-4eeb-82ee-25d691cbdbd4", "value": "T11AA6AF281585B5B8D7D68134EFA2CC9766627C35C33B31CB072B14B0FCAE6DC6636A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207297, "uuid": "775bc5ab-f120-4e3d-b8e8-fcc96299a770", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207297, "uuid": "edc9a115-d3d9-471b-b0b0-49bfe092dabf", "value": "196608:n518QZQeF95VcvjK8FS6BuN16yjhqOhrcFoQCX0QD22EkbnLGiIPReYxtV5BDGmo:jZQeT5VcrNkIuN16yjhqOhrcFoQCX0Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770207297, "uuid": "c6fbc52d-533f-4efb-a4a7-ec3993f9c120", "value": 9863808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770207297, "uuid": "32eeeef6-eca4-4908-92d2-f3154e155d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207297, "uuid": "a6dedd68-d72f-4b5e-b93f-4664a6c9dcd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0c70cc-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770203210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203210, "uuid": "7d8dc52c-cfb8-4b79-8083-b841ceeead02", "comment": "Malware payload (Vidar)", "value": "f743afa5d246348506c56fe45625359e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203210, "uuid": "df364a3f-2372-49f1-b3b7-06c48ef79a8d", "comment": "Malware payload (Vidar)", "value": "06be7f0927b79dbf097e76241264c42dda9a2bfee0374ecf6c620d8e9285e732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203210, "uuid": "e047b29e-01e1-47cd-a0a8-b87e0155e2b5", "comment": "Malware payload (Vidar)", "value": "cb0afe05c5957ee69d8635be822f35d7cdc740ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203210, "uuid": "926f5664-4aef-43c3-a3d9-604c507c3441", "comment": "Malware payload (Vidar)", "value": "9bb955e1a2648bf30b75b658ce3a135546b3d2d21f45aa1045b1c27a99e73561a6313889dcd9d64ddb343fd4b803aaf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203210, "uuid": "2e5a947c-2cdc-433e-b7e7-00b4285bff58", "value": "T1FFF55B537994C238D19BD135E87192C6B770B845077023E73B922AF60DBBBC85A3B729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203210, "uuid": "605c2fe3-976e-4bb9-8893-cd729bd1f523", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203210, "uuid": "cf89e7d7-efe7-4708-8e7e-34e9e6ea7a51", "value": "49152:9fExolZrb/THvO90d7HjmAFd4A64nsfJGYeRSFK1+7bUEm5fFH5VgwZ2D:lwOS7419J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203210, "uuid": "c8a4e860-5c1d-4afb-8ffb-e0db9e2735f4", "value": 3589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203210, "uuid": "de6cfbd5-4491-4642-8cee-c7e8bec218eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203210, "uuid": "c59a47b6-60dd-4ca1-aecc-bb61a9b5b323", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e301c937-01c4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770208055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208055, "uuid": "fca7ec08-f580-4a7b-8e7c-7ce41aff5b43", "comment": "Malware payload (Formbook)", "value": "3eb1d914ab6035e45e228af6a63cb352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208055, "uuid": "d4d45203-6d2e-43d2-9453-d149cafe3267", "comment": "Malware payload (Formbook)", "value": "086a8fb7b92306c495fc562bff32642b856edfc1077ed7c00956ae59363a0fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208055, "uuid": "a0ddeb8e-cb79-4d61-9dd1-25bcd2572b2b", "comment": "Malware payload (Formbook)", "value": "d6ac17820772c4d84b664b76f2d30efd90d08465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208055, "uuid": "5425e59c-2f07-4bd9-9004-76e7b5ff71cd", "comment": "Malware payload (Formbook)", "value": "b109bc07b309cf68e3bd960efbe64993172dd3ecd4ede6b6337d375feef54bd555b347d0f74c85e6a1e107a0bbdf2ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208055, "uuid": "dbd153ee-71de-41d3-8708-de2c28d7ecfb", "value": "T10E3512426229DA63C4AA47F509B1E33107B95D9FEC61C3034FEE9DEB79113166E093A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208055, "uuid": "e8cd0983-061a-463d-91e6-8fc48ece79a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208055, "uuid": "b38eb795-d3ee-4423-b2f0-eb7716419aba", "value": "24576:w17ddx92PqVzY6bqqsKUaxNWgGdMWzTYy3XUVXO6wZWVc5n:wxjG2sKUaegGdMyTNk9O6iW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770208055, "uuid": "f8786e74-40e5-4570-b007-e3cb9d8e9643", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770208055, "uuid": "d2bd7435-63d4-437f-9770-df29e37be412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208055, "uuid": "6dd02b30-dd48-413e-bcae-6ec5c9b8d252", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e0f9e-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168281, "uuid": "19f25b89-0e02-42c5-b69d-98b8ba3718bf", "comment": "Malware payload (Mirai)", "value": "853ece7cf4408da5047b60a920ec1e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168281, "uuid": "84f91b85-b3c3-4dc8-bc5b-402432c5342e", "comment": "Malware payload (Mirai)", "value": "088517b0d3320fd21a52b55f64f0a6b5e2b51f3b2968cca79a870aabd9f53950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168281, "uuid": "2c70541b-9123-4119-a4b5-730878fad6f1", "comment": "Malware payload (Mirai)", "value": "0b4a470dbb4dc004a4a8a686ff00f4d71c8f65dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168281, "uuid": "535da031-268e-4bd9-a132-beb7b468655e", "comment": "Malware payload (Mirai)", "value": "89fd3da2e83f3f58399642503dad22c78cb2428c57a159b81c91a4190a139d8b67b1962df94e851c022a8e911cc62b06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168281, "uuid": "bbef4f35-f0cf-4839-9ee9-f5c09fc83c9e", "value": "T1F4539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168281, "uuid": "b922eae0-53ac-4a4b-9867-abc9bdcf65f1", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168281, "uuid": "2806fb3e-6c78-4e82-ba7c-0299c54df08b", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168281, "uuid": "b7c7f1b6-b703-4c98-96c3-85279dff5054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168281, "uuid": "a40ca9f6-95e6-40ee-917e-03f8b1640a63", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0b18fa-0162-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770165607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165607, "uuid": "1ebbc7fb-9da7-4c62-b46c-bd4ff9b1e81a", "comment": "Malware payload (Mirai)", "value": "f9c6b6e2c054505dde60ad42c268d412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165607, "uuid": "89220e39-98c7-4c83-8954-465dedf8796f", "comment": "Malware payload (Mirai)", "value": "0b00abeb54f732a4e04459a8c504863f60620d3cc38f7e8ffc2de1068571910c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165607, "uuid": "727a1a1f-048e-4da5-b270-d1ab098a901c", "comment": "Malware payload (Mirai)", "value": "56576882ed1f9e5662f02c2edabda8f404ec2828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165607, "uuid": "6e491a7b-c180-48b1-987e-a1b22f13f14e", "comment": "Malware payload (Mirai)", "value": "ca1f26655e3c30aa715b4e3533e22623568230bf58882b81f5bb7c3ab29afa8b25b4d2361eea6c86d81e74bd2bdda511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165607, "uuid": "85b11318-f160-40f9-8cf5-e548ed68d60b", "value": "T1E6B33A01FD104727C2D327B6F79E479C7B355694A7D73311AA38AEF42BC67882E2A520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165607, "uuid": "da529fbd-406b-4d25-8e3c-bc52626c9088", "value": "3072:c6rEFsayQR63Z8ayFb8ZCA358Ff+QmKASQRN7GKe8mO:+FsayQR07yFb8WmKASQRNKKe8mO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770165607, "uuid": "c7d2aaaa-0656-4101-a6dd-5a60488f1d44", "value": 116959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770165607, "uuid": "271f60b0-e421-4c0e-8daf-c384e4c11adf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165607, "uuid": "87a518c7-22c4-4028-91be-9be15416c2da", "value": "pXdN91.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa20fa6-01f4-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770228505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228505, "uuid": "e0c2203c-2a01-4d0b-8039-710a840e1d1d", "comment": "Malware payload (QuasarRAT)", "value": "8e51048ae7d547be92810b81fbacba04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228505, "uuid": "ce6db60c-0df9-4747-bde6-e2734e5414cb", "comment": "Malware payload (QuasarRAT)", "value": "0c6e9c75dab544d1fdc5771296c60f33a96212d8750e9647222ddb7fbd43947b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228505, "uuid": "07dd67da-f5c3-4fff-b028-f46d3c77be9d", "comment": "Malware payload (QuasarRAT)", "value": "b856f33aae8c67547c0d76b120fe2b182e7857c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228505, "uuid": "79f4ecd7-3d38-44af-9142-9484cd7ff2de", "comment": "Malware payload (QuasarRAT)", "value": "e1857fa74c5fb3580dc681cda9488725950f7b7040a7247b44a20757571a4f898b4828f2f4c678988a91fccd8e009c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228505, "uuid": "4a49bd97-85d6-475f-8e90-c7e6f672ebae", "value": "T1A115F110BBF8C613F1BE5FB5E4B286404BB1F4439A66D74E0DD8A0A91DA2381CE91777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228505, "uuid": "b8ed7e70-3bf2-4586-9d9e-08926948cd9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228505, "uuid": "bef2ed0f-cf6c-4289-8471-0b1a278c733a", "value": "24576:4dDl5U6SWHIPbcNK0KKfaOwI55l2SR8rN:+DlKgEgKKHwCBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770228505, "uuid": "13c52032-7a87-454c-b4a2-9113925359da", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770228505, "uuid": "640e8bdf-560b-4e28-a77e-916f0c343e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228505, "uuid": "d26d3394-870d-45ca-95c3-13c2984402f1", "value": "0c6e9c75dab544d1fdc5771296c60f33a96212d8750e9647222ddb7fbd43947b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff9b8f8-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770210305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210305, "uuid": "032ed644-5e16-4b6a-bcf1-6100521eb92c", "comment": "Malware payload", "value": "d8b84d5050bfacc7a31399d09b35f533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210305, "uuid": "de613ba6-ee46-4def-ad8b-3e4d2987f199", "comment": "Malware payload", "value": "0d199e35b32b51874dae687b2ccf65e3d8a98411db6f59eda2f58cd9a133da5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210305, "uuid": "b574c5e7-a520-4862-9133-2deca9f41e80", "comment": "Malware payload", "value": "81748da4ca73678f9712c7eebd77fca1ee9163a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210305, "uuid": "3fc7723c-51fc-4dac-80fd-a68378f260e7", "comment": "Malware payload", "value": "dd3fca8eb0dddd45b500c470aa02b140299f34a1ead78c3fb5d3697b42a6c5bbe92910aadccd0f27ec28060976ae6302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210305, "uuid": "bf426e9f-31af-4503-ac17-a30267b758c1", "value": "T1107239AB239958AEC126B1BFCC1427776044B5A2734C49FF2935C8AD2F03697E4F6B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210305, "uuid": "3f2ea035-1191-4e53-9a06-64740699039e", "value": "384:130q/A8fWIwryGnlew6eMWvpa8BVfkgiUGSa510OrJJkXdAJDCT4ff:130qnm+mWetBpbfkeG510qGXqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210305, "uuid": "7b496d4c-1495-4f81-ab49-bd066cdc404b", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210305, "uuid": "006d3e66-ecc7-410d-ac01-1dc1291a7168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210305, "uuid": "988247db-9392-427d-bbfb-5c2b8cf4b32e", "value": "d8b84d5050bfacc7a31399d09b35f533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf5cd30-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168288, "uuid": "da6b5fda-dae1-4246-835e-08218422e334", "comment": "Malware payload (Mirai)", "value": "0c8229cf97f1bf735cf94706008a2138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168288, "uuid": "8533a5ec-7d63-4c73-8570-0630e5ce17c0", "comment": "Malware payload (Mirai)", "value": "0d3141bb9e074fd9c2d12cdbf0c0b9c1b0eb9c5e64f7ed0c7268cf81138aec32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168288, "uuid": "ea3cb47c-27c9-4576-9d44-b01c7e714b12", "comment": "Malware payload (Mirai)", "value": "7aef5980c1042000e58b91e9cd8a04c1d4f02083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168288, "uuid": "6d711a13-1d92-48f8-95a5-48b861de397d", "comment": "Malware payload (Mirai)", "value": "fc8e229065c70b8dfdeec70b684623e9c63dd87a37655fbd599892a34f4c7d4c1d2dfac0a99c1e0028c4086208c81fca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168288, "uuid": "321bd537-a247-4691-bd69-c6d32750a0c5", "value": "T178B2D0A48B91A707C6B0B075E27C8F926A3716E4C5F63526262093BCDA4149732FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168288, "uuid": "3e09249d-197a-4072-802b-7afd105d5794", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BP7CChymdGUop5hu7c:4GaKQFH0rs3zWoDDRsjt7LB9U+BjCCs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168288, "uuid": "69fec9aa-4eea-4dc3-ba5a-e60e5d193618", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168288, "uuid": "f8487efe-994d-4e0d-92b7-26e8f29debeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168288, "uuid": "15bcd731-e799-4145-a163-7fedd4925eb0", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46815f03-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770210370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210370, "uuid": "322b0115-e61a-48c7-8c18-f515c3152d10", "comment": "Malware payload (XWorm)", "value": "130f81e67427d4d9051314cfea21a610", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210370, "uuid": "5f96fbf5-07e7-4edb-b92f-12c06cf7776b", "comment": "Malware payload (XWorm)", "value": "0de18a088d930a99f668677797ccc6526de6b3efd3dea91d980e735160b82773", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210370, "uuid": "e9912df9-417e-4559-9675-004f28516e50", "comment": "Malware payload (XWorm)", "value": "9e6b83241cdc3babd16f6bb37d8fe97ebfeab4c8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210370, "uuid": "051cfd0c-056c-4605-b5ae-8284d0f1b2f9", "comment": "Malware payload (XWorm)", "value": "ff948e8d323dc80194f640a930c80c61fb50470bdba100e5ef75a00774af024732d926bd8a4c4d38e6048d9ad07c848d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210370, "uuid": "3d12db98-a9c7-446d-bcfa-f4edaacb5b37", "value": "T13AE5339D8B497EEFF41C17F2C8A6E9D45C1EDE45A4B568AD10E8AF3C6AD20744201FC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210370, "uuid": "6f577ad1-50d0-4210-9a2b-4e15f583ed49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210370, "uuid": "50ebce2f-12fb-43d1-b849-769488730ece", "value": "49152:Gfn2lH56yndK0ZD64+06YdryFlmlOFEjFOnDI5J6K+rVAXvj/KE:g2TK0Jf/WIPjuI5JCrOTKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210370, "uuid": "0166548c-7f56-4847-9f4d-525a2871d31f", "value": 3078656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210370, "uuid": "9f470df3-6b6e-43c5-b874-d7ff81714a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210370, "uuid": "73041c15-49ff-4d7a-857d-17f1b5fffcec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b854deb5-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770201112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201112, "uuid": "53663cdf-6aec-488f-ad30-8569c4b0b43a", "comment": "Malware payload", "value": "1455be1f653bb2fab23dc274fb6cc719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201112, "uuid": "1c794718-2c27-4a92-94e6-6f3d98ab93e9", "comment": "Malware payload", "value": "0dee384430e3e0b20101eba35761487845308f973658d9ac2ea42dd52cba1f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201112, "uuid": "3bb830a4-2436-4215-a512-e9aba241a23d", "comment": "Malware payload", "value": "b79110f3e399c633adcc4256e163dc18dcf90c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201112, "uuid": "6dbfa88d-64bc-4563-a7c8-97772f90e867", "comment": "Malware payload", "value": "06b3adcab7b1ac9d5d8bedda74bd72d57a3ef131310b3249a012f47daa27d7a09b6ee3d56d4599467ab8499e99544f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201112, "uuid": "2f2693ac-3ba6-48b6-b44f-e136e13ffff6", "value": "T103853186F603ED4BE3C4E8348825DA76626637BE97F34879BC5CB5D8F26A5533014E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201112, "uuid": "fd17cdb4-78fa-4e23-9268-f30d083232be", "value": "128b7fdd85c475913d250fe1fce24325", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201112, "uuid": "22a02af3-0158-4dc7-b904-fb58d793e1bd", "value": "12288:Nn5mn8e1Q0WLLqiGic+Y3YQqLWQc0qpb0qD0xc:a8CQNCiGic+Y3YJLnq2qDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770201112, "uuid": "32f6c755-cf65-4f43-8b5d-91cbbe10dfb3", "value": 1857024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770201112, "uuid": "ce2b7e4f-e836-47ff-99db-23de4b92268c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201112, "uuid": "cfcb5f5c-8213-4bf0-96f8-00a6edae7a58", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f75e761-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164133, "uuid": "f85b9f01-5cfa-4839-b73a-13aa5b5a3316", "comment": "Malware payload (Mirai)", "value": "cb582ebe0276ed9ace10fd903bfacfe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164133, "uuid": "31a1a429-091e-4d65-9d81-bfbeb6804aea", "comment": "Malware payload (Mirai)", "value": "10066ab962d5b68a97665d2e9af99b8dd73c737ee1cae7fcfeeac80fe89f130d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164133, "uuid": "e1b4d775-760a-45cf-b658-4a8511620c8e", "comment": "Malware payload (Mirai)", "value": "dfea6202f8e6a976514007dc0610cfbca912b289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164133, "uuid": "3ce7a32c-49b7-4260-8fa3-a397212f717c", "comment": "Malware payload (Mirai)", "value": "e2d5a461adffac325ca40c5607c3a2319fd96da7781def7eddc258421d0f34499cea1f644f18520130e290026c564b33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164133, "uuid": "55bb2707-73dd-4a20-bcf6-db01ceb3e754", "value": "T1F7244B01B71C0947E1632EF5363F27D1A3DFDAA120F4E645294FDA4A9272E33244AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164133, "uuid": "e70d10aa-63fd-4379-bbfb-af5cb62fb1d7", "value": "3072:JvdquJZTSlbExbxBuEoUt+rAGiR9Ja1CR3wbZnOZ:JvdrJRSlAxbxEEoUt+NiRza8JwROZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164133, "uuid": "e83bf10e-b284-4606-b048-b43ce446b14f", "value": 210652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164133, "uuid": "caf8515f-88ed-4ae1-9d79-3e9f9d03ec08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164133, "uuid": "e412c835-67ea-477c-bca1-0516b4bec332", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719d02d7-0202-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770234494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234494, "uuid": "84b95dda-b683-400d-9aa6-60a8927b2088", "comment": "Malware payload (Mirai)", "value": "78b2b84e2336ba65614a07803feb4e44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234494, "uuid": "f215cf2f-7e6e-4dd7-9618-0a7e281f0dc7", "comment": "Malware payload (Mirai)", "value": "11610ca0ef339ccc0ca8031f10539c5957386dd71f06556ca06149e91825e371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234494, "uuid": "b50e7bce-8009-4ef9-803d-f08d89ea3bc6", "comment": "Malware payload (Mirai)", "value": "23aae41f2a3abf662624de1e87d009bcc5af5ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234494, "uuid": "ebc7a235-825c-4544-90bb-db3d49c08619", "comment": "Malware payload (Mirai)", "value": "c2f4f94351b8b4e9da9ec7ea2c852eab27f54d308c0ee2b963d52dc6617299d14008dc9ec411ddfbb613c7be8b1e0a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234494, "uuid": "9aa02d2c-464a-41fb-88b0-303b5881be5a", "value": "T14F535907A58181FCC19DC278176A723EE93376BD0339F2BA97E8FD1A6C15D604E2E508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234494, "uuid": "7d80644b-85e4-47b1-ad93-488de2f77ff4", "value": "1536:bnHkHRxHBFPSWGzIGWlGy5TGpWE7wH9OXEL9qK:rHkHvBFVGzIKytJE7wwXEcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770234494, "uuid": "6e18c7a2-36a8-4094-a449-935ebf06195c", "value": 65808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770234494, "uuid": "aedfc276-9b05-43a9-8531-7d4ee9ceb3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234494, "uuid": "21d4b6d4-e949-4b86-a0d3-ab7889cd3742", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be30746d-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168050, "uuid": "ed9784f6-a918-4673-890c-bf8bb5b9014b", "comment": "Malware payload (Mirai)", "value": "7e44fdf24a96faa27fbff88b1d6353f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168050, "uuid": "818015a6-adff-482f-97dc-132e7c6c14be", "comment": "Malware payload (Mirai)", "value": "1176b46071a100d2e41af9c702dad6f3028c766e035808f54fb6b377e4011e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168050, "uuid": "ddd1876b-c36c-4a30-b232-53e15e89f32b", "comment": "Malware payload (Mirai)", "value": "dcd3460a882a7cd0e9b06c927d3d8341ed5277d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168050, "uuid": "0132c6ed-adad-458d-85e8-8274b2e35114", "comment": "Malware payload (Mirai)", "value": "68b658ccefd4fd1b02213b2f190ce2dfd6ef19ccdc930c5d34f975e0aa77bd028d241a532f15752f87d97999884c585c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168050, "uuid": "7e8eb0d8-754f-4387-b873-11bcd2e82a66", "value": "T1CA735D24A97D2E26C0D4A17B61FB8321F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168050, "uuid": "7a81a67d-d0a7-4889-b1d8-8d2e99779417", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws86:YwfdNu4cmZvFqI3w76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168050, "uuid": "c7469639-cf8b-4585-832f-3a719257941e", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168050, "uuid": "aeb56caf-f5f9-4211-9423-9c162d3acc7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168050, "uuid": "9abae079-73f1-4eef-b1ad-70ca5ff8b488", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21edc98-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168057, "uuid": "9bd57382-099a-4bc5-ad9f-dfb88549a78c", "comment": "Malware payload (Mirai)", "value": "4a4acf3ae9c8acd3a521e8b2dacfe56f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168057, "uuid": "1977cd15-0e34-43e0-b5c8-f2a9c2b710ac", "comment": "Malware payload (Mirai)", "value": "11a1cf3c9aaa677caa8e8ac708799a2d843881870f92cc5353e9286b42152a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168057, "uuid": "24035e82-f6b9-4386-ab33-1368ed04c095", "comment": "Malware payload (Mirai)", "value": "a57da386db3585a3f63d3802c73b71f386cb92b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168057, "uuid": "d15d8697-8330-4866-b4e2-9491ff6e43a5", "comment": "Malware payload (Mirai)", "value": "6a0209bd02f86373e0afa9ecf0860555ddd34f91d7283cf958e03f467b7397aafb7c4a13976339603abe0a99c748ed33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168057, "uuid": "b014c79b-070e-4e43-92ba-45ebed5953c7", "value": "T1F5536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168057, "uuid": "b3a62cce-57b2-4961-bb08-351b97a796f1", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8p:p5VHV8I9cKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168057, "uuid": "21955739-902d-4ff8-80fc-e72e8f334e94", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168057, "uuid": "8617a0ff-1171-4263-b4c9-15fe8ee2ad1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168057, "uuid": "23e42e4f-0c5a-44a8-9836-76a4eda4f20c", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc5c7c-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163915, "uuid": "15116ea5-e0e3-4e47-a797-908a76b3eee5", "comment": "Malware payload (Mirai)", "value": "2d1c666931f4c9907e41504318245fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163915, "uuid": "acd86437-7899-47d6-9467-7085052edf09", "comment": "Malware payload (Mirai)", "value": "12b540d69a606db64291149c694c84e81f3ceca263f40f35fbd4b15bcd79e562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163915, "uuid": "9ee2cbf9-503b-4176-b3fe-b4023d300e13", "comment": "Malware payload (Mirai)", "value": "d6f613f1c6d9a711b3d3c79edf592205a0d647c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163915, "uuid": "86395a7e-2cf3-4119-b23f-47ea8a373da0", "comment": "Malware payload (Mirai)", "value": "a81b7dc2f73f40a0e1f25d155d85c7efa3582bcda44c6882b4afc329c9c1cafd046407345f8a641debad25a304b295d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163915, "uuid": "e40a9bca-728d-4a61-be99-d6e1a3ce63da", "value": "T19353F11342870711D25854FF6AECB90F4861E51AADB04B72B7697D3CBE82E745B0CB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163915, "uuid": "75953001-ecef-4af9-b857-fb7bea17b387", "value": "1536:27Sm/Lh84xqPaku+KMUkJyj8HgGiW8X5TLOn3FlkYHacv3nouy8qqI:7xPaQz46i3X5TLOn3FlkKxXoutzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163915, "uuid": "4f74256d-41ab-4c40-918f-56d373478718", "value": 63916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163915, "uuid": "ac6df362-1081-42a4-8d7e-29fa01d244fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163915, "uuid": "a0df0874-0dec-4d91-9dd0-f41729fa746a", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591404c1-01be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770205247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205247, "uuid": "e9f59c61-fdb0-4437-b267-895525080d63", "comment": "Malware payload", "value": "8205cfed7bd057990d49bdbcd11cbc26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205247, "uuid": "c16e14ab-17d5-4ac9-a485-ae75f77290c5", "comment": "Malware payload", "value": "13b6ebeebce2082c09a888b4e531b125926f749e483adc865f0b666f9897a831", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205247, "uuid": "c0f83077-ccab-440c-83ad-53f2dba7bdf2", "comment": "Malware payload", "value": "52b7a79a4848f5be6ebcd06d359d28b58d754316", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205247, "uuid": "e1a60cc4-5c52-4dd7-856f-aed8f74f2a9e", "comment": "Malware payload", "value": "656658ed64cd4d5335ee96cf204e03dc286bbee5de32e9c961bffdb9eaea2df7c5895ee1c31fd11c45a813d115b7f156", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205247, "uuid": "b5a4e509-df9f-4422-8b1e-7edac6d74c65", "value": "T12E868D26EBC8096AD9A791FDA346D232D6F1A5509328631758EDC30F17B746CC3BF212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205247, "uuid": "8ae27fd1-97fa-400d-9bd5-a00f7ab664f1", "value": "00fbed535394d843ddb505b7865ce71a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205247, "uuid": "6074c770-6632-4739-9d91-ece2134e4cb7", "value": "49152:GvoFtaYvT+J+tktgsD3BNsP9dwiBmuoK7cdnui1wwkwJUtnYp4gwS1Ny/tdFW2CV:h5TXmgh3Ie7coienwl1NMePs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205247, "uuid": "631eb9d3-e4e8-4cf1-841b-6df7d4ca4703", "value": 8531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205247, "uuid": "abf55b7e-8945-433b-b6d1-32175fb9af87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205247, "uuid": "1d1b0616-7667-453d-8718-1704ad9b0537", "value": "libfzclient-commonui-private-3-69-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6181f14-021e-11f1-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1770246608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770246608, "uuid": "a1c69428-36b9-4807-a87b-8d72ee8179d0", "comment": "Malware payload (Loda)", "value": "ed208bf58d27c44ded914639e2cc6784", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770246608, "uuid": "a78cce61-bcda-4e13-8789-93f2a1422340", "comment": "Malware payload (Loda)", "value": "152f1f128e778e1dad07ddf4b26449c2cb96102e5f02cfde60354dd72669e5d1", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770246608, "uuid": "49852151-d206-4243-982b-fff89dc05693", "comment": "Malware payload (Loda)", "value": "0daaf02ebf866902e79560b4eec52448bb405fbd", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770246608, "uuid": "834fb4e6-52f7-4826-87b5-c556169dfeea", "comment": "Malware payload (Loda)", "value": "93e4ab916d988ede04006e7171e0e38d43fb4c543b54e2fab36bfc81d8eec567c9c0b273badb36f87f6e62674e6038a8", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770246608, "uuid": "aec43627-9302-42df-8ff6-5bf5bf6b50ff", "value": "T143A51290EAE6807BFA251230543541E597682D396331C96A25C7FB6F323FFB05EB5B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770246608, "uuid": "f729a8d9-4c12-42e3-8039-03c7f68af918", "value": "49152:9NfJ46F5y2zzuIavXEsT+rFrrH+D3JPxaIgBM9M4RAfHkpH0:PfJ4iy2z9uYRHAJxaNuzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770246608, "uuid": "ef753799-3a26-4290-8c55-27764f2b45d3", "value": 2197504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770246608, "uuid": "c53e83df-93e6-49d3-843d-6c85bbbc1e1f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770246608, "uuid": "62d7a30b-ce50-4e5b-a8e6-ec7329a8e4e9", "value": "confirmaci?n de transferencia bancaria.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fdde61-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168285, "uuid": "234868c5-e0d4-421e-8246-645cb04d02ac", "comment": "Malware payload (Mirai)", "value": "85105ad271903566c3537c4ac320dc72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168285, "uuid": "3ac3e42f-a02f-4afb-a12e-ab30081bb182", "comment": "Malware payload (Mirai)", "value": "16a017cfa73f0d84a3ced9789b8810c3e3e0aaa7ce42c315eaa7df09f964e88c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168285, "uuid": "d4459a62-1bd9-4aab-bce5-7437e05f521f", "comment": "Malware payload (Mirai)", "value": "d55431c6cf218c8bd89b2451aea668de7493c40a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168285, "uuid": "9b74c0f3-a78c-4d86-a43a-38cbb2a1e65e", "comment": "Malware payload (Mirai)", "value": "e729599a3b03edac3ac036fb9fcc5420e42455dea0727eddda4adbb6604db1eaadf6dce4cf907fb38eb866b4d75a6d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168285, "uuid": "b181e424-4696-48d2-911e-aad905d3d79d", "value": "T1DBC2D040F0419A40DFFB2DF02D40CADAFBA56F5F6A658E8026A493C5AB5C2735701ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168285, "uuid": "2d271c3c-1b63-4d8e-b011-c52a0e11f9e8", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7PPsH4uVcqgw09w:bam+AnKehPRa9a3K4u+qgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168285, "uuid": "5f286db4-44d6-4901-a154-2c4fbf7ee3b9", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168285, "uuid": "e1f63d8a-2769-4225-8efc-056e8b20313b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168285, "uuid": "f4855ce0-3c06-4a12-9a48-1a906e3dab0c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e245f76-0171-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770172211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770172211, "uuid": "9f5bedc6-d575-4e2c-ba8b-b523b3013c43", "comment": "Malware payload (DonutLoader)", "value": "c8bd411a07dbb993a7894674d541d519", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770172211, "uuid": "18ea5714-8270-4358-98a9-5ec3d47661a4", "comment": "Malware payload (DonutLoader)", "value": "187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770172211, "uuid": "26973bd7-9c55-4510-a27f-f0a021d2313a", "comment": "Malware payload (DonutLoader)", "value": "4fe30dd88d884d8049de3cbb914fcf2a050cc3b7", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770172211, "uuid": "436d2910-55ab-4f78-ad5b-1e38327e4c1e", "comment": "Malware payload (DonutLoader)", "value": "184f52cde8d1b920b5cc873adc709f624134363ef76bddbecd36f74e5ec885671a2c69de3db4fd1f8a3fc5f1589d2bc1", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770172211, "uuid": "35cabefa-ec8b-4e5f-a383-101020784c31", "value": "T131968DE33E6A01C8CB1C7FABE7129DCE31C4EE545A453C8AA7D5B6842B2634FD52C125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770172211, "uuid": "57fe139b-c753-4a37-9e34-6941ecbc7989", "value": "49152:CMVl9BM+G08EBQIBbsVsUgEcdsNP9VzQGKzmLdWW/g183vDkEakp05:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770172211, "uuid": "7cfed477-4888-47f1-861c-1b725d9676ef", "value": 9354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770172211, "uuid": "e892e26c-86b6-4bd5-9c83-03827cdc5528", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770172211, "uuid": "4da5ca4f-cff9-4242-9fb3-5018c5876db5", "value": "nSolicitarRelat.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66488230-0198-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770188948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188948, "uuid": "c8bec30e-fc4a-476e-9c9e-665fa02eadb5", "comment": "Malware payload (Joker)", "value": "ca194a3762b98bbd75588f9f391ab020", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188948, "uuid": "cbf8c5e2-8f9d-4068-9625-6aad2f38add3", "comment": "Malware payload (Joker)", "value": "18b12b225948edee3cabda286c619c01993616bc151cfefd03c8029498575ae3", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188948, "uuid": "501fc407-b1aa-4dee-a756-86b1fba0dfb7", "comment": "Malware payload (Joker)", "value": "63dea7af76152c9a0f0db2bc56146cf94a245748", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188948, "uuid": "1cd2ef72-0b78-4072-a6de-b779eb88c449", "comment": "Malware payload (Joker)", "value": "9deea75dae597cb7818c4fb86bdb7f97b03429d1f4d97778a42a5c1342231ac9b8db04aafc0b091baf0973f04f34c673", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188948, "uuid": "c76fc1e4-5150-49cc-b545-34c1e5438a6c", "value": "T13C371289FF0CBD1FC9F6B0B98E5C53266A2968189342CBA7D900825D7DC76D44E1B7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188948, "uuid": "5545cccb-7a20-4a53-87ae-6134ef369b70", "value": "393216:A7F8fmhPdekgWJhPuKCZaLLn3sBdFe41gD79pc/LsTpS1eCXQquhCnW2COJaP2x:W8fmffzPu1af8JpC79uzsgBgquhCW2C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770188948, "uuid": "14499d10-0144-429c-93b3-d3d7347e5b52", "value": 24552724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770188948, "uuid": "3f43e738-361a-4658-9838-4243797c0da2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188948, "uuid": "56ce8bf0-909a-40f1-872f-ca340172e3b5", "value": "com.manner.nepdrama_1.0.46.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fed1598-0187-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770181556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181556, "uuid": "5bf7bb84-388b-4630-adeb-d775394ae8a5", "comment": "Malware payload", "value": "eb6bda1739d5608fa19f75e9d7b58f80", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181556, "uuid": "4ec161a5-647a-4c64-96e5-edb68282b559", "comment": "Malware payload", "value": "1abb622f4a6ea87e3fcbecb4eb7d265befd68e720ab09bb310e2fbcd6e9514f5", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181556, "uuid": "014b47e8-e778-41fb-bf3d-290589b82069", "comment": "Malware payload", "value": "82094a065de3351b3e30100c72460909352bcb8e", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181556, "uuid": "00a62ba8-0151-4373-a325-3f31f478e34b", "comment": "Malware payload", "value": "935a8ea89ee2d55f74f1e440b21dbddbae0b91594c4884e297bd39c04b7418c160bbcbae564ce91f0265ef4e2c2f6cbf", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181556, "uuid": "15cfb547-7ffd-47d6-b900-6c53399799da", "value": "T14CD23FC93FC3B97417753037281FB099E178AD89746CA51AE366ACA1B87131CD4B6D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181556, "uuid": "7664db72-828e-40bf-a58c-ba4ef88a40fb", "value": "768:mG/vC7V/SwkBh8B9pQq6jiwtcglWYgiDZDS:mSvISJho2VlW8dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181556, "uuid": "77ea8726-982e-439e-b64b-2c521f3f0d52", "value": 28324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181556, "uuid": "ef35b078-d01d-418f-8ee4-4f863875fd8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181556, "uuid": "17c93f6b-5fe0-4375-a3a4-4e359ebbac1d", "value": "1abb622f4a6ea87e3fcbecb4eb7d265befd68e720ab09bb310e2fbcd6e9514f5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a167bd-01f5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770229075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229075, "uuid": "985a86aa-224b-42a0-a326-f81e89b0b5e4", "comment": "Malware payload", "value": "f3ac1ae11c989d964761ac6810433e89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229075, "uuid": "3ca7ee93-c2fb-420d-902d-e047a81d7e1a", "comment": "Malware payload", "value": "1ca80c889b40252a61040f48be8528a52d7fe6aa67ed83e8fdfe34d0808cb34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229075, "uuid": "abaa7490-9844-4c88-a32e-4532548b608f", "comment": "Malware payload", "value": "903b62a9a060f87b71ca42e8f3062e34ac03952f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229075, "uuid": "ab826f59-7f17-4791-99a2-f1fea0ee66b9", "comment": "Malware payload", "value": "b5d0fc93776f254fde9f7eebef851a36352dd60fdaa25de0e42b238fcc20e6cad49532b2b4aaf73f078e5ca090443c63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229075, "uuid": "0c38d300-711b-450a-af06-294a990f683b", "value": "T1BB84238922DB8222D171EE7352F3A471733E8E5E62423D6B454677CEBAF700685C127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229075, "uuid": "fa6768db-bfc9-48f2-acc3-0afb667b5e55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229075, "uuid": "49d0799d-172c-4d1c-849c-fc0704bb4379", "value": "12288:/tiFvjfqd09rowhOLfxhl5gBNSl1jiwtTc9K:/tyridAhc5Gm1Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770229075, "uuid": "9bb46f64-156c-4acc-bd10-36c93c4c53bb", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770229075, "uuid": "dc4e27ad-7734-421f-adb9-f921816b0bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229075, "uuid": "e5667937-2d7e-4636-a5f1-54e59c5195ec", "value": "1ca80c889b40252a61040f48be8528a52d7fe6aa67ed83e8fdfe34d0808cb34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d18f4e0-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192664, "uuid": "d42815c5-b49d-4675-9551-772be12e8e77", "comment": "Malware payload (Mirai)", "value": "f68fff6c1b08fb9e208ea37640b782fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192664, "uuid": "644308e5-2182-4a08-9505-458d9bea6bb1", "comment": "Malware payload (Mirai)", "value": "1cbd717a85a0a385bf3803497cac556910dc76c0c206467cacefe582b655f57e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192664, "uuid": "032c2c2f-dd6b-42ab-8648-fa7125a60f59", "comment": "Malware payload (Mirai)", "value": "278275579f9e9219487e1c34fa44b6f3fd109cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192664, "uuid": "462dbb87-6c8b-47f8-978a-bc4446ebd0b7", "comment": "Malware payload (Mirai)", "value": "a1ba92dec8fe8b6ff75c5801fd5685896844ad827a57aa99c602c10621f48c081cc57c4703fb4c0ad702a610847dfa08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192664, "uuid": "09ec40fd-413d-4eec-a03d-f5228a749d8c", "value": "T154930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192664, "uuid": "8c97a4f1-f820-47b5-93c0-cdf907e5b884", "value": "1536:wqnZE8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YPn:M8NUv5nTacgzafVAwe4BNRIbT2gXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192664, "uuid": "351b1d69-8343-4c98-831e-c8d0cda16200", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192664, "uuid": "046c45de-866c-4dd7-b8af-c6f9dc01210e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192664, "uuid": "f169fad8-e15e-44ec-8366-5affab48dd8a", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e223ddf-018f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770184989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184989, "uuid": "17102297-d2fc-4d0a-b8a2-f11a07319b35", "comment": "Malware payload (Mirai)", "value": "325abee80bead2ddcb27b4712e156bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184989, "uuid": "907c6367-e3b4-47c1-9010-1578180e960b", "comment": "Malware payload (Mirai)", "value": "1d410cfe96b84f1b52da3d8c4627e022226cd1aa34d37a50d56ce8e7cd4aa592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184989, "uuid": "46e13a93-96c3-4e5a-a583-be8b587d9898", "comment": "Malware payload (Mirai)", "value": "7d44869ca80dce59bcc1b9403e5069e52b07592e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184989, "uuid": "11296b84-5d83-4036-a6a3-89f35dabd107", "comment": "Malware payload (Mirai)", "value": "847cfe430b4ccdd378893196b2d853577b7204d993e1e78c518f7149d191b4cf7bfd667c95f720668868214fd9cc3ccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184989, "uuid": "0c35bc25-db34-4edc-8c56-a941ad52e9b7", "value": "T1BAB33A01FD504727C2D327BAF79E478D7B351694A7D733116A38AEF42BC5B882E2A520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184989, "uuid": "3d9670b1-a369-4dee-bb68-f941ac4057d1", "value": "3072:dB4m9EgNZrMk/y+Kvy5PfDqD1omPqqQRNAEetmO:h9EgNe+y+KvdomPqqQRNAEetmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770184989, "uuid": "1cb801f5-dc8b-4b18-846d-d3c9f42f65af", "value": 116583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770184989, "uuid": "e3d4034a-7fc2-4473-ba6d-fe9e58c4a18d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184989, "uuid": "b6be4dce-74eb-4ec6-8f37-c868e5c17449", "value": "pXdN91.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d298f709-01c8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770209746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209746, "uuid": "726f512d-4adc-4fa0-93d5-476dc982c603", "comment": "Malware payload", "value": "16cde43dbab12812177211ed6c28b4e7", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209746, "uuid": "3909c25e-4617-4c1e-9160-834320fb7425", "comment": "Malware payload", "value": "1e9e8c6e0cb3790f07804beb44bbea9335359779e34a777cefa3a774b54a9c95", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209746, "uuid": "fe080dea-7557-4038-8e95-a320d045a83a", "comment": "Malware payload", "value": "38fcabba4061ae3ca5a4d3b6273120f88f3038f2", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209746, "uuid": "a3754e0d-2e0b-44e2-b226-5021f1034373", "comment": "Malware payload", "value": "fd9fd36d7b8ab9b79c5b40e04fee044794153ef9ae5b8cf56bfdaa22f9a896caea8ea90755f43d610a409bcb39fc58f8", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209746, "uuid": "e1dfb46b-9a50-4dbe-b612-dfc36b61d3c6", "value": "T1E4A4E637BE695D84DF950EFF8221D5A58CC8E9D391A5C0E1BC400901BEE9BD4F9683A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209746, "uuid": "be4362f2-29cb-40a3-85c9-99848c63e901", "value": "3072:86/2x6A99US8N3aKOEv30AX+pW9r2zHD5fv1wLGqThKyDHGKF6LBnDlXo8a2R:866hgxz3P/99r2RlwLhT81LBnpXPa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770209746, "uuid": "5895e1b8-29c5-4cd1-b9ca-40a8994350a7", "value": 458943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770209746, "uuid": "f0f0ec5b-19b2-4ed4-91d6-29ada0b1c247", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209746, "uuid": "e47799c9-b942-45a2-8deb-529e5401ecd7", "value": "runSetup_macOS.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833d1813-01c1-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770206606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206606, "uuid": "23c976ba-ef93-440d-834b-055290dbf16a", "comment": "Malware payload (SalatStealer)", "value": "ea081de8b2fab36d30ea757b420035d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206606, "uuid": "aacd9536-1391-44b5-bf79-036a5081357c", "comment": "Malware payload (SalatStealer)", "value": "1f61f18236ef25fcbb4a2cf07931351245859c81ccb60c4a3fcd41f0e8faa4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206606, "uuid": "086d8cb5-88fa-4169-a011-13d7c7a54994", "comment": "Malware payload (SalatStealer)", "value": "4717d7b5c900ba9266225711dadeb77b4e3bd078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206606, "uuid": "b21ec9c1-2a34-4434-bd5c-5613ccaa7e01", "comment": "Malware payload (SalatStealer)", "value": "f2af929e890313a7ad346adeb0dcdf4bfea26d1545bf080cd774f599b995587f560cf9f83e8592cfc2fb57b8bdd3d5fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206606, "uuid": "d7afb4e5-445f-4bbc-b3c7-0c302eb069d3", "value": "T1DFC65B01FA8B98F5E9031835416BB23F63315D048B28DBEBFB547F6AFC7B6811966205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206606, "uuid": "e8b9ebe8-cb30-4455-b39f-17e205e5258d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206606, "uuid": "ff5ed386-b3a5-403b-8e14-f8d502422813", "value": "49152:WoN0+aEAMC7qtuJctBI09WWs50xoQQjfwuKNJFNSW4gCNFabr8G5AT0nOMJpIxpP:f2+aE9tmyEW4La3RoMrzsFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206606, "uuid": "0c54d4b4-09d7-4785-bf1e-a4c41a2dbd4b", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206606, "uuid": "32a320f3-fcb2-4b26-934d-e6ae8364a6fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206606, "uuid": "18bd1798-7c70-49df-8549-eb62624c6394", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06a6f43-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189985, "uuid": "9b6fa8ce-3a42-4751-81ba-4d468569fd73", "comment": "Malware payload (Mirai)", "value": "9e8a5697b45ec78bd5ef0315b9dc0c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189985, "uuid": "935366f0-16c4-4f87-8b5a-465f0f10c66a", "comment": "Malware payload (Mirai)", "value": "1f86d7a4d822aab57efce5b3a19d335510d41a0c47ab75c77887084c3f2412ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189985, "uuid": "49b169ce-a0be-4e8b-89cb-8dd6e7806e9a", "comment": "Malware payload (Mirai)", "value": "310c2cd4796aa7b2de4a1da08d76f42b401e9bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189985, "uuid": "6652f31d-f4f5-462b-a26b-f6f63b4e3b4d", "comment": "Malware payload (Mirai)", "value": "de293433f05e9492e44d8203c71561f4db18c44974f47ecaf2517102bf0c9890515a463be39586819421e859f15c9f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189985, "uuid": "86895596-c5e5-4188-9d35-3adc7b354085", "value": "T10B733C0137588F07E9AA4EF9282F17D083BEEE4011F5F1856A0FA75A4235F33595AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189985, "uuid": "e5b8d961-96bc-4273-bf2c-41ae481e9e00", "value": "768:3HgGNDHJU4h1XZRMbR0OM+yjRXnmNdeLyJ7RqlnYK+dLeDq27aU05bKY2W6hchUZ:hDp16z05yJ7c+dj2W6hb6XrjVe2XQ19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189985, "uuid": "eaed771a-45b8-41dc-b8af-818d6ff3a643", "value": 76920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189985, "uuid": "902652ae-be7b-4fe6-a767-b06be15fb61f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189985, "uuid": "2dd1401f-54c9-4f02-858e-69a785c6f1af", "value": "nullnet_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7532d027-01ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770226340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226340, "uuid": "5b1cd000-8c8d-4cab-8b1f-7b144a7c0a64", "comment": "Malware payload", "value": "f240f774f5fbfc635fedaa415ebabb9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226340, "uuid": "f755a80d-4b86-44e1-8c4f-27042771dc77", "comment": "Malware payload", "value": "1fceea4105963bd920901c0f63587d23277b9ab39872cf9b210c080c59f1a29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226340, "uuid": "b5d5c639-00dc-4b54-9a23-1bb8661ca454", "comment": "Malware payload", "value": "005ee60638ee7f9f732e71727a5b847f95b370ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226340, "uuid": "8d607099-e495-41c3-b040-b2f10bf536e0", "comment": "Malware payload", "value": "9aaaa7d1e5e04b320b6374e34c7fa3b0a2b3201d4d86979c483488d32f97d4d805dc9de2659df26b5915aa248abb2763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226340, "uuid": "d36006c3-ed80-4018-b67a-f456251d3b9f", "value": "T1E5F76B4267AA05D5F9F79A349AE65213D673BC067F3081CF324C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226340, "uuid": "7485c78d-0136-43d8-83d1-6c62b2950aa1", "value": "c26e33877abaa94e37e0b8ae3c8d27f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226340, "uuid": "634cd017-ae28-4544-885c-7e76b0e4e55f", "value": "393216:0fUJsRJDQVZpWWWrGc/d0ULRRQcKPxeUSp3LJpbRQSI8wxSvDazn1N5VRoEY7SmF:0fvTRQtRe5+asRv/UpgPVlcmTMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770226340, "uuid": "cfa5bf41-bcf2-477a-a0d2-7bd7ea69ff3d", "value": 72826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770226340, "uuid": "66a9e993-c49a-4fda-b566-235258249484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226340, "uuid": "93c375e2-a02c-46e1-8300-50c0689e77e3", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3870f2-018c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770183668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183668, "uuid": "846c1463-2462-4a68-a1e7-c69d12104359", "comment": "Malware payload (Mirai)", "value": "3bbff7fddcb27394c06878fbbedbe5a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183668, "uuid": "8ce783d6-d79e-46ab-854d-599b95e31565", "comment": "Malware payload (Mirai)", "value": "21250f8b2f5bc4b1622624c26091f1a89e4f921750f65f7b4fcf4c5d0959ac31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183668, "uuid": "297a582a-3049-45a6-b640-c21e248c23ae", "comment": "Malware payload (Mirai)", "value": "0903360f210fdc20ac2d2acea6756e7df0513b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183668, "uuid": "f9a35b05-eadc-4023-af99-5e4b103d0d59", "comment": "Malware payload (Mirai)", "value": "3865e6841e1a110a854e9c9ce7d918ad9d4a6ce22990190743d7248f2cbbc1452f66458ef07c71e25423bda1d5874b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183668, "uuid": "c6256af9-8355-4623-bff3-329315bfbd2e", "value": "T1F5C34B46EB418B03C4D52776BA9F42493323EB54E3DB330699185FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183668, "uuid": "f948e743-2e6e-43dc-ab19-6ab6ee709fe1", "value": "3072:pZbrJ6ah3P0srIGjE5L6wnezWVIOxVDlJj:pZbMah3frIGjE5+wkWVIOxVD7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770183668, "uuid": "42df637e-8a9d-4bc7-8029-4b1135fccb5b", "value": 128282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770183668, "uuid": "0f336069-1e3c-41f3-8c02-7d438745014c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183668, "uuid": "05ae2802-7e63-4f71-b9ff-7055298b042b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c54abfa-01f1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770227049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227049, "uuid": "760552c7-4d49-4da6-89d3-e441c4c64bad", "comment": "Malware payload", "value": "2ecd027d63a70bcdb1696236d5c0e949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227049, "uuid": "b54bf5ee-ee4d-4eb7-91d3-273a547bbc19", "comment": "Malware payload", "value": "218995a6c7e65b8fd82fc252776f5c2ef7d6f42fc8895ce9530a29528f258c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227049, "uuid": "c3ae6e49-5fb6-40dd-9cd1-afef8939a257", "comment": "Malware payload", "value": "e6d3791dc72d18f54e1005a5176c7451985f782d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227049, "uuid": "fdce7bd6-c305-4af0-ad03-b395c5ac1a7f", "comment": "Malware payload", "value": "ac9a8a03dc8fe49d4b4f8979dec4d96a95e98e0172c59b205a8d5892dd10c8f5e8ad9bb1f786204277c3df99dceec7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227049, "uuid": "de8b5f28-938c-4f2f-867b-66e2781da0c4", "value": "T1CBD623E9409262E8D4E38650758B43DA75C0B26C84ED5C1A39D63C022F61DAF768FDFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227049, "uuid": "40315254-2bfc-4e20-941e-06968079d67e", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227049, "uuid": "d32119b3-14e7-4230-a3bd-2ba1a79bebb6", "value": "393216:mAE+V2K54oT1EVCBkt8d2E7gBThQUOKkjTC:TjkCNdnrULkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770227049, "uuid": "7f14a97e-0e67-4c50-82ce-09717cbdb289", "value": 13074432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770227049, "uuid": "c7e4104c-0223-4156-b3f0-dc8e65df9ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227049, "uuid": "46f6f902-6939-410a-9bb4-339525186cb4", "value": "Wamo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db071ae-018b-11f1-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1770183458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183458, "uuid": "53ca51b9-6d25-4a26-9d0d-155c66306e9e", "comment": "Malware payload (HijackLoader)", "value": "9c12ff43e67508377ea03916b217fdfb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183458, "uuid": "2d900ed0-0dc9-4b22-9a78-36bdfa2f95ce", "comment": "Malware payload (HijackLoader)", "value": "21b27f53183f8613c33b50490e001e75678ad73944588987623cfddd67733cb0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183458, "uuid": "ef02a08a-199e-44de-96e5-8e6a8e0c4953", "comment": "Malware payload (HijackLoader)", "value": "f3f25621f98f0878ffbcd91c15e4f0268950a70f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183458, "uuid": "97848b74-cc4f-4d4a-abe6-17324da40457", "comment": "Malware payload (HijackLoader)", "value": "80e5e36f1e7a262647858b680fee1a9ba936c888e2929220f1f4c5c7f77a7146c6887576fb03ab55c679ec84ea261192", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183458, "uuid": "217fbcb9-1825-4b41-827c-2a3042ea7869", "value": "T1F0663323EBEB00B4F4954D34D5A281847E8739BC15F9B1192CB5C98C89B47828ABF75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183458, "uuid": "b1a58067-6fb8-44f4-b991-a6de6d2bb8a9", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183458, "uuid": "09d21edb-33a0-4251-a727-524a51920bf6", "value": "196608:GMPxWQCF9ChS86w3B7G/6k9R58BW/qLxj:GMphCChxBy/bT5CW/q9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770183458, "uuid": "ea3bae20-0d60-46a2-a85e-c68f1b55c14c", "value": 6626144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770183458, "uuid": "9e4b50d5-30b7-4f5d-9f42-cf2341fd8394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183458, "uuid": "f64dd7ff-0d23-427a-9601-ebea2ffb2a6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9223ff97-01a6-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770195035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195035, "uuid": "b2fcee3b-9351-4fb5-a8d5-aa00d42e1a5f", "comment": "Malware payload (Stealc)", "value": "554a9c71e8b42505bcd0eeb505170257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195035, "uuid": "4488a9c3-0b22-4ff5-bb91-f9ae65ae76d5", "comment": "Malware payload (Stealc)", "value": "22881419a62cd516446a8f1926910aa68e66880322137ce2b3696d97d4f66bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195035, "uuid": "b53ea158-a801-4a81-9810-3dfa2f21c83b", "comment": "Malware payload (Stealc)", "value": "2ba069988b57bbf115f2710871bf74013242e831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195035, "uuid": "8b6a9bc7-f88d-4803-89cd-16fe22852b6d", "comment": "Malware payload (Stealc)", "value": "48fb1facfe7f98fac2f52ca3a573a04ea191686df1ed9b668012a0122843c8ca82a7b488f43064e27b975ab36148cebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195035, "uuid": "20de3571-7a64-4a32-832a-51e49b2c4068", "value": "T1E1C49C03B541D4B6E47705B48D75EB548BBEBC700BA19ACB73C00DAA5E706C0EE36B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195035, "uuid": "b7c229eb-e835-4d2e-83c8-7928ae2b49ae", "value": "f65ed848807002ce3dcd9fabd3861ae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195035, "uuid": "882e8c16-b5e7-438e-b804-87dc1c7b6cbd", "value": "12288:FSdGuEPgFaX2YPeynCHaD9B0kQv3YZtF15kjHPtV:EEuE52YWynCC9mkM3tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195035, "uuid": "eb8e7ff1-a2b5-45d3-88ab-d56e0f5533a4", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195035, "uuid": "4410060c-cf59-427e-8576-169120628321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195035, "uuid": "73f9a837-a0c7-45ca-af9a-6b67025377c4", "value": "22881419a62cd516446a8f1926910aa68e66880322137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8896b8-01c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1770206946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206946, "uuid": "7d857b73-9220-4805-b228-c13f19f81210", "comment": "Malware payload (Arechclient2)", "value": "1691b78bc893f7cc4ee097858d225a7a", "object_relation": "md5", "Tag": [ { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206946, "uuid": "b58118e0-d867-4574-9958-8c4346f43ba3", "comment": "Malware payload (Arechclient2)", "value": "238c893322b9d399a8ea716c9a8dcece95381418665c9c38911c1fa4ec9cf65d", "object_relation": "sha256", "Tag": [ { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206946, "uuid": "b4ceaba2-9c3c-4e54-9bdd-2efd608973a6", "comment": "Malware payload (Arechclient2)", "value": "69a7aceaba9507b106f07650e95301a6ba1f84b7", "object_relation": "sha1", "Tag": [ { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206946, "uuid": "cd6a5be4-793e-4e82-ba64-6d6f5d68d6e9", "comment": "Malware payload (Arechclient2)", "value": "bee43e578924a8684112ddd05ac913fd8d39492c39e1e44456a2e31b25a1bfc2dc149330e5bf430d7d9f503a2acf9a91", "object_relation": "sha3-384", "Tag": [ { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206946, "uuid": "6d41d096-bfc4-4fd7-967f-373431f69232", "value": "T1583733B1C63B514BE83FA274EF18A51D60B063179BF0C227E95641F26CB39A18FF4619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206946, "uuid": "b6a8e26e-30e4-4b8e-b91d-8c667bc9df27", "value": "393216:+iL5AU239jHIHSnKMcLhEpUIHp8TdRY0N4J1AZNTsSGRbAP3ZENewtHg7GLUosJn:zo9MyH0IHORHN4J6TqRQ3ZWewtAtxYfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206946, "uuid": "e27d6d67-e1fa-4be5-b011-2c61ab4a01a2", "value": 23923240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206946, "uuid": "9810f852-e7f5-48af-90c7-f6a8711938b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206946, "uuid": "3b62788e-be6e-4c98-acc0-61b25e6aba38", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fabf932-0195-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770187702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187702, "uuid": "875cc0ec-24c9-4c5e-9884-56761b350142", "comment": "Malware payload", "value": "0484a054958dda9c35a30aec322b9ffd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187702, "uuid": "e30a8caf-4359-4ead-aa5e-606c21da2ccc", "comment": "Malware payload", "value": "24e05f2e65d792e65b8a2b5f0badaf71bd2dcf547625fd48813c203df7c09ecc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187702, "uuid": "8aa5fb24-feae-4b6c-bcdc-6dd6bb99d491", "comment": "Malware payload", "value": "bc557a9f71db86b65af15dc61fc4485c010e3f5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187702, "uuid": "f814a00a-e533-47e3-8b78-8b99b5491c6d", "comment": "Malware payload", "value": "085c40fc6eb649cc34c77ae0ee7d4db451b674db9a61df179887db6812b571e716743c3662203b2ef2e67cef0b930eeb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187702, "uuid": "ecd818da-bcf7-4961-b2bf-4c1df9083178", "value": "T16A45D2D3E669B19B079E18DD811AF2669F0442A2FE359D4F789CC2C7897EF8D09C101E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187702, "uuid": "be8c8826-7372-4952-bbeb-5c8c7be02c23", "value": "1536:/Ak+aDalZ0ETMKWnKONZROKdDNYaOS8qafdCSZ3w8p55kV34p:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187702, "uuid": "14432f8c-0175-4feb-be6c-0c47a9a67927", "value": 1167282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187702, "uuid": "873de0e9-96df-42ad-90c1-380611bda393", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187702, "uuid": "75b3b7f6-32da-4671-b8c9-bfeee68c3c8c", "value": "purchase order49939915949.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2344a3a7-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770190983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190983, "uuid": "4757f3a0-3834-4cc1-960c-fd205f2b9510", "comment": "Malware payload (Mirai)", "value": "ce075f335628dfd1d04a0311240a545a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190983, "uuid": "50064b55-1315-401e-90d0-3540de6fd063", "comment": "Malware payload (Mirai)", "value": "251163674565c6a0dd9a9c1a2ae2670eebe4de708d424556c9d24515083de6d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190983, "uuid": "6db945ed-e4fa-4a09-8837-ab9f363b0f8f", "comment": "Malware payload (Mirai)", "value": "88bbc5f5c7e67730b062821d7f138e7a4ec4cfd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190983, "uuid": "42370633-05d6-4958-907d-effe0546a24b", "comment": "Malware payload (Mirai)", "value": "e62a1472f2375ee2b0f26fbaf3a4cd58d0b0fdf325a2d9b89acefb1746d0b072b92211925064aa474296cbc1c1f16b74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190983, "uuid": "389f9418-ac0f-461e-92f1-21105d8b3dc1", "value": "T1C0638309BFA51FF7ECAFDC374AE91745258C551A21983B7ABD34D818B24B21E05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190983, "uuid": "a5347489-1dd0-4f1d-b1a9-d8a7b9a6ef6c", "value": "1536:oSgYvXcVrQK9s2jyDINakg9E0heNRjqm7ZvrVla:oDYvXcVrQgj53me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190983, "uuid": "eb8deaf5-a10e-4632-b42f-7efa4956df1d", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190983, "uuid": "41c9d71a-c8fa-4e22-8b77-71b17dd3836b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190983, "uuid": "5e484481-9685-42e1-8015-6a707926a309", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cfcf45-01f1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770227139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227139, "uuid": "28c4e7ba-4f0c-44b1-ae87-f88ead8fb0fd", "comment": "Malware payload", "value": "ae3204da4f2f403499103ae137311106", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227139, "uuid": "605f2c30-8f13-4f47-9e97-f23ebe30968e", "comment": "Malware payload", "value": "25db9e8f7fa51bd00434cd0ed5ada9981d0fadc4147b56719c45206ea2568c2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227139, "uuid": "b27513b4-efae-49bb-b395-e41446aa5ee3", "comment": "Malware payload", "value": "a5f98a853da43254b94364f1a9993e8b94e327ee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227139, "uuid": "54cf01f8-a72a-41bd-9d14-69a5cfe024c5", "comment": "Malware payload", "value": "3d0383faaf7ecc4cca3aa5330e8780cdeb00c6de52bb201682e1d0de20da108ca6c5ac074cce6e4b94d545173a64f119", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227139, "uuid": "fd468c85-df8c-4f40-b507-df1895744202", "value": "T17584185056E90208E0B24B3DBA7AB3C059767658DF62D3CD0254F02F6E60A64D929F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227139, "uuid": "b059eb59-6fd9-4aa1-9271-79729bb8c493", "value": "48:9oEDugLfxUyoxqNBPEP23hbXKX75fsNNBPEP258Cv:nBfu2KP2te5fKKP253v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770227139, "uuid": "3af52284-03ac-4142-a1bb-a64e1b3a1c55", "value": 380779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770227139, "uuid": "13d9c341-2bd4-4744-8603-6db21358cbef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227139, "uuid": "6e83acea-d012-4309-9a18-a54354c67a82", "value": "pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5295e38-01ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770197697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197697, "uuid": "0b3c9cda-b799-45e0-8ad9-5651ec743149", "comment": "Malware payload", "value": "fc3c26e0ad9ea5622bef527c5b2c553e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197697, "uuid": "7f9a4707-e361-4113-bbf1-f7570d9b5cf5", "comment": "Malware payload", "value": "26828f22f3c215fa8551ccf532c452e90f495e7f115d6a519e74112e198878ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197697, "uuid": "449a5eb6-547d-4f38-85e0-8db11d92da5e", "comment": "Malware payload", "value": "2c732d4ed42332996437c7f363e7eb71005c5de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197697, "uuid": "fa92b8d9-aaef-4162-bf2b-657180114ae4", "comment": "Malware payload", "value": "396f94a95ec1c0f4250ffe6959824137280709aee7959ad3a8cc374b905fb9c726503812243085c920d1e85ac931c8be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197697, "uuid": "3c2c163c-6230-4b2c-a942-447a1bb3a4c9", "value": "T150521A08A748427EC6BE0B759CB397044678E38B9903EF8F6DCC91CE5E26BD946117D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197697, "uuid": "0e7b34f7-2290-4ee0-9360-d426bdea9a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197697, "uuid": "2230a2ca-21f5-47a2-9f91-2e15e2955c83", "value": "192:rJqYMZI8pv6ibECRconrdb/iv1r1HW1199Cbs41QzJVIv+IoUMqnhX7s6Za:wY8xp93rdb/iv1R21199CbedcHoSB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770197697, "uuid": "3fd7d9e2-44b0-45ec-aefd-9d11c713b8d5", "value": 13517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770197697, "uuid": "202bf015-c1a6-4cb7-997c-1b2ce9967211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197697, "uuid": "b9deea5d-d121-4e0b-b3b4-61287e7147db", "value": "fc3c26e0ad9ea5622bef527c5b2c553e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b929a6-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770219284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219284, "uuid": "da59da5f-fdd3-409c-9032-1e168f8af3b7", "comment": "Malware payload (AsyncRAT)", "value": "74c28697590531218ce7a300f94a3e90", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219284, "uuid": "0e2244c3-f0c5-43dd-86d0-05e08e0ab12f", "comment": "Malware payload (AsyncRAT)", "value": "26a816487d4089e09729bfa2fa769a8da2d1b8a7b064d64ac101b41afae2cbe3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219284, "uuid": "880fa529-c15d-4ef0-a0ff-a03bbf34f907", "comment": "Malware payload (AsyncRAT)", "value": "01de1e62c8f80192b060150631b5b403123ac536", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219284, "uuid": "db095953-b19c-44c1-813b-26bd840c972e", "comment": "Malware payload (AsyncRAT)", "value": "4341c8179193ae0ff26b30192b9d2ce6edfd503184f48a9d41989fc80fad4a61a1af2255348e3f9f78e4767d36920c3d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219284, "uuid": "9ffec5f9-686c-4957-8255-752631eeef20", "value": "T108535A002798C965E2AD4AB4BCF2954046B1D9372106DB5E7CC804DF9BAFFC64A123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219284, "uuid": "7539ccc7-4ef2-4cde-a64b-41922c4d5cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219284, "uuid": "4dc8b61d-2f63-4ad1-af64-775deccd2b91", "value": "1536:fhqjnRQ/kVJmVn+c/PDHdtRT18GbbDwfb4HG6cVclN:fhqjnRQ/kVCn+c/bZTCGbbDMueY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219284, "uuid": "2bd69464-2dbc-4d0c-8484-0e5fc0ad2bc8", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219284, "uuid": "111d74fc-5288-4ae1-91b3-ada2e1227d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219284, "uuid": "a85736d0-33c7-4567-a55e-64b5ea227a54", "value": "EdgeLoop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ebc91-0198-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189066, "uuid": "5727c80b-bec6-4e30-96f0-8045aa938e8b", "comment": "Malware payload (Mirai)", "value": "1b56852ff0aec0b642a356e1ac9bfd02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189066, "uuid": "1ea9ccfa-84cb-4e0c-898e-4a9515d0952c", "comment": "Malware payload (Mirai)", "value": "27c612b89a1c8865f7e97e1aab932f68a14b9c4688e634abca67dba8a2e0d71e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189066, "uuid": "9b335be2-e8d9-4005-a1e3-6947f1e86489", "comment": "Malware payload (Mirai)", "value": "3470bb89cb78762b374da1bae0c786d2beb0aea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189066, "uuid": "59e96ba9-b640-46d0-87f6-3b4e44f429a4", "comment": "Malware payload (Mirai)", "value": "2cb1df46ab7ede8f6a6d98f0d5f4a64a00157669ce14f07b734907e120dbbbf99483950c46cc950501812e66dedf5d51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189066, "uuid": "f327de97-87e0-4b27-9819-8df21a7ae82c", "value": "T18973840ABF651EFBE82FCD3705E51B06358C640A22A97F757934D828B64A20F59E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189066, "uuid": "6f603c19-5253-40a7-8468-25782622d3a2", "value": "1536:Y/UcsrJhZGLLoe8U1O9X62MUsMyEQZqF8ZJglQs83mX:Y/9srHZGPojUHU84X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189066, "uuid": "09257e2d-4e94-4d53-a1d5-a0f47ee676e7", "value": 73392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189066, "uuid": "5d5e0510-e090-4ceb-9c60-9fc1c473112d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189066, "uuid": "171d294c-440f-466b-a44b-827c6c4bf02d", "value": "Hilix.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a6dc31-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770200805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200805, "uuid": "f61b12c1-7997-42ae-8d6e-75de0dae3ceb", "comment": "Malware payload (NirCmd)", "value": "6092631cd56b090b74cae81b7bc71f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200805, "uuid": "328e4bd4-9796-4646-b70a-2c191f529646", "comment": "Malware payload (NirCmd)", "value": "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200805, "uuid": "36db57bb-5849-4f5a-83d9-07d01e34ee3f", "comment": "Malware payload (NirCmd)", "value": "df5b8cb878ebc445875789d5ba02b1cf8f010775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200805, "uuid": "18e4499c-1b70-4273-81d3-558f00a94a86", "comment": "Malware payload (NirCmd)", "value": "376fb186b6336cf1b181b2f74a0980e0b68eb92382cbb2c2dd6a33c2b26f89a96501c21f5b0b9b02186aa12d55448e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200805, "uuid": "c118691b-8bc1-4351-8217-c96b44164c17", "value": "T1790633017DC68972D47314F30A3997A2667DBE10BF34CDDBA7812A27F6760D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200805, "uuid": "e4cc9343-f0da-46a9-bc16-65387ca23e06", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200805, "uuid": "653ae733-2dfc-4efc-8c4c-39240c84ad97", "value": "98304:a4T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:X2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200805, "uuid": "468a62a8-1f14-4f79-b272-0799a399741c", "value": 3779612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200805, "uuid": "5c7a5cb2-5a65-4cdd-b018-3c1ade5e4c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200805, "uuid": "696388af-cba5-449e-8b93-a16d742287fa", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec1fcd0-020d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770239348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239348, "uuid": "1e3a73b5-a564-4a1b-a683-c24fdb73810e", "comment": "Malware payload", "value": "fa7d9b87122b51017e205a37bb862ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239348, "uuid": "b05faef1-8267-42bd-a01e-49bbfc2377ab", "comment": "Malware payload", "value": "28411836a36d2e80c251de2fba0ac8c10258c9a4a8b69dab2977e26ef0d657e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239348, "uuid": "6140a1f1-2bc4-4065-8fba-3a2b1958a754", "comment": "Malware payload", "value": "0351f96c3ca101cc799ee29a756fbb3125857b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239348, "uuid": "15b722eb-42e0-411a-b967-6af041c5891c", "comment": "Malware payload", "value": "3c7bfa2a9051fcef77da6f3b097aaf91fe1aeeb2df5c06f9b2890269d25205d91b33443859ee0611400d69b160efd786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239348, "uuid": "502104f7-6ed8-478e-9900-a3db26c56d88", "value": "T10755503318A56E8ADE8958BC502EFE4437FD5A6FB302EDFC82F8C39204995E51065C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239348, "uuid": "9bf52245-93d7-473a-a529-8b024f435fe4", "value": "384:9++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++F:YhEFF/ua1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770239348, "uuid": "0a5845fe-ff89-4d67-a5a0-78fd75ae3f7e", "value": 1285318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770239348, "uuid": "842b5546-7832-4054-83fa-86cb2125001c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239348, "uuid": "67847a27-854d-4ae8-afd6-28819c857645", "value": "as866sd7f623f72f76f67sdf676ds7f67df6fs7f6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037e1f9e-01c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770206821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206821, "uuid": "960ff6b1-2d32-47b2-aff3-01b068c655ec", "comment": "Malware payload", "value": "0ebad2f312c1cf86264e7d658786c60d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206821, "uuid": "4ae287fd-be62-4ddc-8b89-1f05b7d135aa", "comment": "Malware payload", "value": "28a43c65e7c9940ad3630aa56d657e6e1bc3e350f29be6ef671d447a13195fd1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206821, "uuid": "fa87272d-abf6-4076-833e-ab33fb22958c", "comment": "Malware payload", "value": "a207c71826587f64e6cb0982ba1691922bf3583b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206821, "uuid": "7fb28fc6-d6c2-4f36-872e-59ab87386290", "comment": "Malware payload", "value": "0cca80446cef27ed61158a79e6fe0d56e0853628a2e0dc2cb7490dc4f0e50f0bb96f250629099ee02c89bf60f5d10625", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206821, "uuid": "b2f1706e-760e-4caf-af82-5479f6b4c92e", "value": "T12ED1965BA92BFE648FCFC55708192D6A397904B0FD80C76E251979B0E1593BC24FC09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206821, "uuid": "b3e91636-3f48-4ccf-8f61-ae8da68d5847", "value": "96:v4ZQiAoIIr6cfZtzjtbbuoXhVNe71uYjyx/iqxKcBw+UdRBBCTbxZzIRc5JTdxHR:v4ZQiAoI46ohxXRBxhl4B+xKRmJDRFQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206821, "uuid": "0ef19c76-de2d-4b9e-9a75-9fa69c49fa48", "value": 6632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206821, "uuid": "3b9ebae0-c57c-4b08-87b9-ae16372f6e4d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206821, "uuid": "6c5b7eca-d19d-43d7-93c6-5c0a98d10aaf", "value": "SystemUpdate_594.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d31a13-016c-11f1-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1770170097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170097, "uuid": "a878c8ee-b84f-4912-a441-bed417ab9d06", "comment": "Malware payload (XenoRAT)", "value": "f7dae4bd05bcf7bc8dc041abdfbbe5b8", "object_relation": "md5", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170097, "uuid": "6216395e-bb55-4499-ab0f-cec87c720116", "comment": "Malware payload (XenoRAT)", "value": "29295f7e090d0548a146ec1b9ed8b19235d65470e5580059c2ee99508ada3593", "object_relation": "sha256", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170097, "uuid": "c7620dc2-7f1c-45a8-9e55-29e1ab91b1e0", "comment": "Malware payload (XenoRAT)", "value": "7908c2f542f0596439b4cd07a6442a9ec3ab3c8c", "object_relation": "sha1", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170097, "uuid": "b889f675-140e-442e-9bda-0c1cdbe69024", "comment": "Malware payload (XenoRAT)", "value": "22bb498a7e7cf4b49cd0a55db37135cc64dfc50d7f59ba49d1d020e185ccda7f7cbea55094412e73c917971f20012c9b", "object_relation": "sha3-384", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170097, "uuid": "e2d7c726-6500-4281-9218-d934a2c4dfd9", "value": "T10592D0BE70D60B90C33A40FFFD5C047502B50E866B5D692B729895877E254846BEF077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170097, "uuid": "d5fc15e3-0450-49a9-8af7-b62f715fe73c", "value": "384:nPswGC3/SSes2L4w+9f10P+QzFTL72U9yuWIZ48WQkxe4vPiiz:nUwGgM2f1i+GL72u6FD9iiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170097, "uuid": "d19c6659-f1cf-4d36-81dc-81ad972dd4c4", "value": 20849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170097, "uuid": "ea4c71b7-8ef6-41de-9331-8200711069a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170097, "uuid": "75e92d17-07e8-42fa-8a69-85036da8641c", "value": "chrome.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5197b99-01be-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770205401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205401, "uuid": "cfb30da1-4cc1-4a5f-ba03-646bbe474479", "comment": "Malware payload (Vidar)", "value": "f384a7bc0f2e90ef829c253f9a99af0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205401, "uuid": "7681d6c3-33c6-483a-b7b2-d70a375c900a", "comment": "Malware payload (Vidar)", "value": "298747cc1e1d7e35bfba1a6512562a8e5b8e8d2863bf3a8b9d6072a0277c83e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205401, "uuid": "92579f82-2dc5-49af-8d3e-b0a4ab80a12f", "comment": "Malware payload (Vidar)", "value": "6ae4168c03d441116977fecb0e175360e9f70fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205401, "uuid": "73e3fe89-2d02-49cd-a615-ced2c6929f17", "comment": "Malware payload (Vidar)", "value": "6a266374ba97df9f0d990acbbf0b9933e9949b4237d1989c4b3c874326896bf80eb4f556f995956ae066ca11c8f5be13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205401, "uuid": "c047fb01-173f-49ed-b6d4-9ec8215f9e87", "value": "T12F1649527D90C679C69BA239E97052C1A330F844077126E76F552AF64E3B7C80B3B72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205401, "uuid": "1bf0d516-ab18-4df9-a891-793b6e730aac", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205401, "uuid": "2b5a011f-143c-460f-996e-0f4f24b7ddcf", "value": "49152:rAvlTFJrb/TQvO90d7HjmAFd4A64nsfJ5Z/a6P00ibJs3gf5X5cT4hujxW4Xe7KO:ELW0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205401, "uuid": "f3dd0a1e-c886-426f-a8bc-854d32c7be69", "value": 4041856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205401, "uuid": "ac98de00-0995-4a41-9f52-f42a2b4153b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205401, "uuid": "f3cb344d-b6f8-4dfd-a3bd-f4a336d5128a", "value": "S\u0435t_u\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a4e75b-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168278, "uuid": "530e8efe-21c4-4443-9aef-d9f0040a7275", "comment": "Malware payload (Mirai)", "value": "2fa46593aa41f23cf0c1d0194d15604b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168278, "uuid": "6b1ee0c7-8632-4d5c-9fc7-1fdd10e29778", "comment": "Malware payload (Mirai)", "value": "299565c76c93e224d6bd5cbcfc05ac42470f56e5c2ceebbaa07b28913c68d30a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168278, "uuid": "6463f057-b38d-4538-bfcf-f9565ecc1e12", "comment": "Malware payload (Mirai)", "value": "4d4e090157fcde0316aaacb8a29b4dc816da7f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168278, "uuid": "d4adccf9-9d82-4306-8930-ec16df735f55", "comment": "Malware payload (Mirai)", "value": "1bae9a7e145a30bdcd9224306c2805278153c55990efc996c6830f5ae1b2f2b73bfd08a54f00633fe80b442f29f194f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168278, "uuid": "ed2324a9-7eaa-4496-88be-545fbcf5ad8e", "value": "T1CCD2E12CD99D7D05CA9D3EBA10DD96B5398CB4C0A35EB68E17268448B617E8BBC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168278, "uuid": "b684b27d-effe-4600-a70b-034001494552", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNkUSjJbUWUD:kbDs06t4BEub4sU/MbUkXYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168278, "uuid": "db5b34d1-4349-4b20-9e0b-b161c6b2918c", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168278, "uuid": "304617c2-0bc9-4ba6-aab0-20d0c7e7658b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168278, "uuid": "5c44fd96-e591-4e61-8a0f-575316b30b2e", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9dbcc4-0196-11f1-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1770188239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188239, "uuid": "205bdd97-9f2c-4927-83ef-2b218e32bccd", "comment": "Malware payload (VShell)", "value": "eed1d5b10e6daf26d5e90280b9632afc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188239, "uuid": "c9ad7a37-4548-4e2e-9258-1790c0d969bb", "comment": "Malware payload (VShell)", "value": "2d292610e8849abf770da00fb14a65279072097d3c05aad40ce6d126aaa9c345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188239, "uuid": "41cd9f16-49f8-4a6a-a301-4a4174b6d30d", "comment": "Malware payload (VShell)", "value": "ff266ec3a21fb725b918f4a82e0a9fe96129ec7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188239, "uuid": "f04e3dbe-02d4-4e16-a405-cdd4927a49f1", "comment": "Malware payload (VShell)", "value": "3a0b95319c2fd62af108ba1ca1bfb1777057b5fb52e668e7118ef12d05259db5fec27b748840febd1e76722d480fe871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188239, "uuid": "678ce8f8-1b12-42c9-b09b-e84218739e2f", "value": "T12E024007A1D0CE3FC8DA53388467122472B794BADF629727064825B63E427E81E6E75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188239, "uuid": "af18ba1d-9906-44e7-bfa8-0164551003dd", "value": "96:GqTVJWWGXzS6vH5ML09V1J9G8YmY+hrsrwegVekrf7mxaamBFBp8sBRr:GqnWWHUZMWT1YmRhrsnurfjTr8sbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770188239, "uuid": "12311831-9c44-4113-a9c0-10f99f345ebf", "value": 8666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770188239, "uuid": "666c1d25-f412-4537-ad99-7fd91ee2b2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188239, "uuid": "b2c084e0-4490-4aec-8645-603b2b55eb93", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444dea8b-0187-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770181590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181590, "uuid": "d31c5c21-8fb2-4e62-82d3-19f48fc1c945", "comment": "Malware payload", "value": "1c0674f4979816f3f30373951236ffc3", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181590, "uuid": "ab0cb4d2-54cd-473d-970a-be9ba58a0bee", "comment": "Malware payload", "value": "2ecab49fc9d2278d632a039eb330447a2225207c6d1d184416360c7797fe0a3a", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181590, "uuid": "5baf5b25-8efa-4e44-8537-c3a667edf5f0", "comment": "Malware payload", "value": "55f4f7adc909259e534070d8831d9858112da6e5", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181590, "uuid": "fe98c450-0f3b-46b4-a466-8038b8c156e5", "comment": "Malware payload", "value": "a99e9d2ce1f43162eaac24fd96cb0f0f95c61133198ffe6634ae6a507db8e2d8dad536e61405fa80994ec3e2ca0becea", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181590, "uuid": "9d31e768-7825-40ac-b7c0-eea8148832a3", "value": "T1BD02BFDABEF092D268F0DFDAD31ED64A2BF5EE7C27E0A610A095030F464995B90153E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181590, "uuid": "f32909e2-d5b2-4369-884c-df6bf8878642", "value": "192:s8NXirMoNPu0cbF/1HvfpoPeuvDZ9i3XrevhAuALh:VMo0wx1HvxoPecNGXrwDAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181590, "uuid": "78f0dbc4-7e8e-4505-a41e-3ba6cbdd8984", "value": 8652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181590, "uuid": "2d62ecab-2c31-4447-a587-25e748671e11", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181590, "uuid": "857dbc02-fd3a-4c15-9072-dd75f96ef1dd", "value": "2ecab49fc9d2278d632a039eb330447a2225207c6d1d184416360c7797fe0a3a.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918aa6ef-01ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770226387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226387, "uuid": "26a8d8df-e2e4-481a-8635-8a16e96706c5", "comment": "Malware payload", "value": "12f1b0d9fa2a0e8ee2259b394c8decc2", "object_relation": "md5", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226387, "uuid": "f7966a91-6c10-4608-af8c-55e99b7094b8", "comment": "Malware payload", "value": "2ef8fe84c9668685595eb363d106c9e14fee93176de50cc4405d6e7b32e35e76", "object_relation": "sha256", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226387, "uuid": "3f6a2ea3-eefc-4e06-b4c3-2f52427bb883", "comment": "Malware payload", "value": "4de360802c03a2aedb81480b23c45ff5ec85dd3f", "object_relation": "sha1", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226387, "uuid": "67a3f2fa-a19a-4e68-b849-c1ead431f2f8", "comment": "Malware payload", "value": "a348a2bebc4732e3978cccb7831f6af23e5042dc0daabcaf1644e32a590608f1b408ec6c6f7a0144823ff2204b62b206", "object_relation": "sha3-384", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226387, "uuid": "9d04bd12-02d2-4973-834b-64111de35e2a", "value": "T131C55D203FE6F444F5AABE3A45E9B7945776E2123F06E79E2280515F7E2E94CCA001D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226387, "uuid": "f3b42d16-9b99-4ba9-93c3-221bb9b226a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226387, "uuid": "3f20c52d-8a01-4816-83ed-c6fb0a534f3f", "value": "24576:Z5dbWF0W1UI3+NVjhhU1H9mjDgQlaX81bx82xDZ5pFrT+DvooWyZrS+P9DlV6IlV:6+laX81bvlZ36drdPjplNAHX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770226387, "uuid": "f5e1d898-ffb6-44d1-bb49-c5537cc271bf", "value": 2666016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770226387, "uuid": "e825a138-a32d-42d1-ae8c-45a6417ae845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226387, "uuid": "56b3bd9a-175e-41c8-9c26-007aec6342c2", "value": "2ef8fe84c9668685595eb363d106c9e14fee93176de50cc4405d6e7b32e35e76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd80594-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770200829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200829, "uuid": "a49bf66c-bfa5-448f-a92d-aa273b3686c4", "comment": "Malware payload (PureLogsStealer)", "value": "83ceeb3114348090e069f49e980638aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200829, "uuid": "36786e08-6a94-4bb6-af29-352f0cdb3edc", "comment": "Malware payload (PureLogsStealer)", "value": "2f9c958bcfe1bfa7fa0f1a0cf563cc032a4da1c6571bfc5121559e0db84d8166", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200829, "uuid": "1b566de6-10f4-4116-b6a9-e4f3176627ad", "comment": "Malware payload (PureLogsStealer)", "value": "5d50d398dacb7ad2276a751a4786b29d6d8a02d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200829, "uuid": "eccdee76-45a5-45bd-a0c4-9cbcfd56fc18", "comment": "Malware payload (PureLogsStealer)", "value": "9ec56be41b2001bd8fa28baf7dc4a0b981d3dae24fd32913a654cb2fee0bf6924d991618a0413076e0ef8f1cf8821f24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200829, "uuid": "4ff95ad2-95a7-4ffc-bd6c-ae28064f9025", "value": "T1E8461260772122697055B607276A21B79A00150F720F68FD6D78C7FBF87DAEE8E80736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200829, "uuid": "21766dc4-b5c6-42b9-aa5d-ffb5745a5719", "value": "96:2P0IK00IK8Jc4m1IKjRxZewZIMIR8tdozzCB80doE4fzwjDfvahRdcoLjwoMOPU+:W4lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200829, "uuid": "2c4809cb-e058-42ff-b57a-77e3b1eb46e9", "value": 5665176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200829, "uuid": "6e303cc5-1c36-4362-8b89-74e443f68cfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200829, "uuid": "535c9a0f-e168-4ad1-8b57-3066205a062f", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21daddac-01fa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770230924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770230924, "uuid": "e8a3abd1-54c4-4e53-b186-612c22134532", "comment": "Malware payload", "value": "6328268129ba2d077eaf9676336c50e3", "object_relation": "md5", "Tag": [ { "name": "daveshell", "colour": "#11C42E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770230924, "uuid": "f763f8f4-4d57-4eee-bb17-309ccd3a9558", "comment": "Malware payload", "value": "2fe53f0f4a54c90344b2e436f518e68215293be1cf50af37df9710cf8c6f8f73", "object_relation": "sha256", "Tag": [ { "name": "daveshell", "colour": "#11C42E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770230924, "uuid": "5a894d10-f0de-48ef-b6c4-57044b741e7a", "comment": "Malware payload", "value": "701191f6b4ba138b9b993d52dff4b2160096a388", "object_relation": "sha1", "Tag": [ { "name": "daveshell", "colour": "#11C42E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770230924, "uuid": "068b0d63-a83b-47e1-901f-522a608cfd2e", "comment": "Malware payload", "value": "acf117c09422bb49633a2c5a09fa1312b6df0475221eb4ef3fa8fef669fce3f0f6c10ee10690f38e0af1d94d6f763775", "object_relation": "sha3-384", "Tag": [ { "name": "daveshell", "colour": "#11C42E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770230924, "uuid": "277c899c-e351-45a2-8e52-41224490adfa", "value": "T1EAA7339C9CC2B3999E3112641A0C6983ECE5D86CBC378686DDDE7B3855AE670032DC5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770230924, "uuid": "0a955c9b-72b1-4bef-a85c-438d19867996", "value": "786432:a/xTv8BvHwL7mOdbpn2jHcW7b2swYv8Vt9UmDhMLLxoXAJZ7WNMiyoV:+x7evHwHHbpnmcVs8VnGxYrMipV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770230924, "uuid": "a8db2b81-40ea-4b27-871a-28a74f472f46", "value": 44630633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770230924, "uuid": "ae86b0b1-96cf-4bd3-b116-22c1c992bd06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770230924, "uuid": "50bf47b8-f9b5-4b8d-be14-fcadb493d8d4", "value": "goaeglee.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc3785a-021a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770245040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245040, "uuid": "98ea7d03-2d36-4612-ab4c-d94ce64f54b3", "comment": "Malware payload", "value": "ab82281ae08c55870ff8d2361fa4bfa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245040, "uuid": "71c5cd9e-2fa6-4229-8d59-983218fdf865", "comment": "Malware payload", "value": "312ae8866f43fc1f36b92bd258a20c66d157bdabfb91d7a82f25d556194a56d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245040, "uuid": "e3b2d188-793d-420a-9ffd-915c4b3c2be1", "comment": "Malware payload", "value": "3828a4eab497c97b3e89c22cc28a62b6430305a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770245040, "uuid": "7b594353-090d-4826-8b97-c3af403b5ab1", "comment": "Malware payload", "value": "149c9b52e288aa33d7d1c5db3e245dae0b49049105fa5ff19489fd89e7b6271b24deaecaddeda90c23ebc85fedde88d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245040, "uuid": "e1e851c9-4b57-4140-b8dc-f9616b2e6cdf", "value": "T132F5F123E24EA73EE46A593609A29950583FAE60651F8CA3D6FC3D4CCE390501D7EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245040, "uuid": "c8e604a2-f9ff-4597-8a8a-21bcc3114da2", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245040, "uuid": "ad302027-36c8-4b1c-9281-4ba6eda79cb5", "value": "49152:InfhrouOHP5cR3uRpYzxqozktxrn4uncp5soapYGfA3zJe0/7nO8/FirbaKs:InfhrIvWR3uMooQbnoa2r3zk0/Fgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770245040, "uuid": "8d601a2c-1a74-4b1d-8757-8bae734b0247", "value": 3383792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770245040, "uuid": "63f7af11-74b4-4810-b9a9-9c357bd21f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770245040, "uuid": "cea19ee7-02c3-4a89-996d-1d73fcd47d52", "value": "ultrakill_cyOk-O1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26138962-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164359, "uuid": "d4be145c-f620-45b8-9fe2-58948e53fe64", "comment": "Malware payload (Mirai)", "value": "e9ed57351aaec7a0b2419977d638e34e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164359, "uuid": "db5774b6-bf33-4dcc-acdc-bb3a636f5636", "comment": "Malware payload (Mirai)", "value": "318eee827bb392cdd0511671bd6c871ee8ba678f2c2f1611a11727280c807b5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164359, "uuid": "c1ec2378-82c2-4d03-aea1-64457c3d5280", "comment": "Malware payload (Mirai)", "value": "a2de8f99f307ccb4e51d380f64eee4a16ce09ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164359, "uuid": "f7233df1-4ad1-432c-8f31-2d7824136f6a", "comment": "Malware payload (Mirai)", "value": "fcb198efeb393340fa6afce98f36edab7d28e745bd64817e0fd74bbfb6b9b707f0bc0fb8680eed5809d2d5bd1aeefac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164359, "uuid": "20aae7d6-6eb2-4652-b882-30dd17660ac9", "value": "T11B931986BCD2CE19C6D423B6BA6E219D331673F8C2DA7107CC145B28B7C925E4E37A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164359, "uuid": "78631b2a-60d3-4a5c-9756-fc68235d2c97", "value": "1536:z35OSCjfi0ddVuxOP5oTfvhvKy2GpDx5gd6Ge/21VykO6p7Ekmng27YCm/dDUOwR:T5Cjfi0d2cP5SfvhDOd6fQ096pGNcDdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164359, "uuid": "52c1323b-aff4-4e2f-9fd8-eee47b4b523e", "value": 95680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164359, "uuid": "30f3645d-1629-40f3-ab01-4b4035ee9fd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164359, "uuid": "c9179405-20b7-4aeb-9457-15459f4c5bff", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e2255a-01c3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770207522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207522, "uuid": "df826f99-001c-4e1f-ba91-c32b873cc33f", "comment": "Malware payload (AgentTesla)", "value": "6d8c0a837540a3366958114e8bd4a2c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207522, "uuid": "a8ecd521-b641-4d84-8e1c-c4e456c379f5", "comment": "Malware payload (AgentTesla)", "value": "339a2266533304573cdeb1138bca268419acfdebd5767866df313cb6b078399b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207522, "uuid": "b2824da5-b690-4b12-94bc-b8146211d4c4", "comment": "Malware payload (AgentTesla)", "value": "efe2c6824854b0009e15fdeaf0bee762f450a4fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207522, "uuid": "1310abc0-3379-4e2f-91f0-8bca737fb850", "comment": "Malware payload (AgentTesla)", "value": "8a7763e73afe1a929052d708847750bcd4f69a9da2c0a08b77b21d24383f2c64165c7695dd903621bd0f2d283d290ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207522, "uuid": "d0f7f2f0-a36e-4524-b563-6d8e5b2ad7d6", "value": "T1B6D4238254C4A995C29023708437CC9459B93D70BE02B33FCB2DFA6E6CB0397BA6765D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207522, "uuid": "2bf6b0da-c50b-49c0-9bb0-95767c2727eb", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207522, "uuid": "9dec6e86-7895-48b1-96d9-943eba9a76dd", "value": "12288:Gz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwD3snZofP/5SiiYTDyJEO8n4afAh:Gf+iN57Gtene3PRsYaJEO8gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770207522, "uuid": "a1937987-8a9b-4724-a8f5-a15d73efde2b", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770207522, "uuid": "1cfbcebe-6ea5-4ca8-ae5e-5cce1cf06c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207522, "uuid": "18c7ad77-56b7-4e1d-9f2c-33b98e6e4efd", "value": "339a2266533304573cdeb1138bca268419acfdebd5767866df313cb6b078399b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0b5cd2-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182116, "uuid": "e6f27a95-60c2-4f02-a72a-f6aa2de77543", "comment": "Malware payload", "value": "2d1612dfa5486811fbeb0e13a35519c7", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182116, "uuid": "0d7fbd08-06d0-4896-862e-fd81992a1494", "comment": "Malware payload", "value": "3438a8b4290c800beeb7a72c23c4d4a046bb8e171f844b7f2989a830cd8f9289", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182116, "uuid": "893df3fd-bc27-47d5-8976-432b61a0a8a2", "comment": "Malware payload", "value": "951c738e06b78b132e55f4036c00f968d16567ea", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182116, "uuid": "67d7bbd4-81fd-409f-a1df-f1bb4c7f63f6", "comment": "Malware payload", "value": "bf4d9701654a8e2ea66b49f89a52bcd76f0a2a9f029dcb4c89dda2f5cdae8de6d65ba9c4914bb58fdb5a6847e6078034", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182116, "uuid": "31daa1dd-e66b-41ae-8564-406aa4193086", "value": "T13151D3006AE622C4B1BB5F5557FAB0E6097AFD68AC39DABC1104894D4771E848C36F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182116, "uuid": "a24501e0-bebb-4fca-a7b1-f9c8af6ed91a", "value": "48:kmyqVah6NN3YXnYY5iNj1jMG2Chj0M+9rRajZXtDVZXtDVjdr8cdOrwGHVVVm0Fd:jAsVgY0GC+0M+9kjZdDVZdDVjdgmqRH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182116, "uuid": "db130bc9-4ba0-48f9-a0ef-96e51aec395c", "value": 2958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182116, "uuid": "c0363a5e-1ff9-458f-90e3-b20ee84ed607", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182116, "uuid": "233ade8d-419a-40be-a746-e07365905976", "value": "3438a8b4290c800beeb7a72c23c4d4a046bb8e171f844b7f2989a830cd8f9289.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49242aeb-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168284, "uuid": "67c958ec-b35e-4f71-a5c6-08d34a7b0d5a", "comment": "Malware payload (Mirai)", "value": "41cbe004428843a6650b99dc9f77d009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168284, "uuid": "dd898512-017a-49b1-a0a5-c2df3b69106b", "comment": "Malware payload (Mirai)", "value": "3603bc35c28a61b116c561504fcf4199268bab2cb36821f75a3f7ac4818902f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168284, "uuid": "418001f8-8fbf-4c3b-a2b5-bb644f74d5ec", "comment": "Malware payload (Mirai)", "value": "9a0bc86dfdd843565f835721076f78babd6a8ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168284, "uuid": "c3b56402-8423-4d86-ad8a-394090bece95", "comment": "Malware payload (Mirai)", "value": "c4e8a34d9778b18b3287dcf70f1966be013ccc0f328fb4603218bd1156d5d7b50f5e0c35a70ebbbf739111f12b91becf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168284, "uuid": "fd15de19-f92a-4833-87f2-1780162475b8", "value": "T18AD2E18976D353FB8C8DCA7EB65E403A30DE78A5A6B2D323B301D5530726180E655E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168284, "uuid": "7f5564e0-5ee1-4601-af0f-3c7ff6dd076b", "value": "768:WlxKd2FLPxEnspd6IHE4RlY990JMtupmG:Ld2FTnplHEw0auiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168284, "uuid": "cafb84c1-e37c-4626-84f7-9c919dd1fd05", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168284, "uuid": "6aeadad3-1978-494c-a348-6ad6d0a42f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168284, "uuid": "4153d9e5-60be-4a68-ad16-9d35cc9b0ddf", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89756e2-01a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192630, "uuid": "23aeedf9-37e2-417e-895d-10aeb028086f", "comment": "Malware payload (Mirai)", "value": "e186d25124b81dd6f1c0c30b43612150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192630, "uuid": "3f5322d5-955f-458e-8c12-823797b7b60c", "comment": "Malware payload (Mirai)", "value": "36468c20d264ea58e811b26112b17355c610f9e800ef5a2b6ab660ae28da7c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192630, "uuid": "7acf6cd3-78b0-4bdf-aee6-3576e79f595b", "comment": "Malware payload (Mirai)", "value": "8666581b385d0f3f3d75b192ca8d9f4b5d5ddfd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192630, "uuid": "2db2e267-4b6e-4c0e-9293-c23922e07cff", "comment": "Malware payload (Mirai)", "value": "b100a0e71269dd93c3f1ee867370baeafbfe78680735ec2a8d4b88430c0685fad9e17d78388d4e1a17122ac81e1f1e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192630, "uuid": "efa06654-a2b7-438a-83bd-865b7a7aaae2", "value": "T1A732C517A7BBAE1BC4D027771193072162E95F916024472F7D0D1C8E6E9A3412E3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192630, "uuid": "0153882f-ade4-4277-be35-15eade31fe45", "value": "192:xvrOR1CQOsz1NxfAz9H9iG0GhWaDpU/O7Q89AGSybfqeif:xvrbCzfa92GwIU/kwGSAUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192630, "uuid": "90d4a1eb-a9ff-4348-894b-bb238a79ba9f", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192630, "uuid": "86125726-61ed-4609-9ea0-70742ef6b597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192630, "uuid": "66b15cbf-a009-4fe8-9b47-c676612ce10b", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa27633-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163911, "uuid": "8461d43f-b588-4182-b2af-3e8be8126b6c", "comment": "Malware payload (Mirai)", "value": "ba1da33e785667a7c974cf201842131f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163911, "uuid": "90ce2d85-4929-46cf-bb1d-e2199598ac12", "comment": "Malware payload (Mirai)", "value": "3827b451ef2e340544ddc982fb95e1374e7855af91b390c6990ef41f32c534df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163911, "uuid": "74fdd138-64cd-4b7c-b6fb-1f080a28a24b", "comment": "Malware payload (Mirai)", "value": "e3542df9078fa751aa997e2b7f4a593fc9349bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163911, "uuid": "eaf52c97-451d-4438-bdfe-30a8095b03a7", "comment": "Malware payload (Mirai)", "value": "2de7915d3b0884b6425432ebc6c39c073d9db1ef02d0d99b9e0c72f7fcc578e125126f0364a3e84a909def69090ad134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163911, "uuid": "39adb44e-d972-4292-b60b-861928ff0434", "value": "T187A31270D184737AF37CD83745BC064B29EB0EF4868F6258371AACD1E950B4B16E715A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163911, "uuid": "11065f4a-d5ff-432b-ac9d-687198bcd3fc", "value": "1536:Z5XtVlB/yLQ7iLSPCxpifLyoKmpckdXhAQvoH72vtogIWKfiNNI/S8nJDuV+LcXR:Z55B/WQ7iGHy+9Xu4s7Cr3Kfib2JDm+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163911, "uuid": "b42cd6ba-6629-41e0-a46b-e18cb4772c21", "value": 98044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163911, "uuid": "740b41a1-d775-46b6-8da0-a89686ecba84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163911, "uuid": "38c262d0-8565-476f-8de1-73df6ec1ce9f", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c72cfe4-01ac-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770197441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197441, "uuid": "e0258ae5-252f-430f-a3bd-6f7d289fd7fd", "comment": "Malware payload (RemcosRAT)", "value": "c92ae00736f9a249533c980d7f5a5d5c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197441, "uuid": "f4930356-0dc0-477a-afd7-a148119f6b0f", "comment": "Malware payload (RemcosRAT)", "value": "38c41cc8ae7a37a03db5919d8972d76fd7c8aced886fd25c1ef912927e5d8df6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197441, "uuid": "76bac3a7-63ab-4eb1-909d-7108a89a6e3f", "comment": "Malware payload (RemcosRAT)", "value": "48f4be93a4595ae56f4b37e0b65e727b3bbc0660", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197441, "uuid": "5ee5d093-c83f-4452-927d-cd4b23b880e9", "comment": "Malware payload (RemcosRAT)", "value": "4c6bfae2e70fb27fce2f58ba48ce4851faef0f1cc13595b21e7538a97964899af8c14470fb6a3102f0a559d0dd724840", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197441, "uuid": "3cf13924-3a56-45c4-bc38-cc3748ccde15", "value": "T10873A330CB552FD56D7737B9AB02755881F983810D321D91FEA80609763EC98BEAF2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197441, "uuid": "fd6f8ef9-5cc7-48db-a0a2-79c6c10bd49e", "value": "768:v/Yp4KapwUZxkZBsaCZ8QYJWH9JZcKV2pMCfobuDCCurJPwk1gvhqUBi/y6+vi:v/NKapLmsa28Pk3+w2ptfNuZ1d6AyPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770197441, "uuid": "97f702e0-9d43-4fc5-94be-a1016059ca29", "value": 75822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770197441, "uuid": "f7f220b0-3801-41fc-8ca2-cec7b54df099", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197441, "uuid": "0304a4d7-e47f-408b-94e7-0c6326a5277d", "value": "PO221000004931-pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becbdd20-01c3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770207565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207565, "uuid": "4cf4a421-864e-46e2-9393-b8b813fcd308", "comment": "Malware payload (AgentTesla)", "value": "b0ed2073206a7ba7b047c370aa398ff9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207565, "uuid": "87876bb6-6c97-4c87-a9c8-588b2982a9bc", "comment": "Malware payload (AgentTesla)", "value": "39e885110ea41b64da0597e267754cf951b6932d52a956e47d35e3fbcdbf0281", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207565, "uuid": "9408d704-7e75-4925-9cc6-5712ddf85eca", "comment": "Malware payload (AgentTesla)", "value": "370c4cdfb52b2a5ddeeeb350209f5a7a6e1e064c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207565, "uuid": "fb64cc67-9cbe-44e0-b64d-90bdccfc9532", "comment": "Malware payload (AgentTesla)", "value": "76c7f0a42ad75d265f60fdaf9d37756a93a3e07bbf9fc8b568a00b520dd9c560ff0e3b27ad8c5cb13ffa79101cc3abfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207565, "uuid": "625ccc03-a6ee-4222-9bc3-b0fadf4fd501", "value": "T15235AE0273C1D062FFAB92734B5AF6115ABC79260123E62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207565, "uuid": "1dbfefc6-274b-4809-ad27-42ca223d6858", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207565, "uuid": "951157bd-2995-4d2c-83d6-1559a371c9e4", "value": "24576:q5EmXFtKaL4/oFe5T9yyXYfP1MAXDzReRsYaJEO8gv+:qPVt/LZeJbInGizReRgL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770207565, "uuid": "6e2fb751-e697-406c-9c29-a2b67040a9db", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770207565, "uuid": "7d6de34b-0aad-469a-85ae-fe5b40895e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207565, "uuid": "1344496f-224c-4f3b-9fc4-446132de1126", "value": "339a2266533304573cdeb1138bca268419acfdebd5767866df313cb6b078399b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f103a0-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770192682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192682, "uuid": "e957328a-779c-42ec-a682-e94186b02396", "comment": "Malware payload", "value": "17303c070fd6660cc0c5ff77aa9ec165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192682, "uuid": "e463da61-d508-4e64-a98f-b65cc00de40d", "comment": "Malware payload", "value": "3a551cfdbef648c12fc4b29e0fab9e55e9336c9493fa5df00869124c7aed970c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192682, "uuid": "528dff3a-08b9-4b0c-b860-6326eb06502b", "comment": "Malware payload", "value": "2c25685f79ab8f0c41344728087577a185650abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192682, "uuid": "337ca5e0-0ebf-4889-944c-4d2ac5596423", "comment": "Malware payload", "value": "f5261b756a779a31415b785566ce0717b428ded5d222e0d6480e48f8ad40dbd192a9040062a5cc5ee4d38919d542428e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192682, "uuid": "aaf1e0f4-de45-4723-af7e-706ac46c1329", "value": "T152C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192682, "uuid": "6cf4f5e2-68bd-4bbe-b39b-e62b2a3e60e2", "value": "1536:UPAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK39:UYFmSmviqS1Bs0+Nd6lAqktNMxSNbm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192682, "uuid": "3fd19962-1c14-49c3-afc7-f849a955c84c", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192682, "uuid": "36ed3c89-1bcf-4c84-b4f2-b91d4ea5530b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192682, "uuid": "17432c95-6698-4a6a-bc2a-6df564b7b037", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03c687f-016b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770169852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169852, "uuid": "2a72b770-1cb0-478b-aef4-c5a2158997ff", "comment": "Malware payload", "value": "537873b6e85ef04fc630d5deae56d7c7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169852, "uuid": "85e54757-5dc0-4acf-bb1c-447c6a7373dc", "comment": "Malware payload", "value": "3a6adbd06bd48c62fb2b9faadc9853318acfaa3920bfe041a29ac2070282c3f4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169852, "uuid": "e9b2dd85-51d2-4587-a219-3ee02e077736", "comment": "Malware payload", "value": "81dfea4c8d4d1ef692d0bd4271e8b18a240c6a22", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169852, "uuid": "22c4303a-b00b-488d-95e3-630c7c4afc1a", "comment": "Malware payload", "value": "a0a0abceb23de21db3a398103b3c08a8cfadd7b495f806fd6b69968ad9c5199d039f25c42fb518fd133b6badde0b63a0", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169852, "uuid": "3d907cbb-d9f6-4e1c-8a9d-74334ea02e3c", "value": "T106C523AE0BC50249E4BDFFB4CFB39036937176BCF5644B979A94106C4B2A5C09D26B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169852, "uuid": "e6e54444-4de2-486d-8d41-25b20fda9ef2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169852, "uuid": "bc009451-b093-40c3-9e27-76c335d74b9d", "value": "49152:bdYjhdYjVQDbsdlYmj0mUHLnmE9X8SIQK4G8pKEsGuDlk:bd8hd8qsdMrndBIiG87s7Dlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770169852, "uuid": "5fc0b22f-4ace-4acd-9e24-d4e1ac9b5176", "value": 2673664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770169852, "uuid": "e6737003-c26f-4041-8507-f08afbd0408e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169852, "uuid": "a94c2374-316c-4d4c-9b1b-6761d5f01626", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66406fbf-0207-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770236622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236622, "uuid": "2fe40292-c5c6-4b82-a2de-b398a7d7bd1a", "comment": "Malware payload", "value": "bccfa922d8fe362941f15bf396c3f72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236622, "uuid": "3c27be17-5932-4f25-a618-3f24b90fc71b", "comment": "Malware payload", "value": "3aadfa985191f3a6613f2ba62f97237630075bf6a2235033c351597257abcf07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236622, "uuid": "3aef278c-7c05-4508-a002-4ab2bcae223a", "comment": "Malware payload", "value": "774a58c62d20112c41d2ea15f619c37c27c76618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236622, "uuid": "55073df8-c6b5-4853-be0f-a44589521a89", "comment": "Malware payload", "value": "fa8869985a0c9fc73a9832524405866fb795c99999d47705cb348b9e3cc18561727030083283fc58296945d6867b36f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236622, "uuid": "f249aeb2-efda-4fc5-8fd5-ccfa140a7652", "value": "T1DAA30897B901CE7FF80BD6BA44E309197520FB660A530B76A367FDD3AD710D41922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236622, "uuid": "b97d8fbc-5b14-4d6b-b599-e8d621d26087", "value": "1536:KvjYRRhyBJWrYfmppHT/KhA8Fd4J8u0EjHHiqYzLbp2vtryj+uSw:KvkzYIYfmppz/Khl46EGfatryjrSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236622, "uuid": "590ef55b-5704-42a6-a3b7-d109e779e3e1", "value": 103504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236622, "uuid": "3648915c-990d-4f57-954e-87e7eb566f6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236622, "uuid": "d964b9df-30c3-48b9-bf0d-85e721487055", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bfaf5e-0188-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770182205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182205, "uuid": "b6618b1a-bf79-422b-89df-fffa40e30beb", "comment": "Malware payload (RemcosRAT)", "value": "001685109f5d60000de0cda25ce3a5c8", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182205, "uuid": "466e259c-4d08-4b0f-b2cb-70a17a623fe7", "comment": "Malware payload (RemcosRAT)", "value": "3b4a519c5bcbb946e1943f4fce04c50da4707f387cf63eeb458a7e04bef15cd3", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182205, "uuid": "f30fe496-aed7-44ee-be50-694370522e2c", "comment": "Malware payload (RemcosRAT)", "value": "f32abbfb13ac69247216ab9d711889394c3073f1", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182205, "uuid": "6dafd4b4-d6fb-4c15-aef6-327ba3595ee2", "comment": "Malware payload (RemcosRAT)", "value": "aa89a7a03903c82f25c06d8a5e680a672820bc85eebf918c4536c5f2fab14dabd8632cf6bd4a681c26062bf28845154f", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182205, "uuid": "6181b284-ed23-4fa8-8f20-6bee06c11d05", "value": "T1A3936A317797CA41C81527367CEAC2E72322FC619E6B2E0736447B0E29B7AD49E43617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182205, "uuid": "fa44420a-1996-44c7-9626-b3985ff1c3e3", "value": "1536:QOZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAmgSfMeNLChOOMc9ECzgcM3kiqsTEZcw:QOZ+RwPONXoRjDhIcp0fDlaGGx+cL26T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182205, "uuid": "8441e830-cfbe-469a-88e4-d3608d1300bc", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182205, "uuid": "2b4a4498-c425-436a-93ab-2f2fd5e9b6b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182205, "uuid": "ce4f62ce-a279-42bc-b058-fffe7a490e66", "value": "3b4a519c5bcbb946e1943f4fce04c50da4707f387cf63eeb458a7e04bef15cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676c4d85-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168334, "uuid": "e05e5e92-1930-46c1-933d-551b7209fca1", "comment": "Malware payload (Mirai)", "value": "d180baf8ece7a84da1f06c63ffac956a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168334, "uuid": "c12c254b-2623-446e-9556-1051d4f1f00f", "comment": "Malware payload (Mirai)", "value": "3b6236c4221f50d0a19240a08c237c63e90e1192697dafabe0e84dafc75128f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168334, "uuid": "49b9021d-459f-42ca-89f9-5bd8ddab521b", "comment": "Malware payload (Mirai)", "value": "5b92d59efe96b4541553474b382d9771b9aeedc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168334, "uuid": "5850e78f-7148-4b26-b496-53c215f092c2", "comment": "Malware payload (Mirai)", "value": "30b1aaac3fc2faba54829b09584db5c26c96df81b502141eb46bcb1ff136819302de5c47b1acdb8b86e72050b606c649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168334, "uuid": "7e617ec1-7019-44d2-83dd-041ffafb1f4f", "value": "T196631BC4F5C785F5C81B893860ABF73FCA32E57A80719BADEF8A5E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168334, "uuid": "2d3a06ee-3250-4198-b422-9ec1d2231d1a", "value": "1536:99IEpE5HVjXLoHRCVJzpTXwp49cuPbYAeWky81:4EpE5HVjX8HyDT0EcuD9bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168334, "uuid": "70159f1c-a89c-4222-9d8b-cce9be9ab62c", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168334, "uuid": "fbe3c670-1da8-4039-83e9-493760a99bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168334, "uuid": "9ed63f0f-460a-44a5-bbad-9f53a6b34510", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811bdfd0-01a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770195436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195436, "uuid": "fd84321e-ab5f-43b8-a18d-beacf007fb12", "comment": "Malware payload (Vidar)", "value": "d1a1dcdd8267f5656f2d671dfeb3eede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195436, "uuid": "aee4df26-c233-45a3-bfee-479a08d0f573", "comment": "Malware payload (Vidar)", "value": "3cdf48134632790ee12176a28af37ae654002941721ae22364d176a28e08c1b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195436, "uuid": "0177c5ae-e7cd-4781-86d6-3affe86aca20", "comment": "Malware payload (Vidar)", "value": "7f50a05e06f3e5441c428e2baf22f7fcb2088927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195436, "uuid": "72c8c610-710a-4b08-a14d-2926585065f0", "comment": "Malware payload (Vidar)", "value": "495b22491e96f51c3259d66e1b5e1284b800e5932f84e3fbba9b7c058f06f03762e6725ae6a834a1d9186be191b8c281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195436, "uuid": "44be7b38-a120-469c-be5e-84cbc994a0b8", "value": "T15D464C53BC910966C67FE23494A0A2917B71746543323BD71E9A21B60D3BFC82B3F729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195436, "uuid": "7ed7eb41-4792-4d9e-b470-3f5cabb0ab1c", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195436, "uuid": "bf7a0aa5-25a1-4816-ba2b-c980fa43821d", "value": "49152:oOPWJoB3c2MltCwgiLsT7DOKlyxK2MTgr9u4Tkcnlc4lrqZQPAgSNEvupu50jvEm:oOvB3tL5iQT7blyQ2MY+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195436, "uuid": "4974d1fd-15f4-4330-8063-8d29d0d8de07", "value": 5399168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195436, "uuid": "1aff26a5-0148-4df1-acc5-70910d87a75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195436, "uuid": "c0198e79-184f-42d2-a8e9-89a9c361b5b9", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c006db30-01e2-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770220882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220882, "uuid": "83279489-bda4-4b3a-95d9-8c71cf70683d", "comment": "Malware payload (PureLogsStealer)", "value": "e9d8169b6cc5ee9b041ce59a9a243092", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220882, "uuid": "24e66d45-92dc-42cf-b5f7-a6413ea667d2", "comment": "Malware payload (PureLogsStealer)", "value": "3e125892e37f2ce359cf84290c0faf71111848ee92daefb2491ee6b7a88abdeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220882, "uuid": "97afd4a2-29fe-4e92-9bdb-bc9367d57125", "comment": "Malware payload (PureLogsStealer)", "value": "cadb22fd3d91fb4debaf13a8895bb765d15ae7c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220882, "uuid": "3c211401-c25d-4283-9f20-d97d5e6c1f57", "comment": "Malware payload (PureLogsStealer)", "value": "598148685489e5c03706a6b1d4f2e2e18e47d2dba3b5ab2795d8bc5321c80eadcd2d0d39f6708e91ff1f0f8c76f98c24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220882, "uuid": "6acbea0f-ae90-4f4d-89cd-6c79748bbc04", "value": "T1D2F612B6D8E03CA7617A71EEDC8630939F6DBB0C6562C8791B58CDDBE7D203424161B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220882, "uuid": "4432be52-d595-494d-b475-9b0d8dcdc4ff", "value": "1536:FtfnpiKTAc9EQwf7Qo9D+XqfGS9P3XgHI3ldu8ld+V1Gq/KBOGu6+OD+4N+IoiI:H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220882, "uuid": "8159c34a-9325-43f4-8a25-45a9b4c5fe0c", "value": 15675901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220882, "uuid": "c3fc3ef7-1471-4032-abc1-812f8e939cf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220882, "uuid": "aa22cd5a-1570-47db-9d77-cb2082d1740a", "value": "PaymentDueInvoice#NQPMD3ZS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d2b8a2-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770219475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219475, "uuid": "4a5ad721-3c1b-4b3b-b78d-9ec31ffd5169", "comment": "Malware payload (AsyncRAT)", "value": "9ae4b7fdcca3458b25d1ac6f92a6a343", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219475, "uuid": "c79b2b4d-12b2-455f-ba43-aa34eb3d6b00", "comment": "Malware payload (AsyncRAT)", "value": "3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219475, "uuid": "58d08a9f-21cf-45a7-b25d-da65e1b42627", "comment": "Malware payload (AsyncRAT)", "value": "1ee094c8d737efc11e31ca90efe96fa6eda56426", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219475, "uuid": "e87771d2-8812-4fd6-ace7-58390c1820dd", "comment": "Malware payload (AsyncRAT)", "value": "42b8b9d3dcde11d35aa07fd2449af0b361ae244c41b3e03def5841ae5245f5d1eb841656db81e7e355269b09dbb2353b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219475, "uuid": "4a5f06c2-8a11-41fa-adf1-7df7a3478ebf", "value": "T1E12723B88C834975EB59C07C6631C701CDE5AF09BB385A5D38CD51098ADAEEFA84CD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219475, "uuid": "74ec6c34-9e4f-430e-95a0-8db3b8c81b94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219475, "uuid": "8ea3b01f-0921-4590-bcaa-b69b340d9190", "value": "393216:l6JKUwRplBq7BvK6bR11/su6Yn0s4weuXA2siq+G9rWZ:cJRSlM7B5bHlsub0uQ2ibI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219475, "uuid": "68338515-47f3-4600-b867-191c0f41b256", "value": 22327296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219475, "uuid": "ced27ebe-94da-477d-8860-a09b57945489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219475, "uuid": "f038f240-c8a3-4e84-a34c-e1d723d8d639", "value": "3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa6efb1-01ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770198493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198493, "uuid": "e39d5460-854d-41d6-83fe-7d7aacb59153", "comment": "Malware payload (Gafgyt)", "value": "a7bf54067193c966ed6182df0bacab2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198493, "uuid": "378123ee-5c3a-4571-8a76-d73e10b85652", "comment": "Malware payload (Gafgyt)", "value": "3f8b54248ff47e2b3a3bfa0208d855ef10bd4aaa33f83fbdcda42e800afb2e2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198493, "uuid": "9e12a3b0-dc3e-4401-8fb0-8846a1aac385", "comment": "Malware payload (Gafgyt)", "value": "2ad525aeaf0a10b845efeaad19c30b209ffc2bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198493, "uuid": "af53f200-f808-435c-ab9d-188aaa63d897", "comment": "Malware payload (Gafgyt)", "value": "434135e112cec171bdaefeb799cda36b738de272795bfcea7dc2df271fcb083e20f4c24890d686901698af617a66eb6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198493, "uuid": "11f5434c-bdbf-4014-8cb9-57525fd4598a", "value": "T1FCF34B09EA904757C1E3277AB6CB434E33238B94A3D733165938ABF43FC27995E26911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198493, "uuid": "1d9799fa-955b-4c4d-be9c-578560ac4285", "value": "3072:0dH4vMaa6CPod/8GPWTZmhK98yyv6M/9TKAam3wgRIQ5bX:aEMaa6CP4/gTZmA98yySM/9TKPm3wgR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198493, "uuid": "c581e720-cbad-4e87-a3af-65b37c633e14", "value": 171561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198493, "uuid": "9f9a3ac6-0d76-41d3-b485-1fd0de4a10f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198493, "uuid": "19d45edf-031f-4b83-bcd9-8be3a6135db6", "value": "pXdN91.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0a6110-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236474, "uuid": "d3be6317-6dc7-4221-aa4f-d027d05da51a", "comment": "Malware payload (Mirai)", "value": "96682df6b2f4b93713b81428aca23c18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236474, "uuid": "be6426c5-7773-4786-b425-65cf8a2c36ec", "comment": "Malware payload (Mirai)", "value": "40403c3d3075db239dc254f5ccf15c00305569e9a96e17d92e206b2526da4c38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236474, "uuid": "60f95322-a827-419a-9c99-f303559bbc89", "comment": "Malware payload (Mirai)", "value": "cae2c48e2f61fdeccd6e2329fcc83dd72e4ec13f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236474, "uuid": "eee698ba-51b9-48c8-b6b9-8c5b9043c2e4", "comment": "Malware payload (Mirai)", "value": "49f450797e6f870c34610edc812b16bc47f9a7bb833a5d8ef83885b12b161b26d20f03e37c758837593a3eea6acad077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236474, "uuid": "925e5a95-5c2c-4476-a36b-6baa85a8afcd", "value": "T17D93F942BD429B13C1D222FAFBAF059D37127B79D6EB3206D9217F9023868DB0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236474, "uuid": "5a75eb9b-a196-41f0-87b3-16bfbffea459", "value": "1536:yLvvprlBg9Y99MBNcPDjmCon6xqP1dNGz06WKBJw3e2k5RXilTMxDSS1jEAnMDKy:yLvvpzgMjmCon6xqddb6WKEkTXil5AMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236474, "uuid": "4adb2ea0-72e2-4cbc-ac61-0ccd6b30a2cc", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236474, "uuid": "5b35a96c-26a7-4f23-b519-7562f2ca6c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236474, "uuid": "e80aeed2-edb6-45ce-b253-ea646529558e", "value": "SecuriteInfo.com.Linux.Mirai.9838.696.20213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90eaa84-0195-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770187879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187879, "uuid": "7d2e4cd2-5977-44e3-b522-ec7bd7e2c891", "comment": "Malware payload (Mirai)", "value": "4e709a175ae13124bce2539b036ac7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187879, "uuid": "5c3ea892-48f6-42db-9830-347c216132ee", "comment": "Malware payload (Mirai)", "value": "40ebc0556d1cfccebac20196a1473be2d298736bab266dfa853c539691c6233a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187879, "uuid": "5eeea107-c795-4a24-957f-27f83ae280e3", "comment": "Malware payload (Mirai)", "value": "156a572c1e37ac60000882e7937ffabffab673f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187879, "uuid": "0e01b18f-1a97-42ab-9f80-08c6d2e91723", "comment": "Malware payload (Mirai)", "value": "cb39ddd614e0a1801ced3ab163df172f19629b18299c59a7e868a24aea3cb0cfec58116910d50980f6ee6b85b1384012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187879, "uuid": "1c5e07dd-2dba-458b-a638-1809ea6ec729", "value": "T101331985BC918912C9C42377F61E01CD372663E9E2DF32179E226F1177CA92F0E67546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187879, "uuid": "cb75d563-724e-479b-bab6-9ad7f3801b9d", "value": "768:pIgyxzL/ynKLEbo6pQvgDKehSG+EMon8rt7RBNOFTSLLKmtN:/yxzLaniEbo6pbmehSrEEWSiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187879, "uuid": "b63f431c-18c2-4581-b2db-091eb8f1204e", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187879, "uuid": "59002c0a-8484-4aea-9948-4fa0cca3a171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187879, "uuid": "916a305f-a242-4150-a492-230ff3469053", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d434cc-020f-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770240188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770240188, "uuid": "1812d07b-8109-4751-ba95-d1949be5a0cd", "comment": "Malware payload (SnakeKeylogger)", "value": "ac6ac494e5ee2e870e603b0a9c049ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770240188, "uuid": "46ca81a5-d93c-4973-a0d7-dd8d242a1021", "comment": "Malware payload (SnakeKeylogger)", "value": "40fc8d0fe590f2281efe1af792f90654aff809c3a445c2fc94f6f671c6faaa5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770240188, "uuid": "24f1cf60-1825-484a-93c7-b190b377fa70", "comment": "Malware payload (SnakeKeylogger)", "value": "97828b107827519863f91fc8324f11aea5a52142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770240188, "uuid": "1079f343-c769-4a1c-9d54-505c5f608095", "comment": "Malware payload (SnakeKeylogger)", "value": "168a0c21459e74082597722738b9cb8e86437fb2c2e33b84365d0cf1440511827a77329a1bc7c6afc9f9cffcea3e0ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770240188, "uuid": "34e6554d-6148-41f3-aff1-eeaa442128c7", "value": "T110E5BF15E3E904B4E567CA38C665C333DAB17E961730E44F0658F6062F77AA29B3F221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770240188, "uuid": "7e22a689-2188-40c4-b0de-31c6d2cbc22e", "value": "b5f5bcb71c45b603b68fb4216fbf5b5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770240188, "uuid": "f2a42f8e-37e6-479b-8448-32eb87c272f4", "value": "49152:4T26YNHLlbCoay+3s09fDKhBK47wDTUpHssUFKPPVVVZ:/xtwM7wvUNUEHVVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770240188, "uuid": "15a7144f-0b29-4d82-a783-f05b5b24d16a", "value": 3177984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770240188, "uuid": "2ef8b182-12f1-4f81-b656-e261ce295634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770240188, "uuid": "008eff68-4b35-4df8-92cc-16a610229440", "value": "liblzma-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4c4756-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770190973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190973, "uuid": "852f9c6d-6699-4f59-87cd-f80d4289412d", "comment": "Malware payload (Mirai)", "value": "36c2881f0077ac48e8374af6523ca363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190973, "uuid": "46ba0c5c-f62e-4bb8-9878-3423aeecbd11", "comment": "Malware payload (Mirai)", "value": "411f5466b228165a6db2852ce930e5716b4108cc55aa3a4c9068c72c2871fbc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190973, "uuid": "64053f65-f1a3-4b5c-a805-d5e881c731df", "comment": "Malware payload (Mirai)", "value": "6930a55f34c8f44dcfb0e6e620156fbc5ad4c04b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190973, "uuid": "32309607-551f-4734-be21-b7b946faeb07", "comment": "Malware payload (Mirai)", "value": "0f5b2c0b2a4678e9b81de24680235887c699f6ac9206a91763da3b853370005d784e9f67be8c6bff0f72c9cc0bb06add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190973, "uuid": "30f667d4-f877-45d6-ace8-fba7bc7c7ef0", "value": "T13BB39E9BB70B6291D82186F00BCB4FED2E2333128F67C9E76D0E253A59391DF4906391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190973, "uuid": "8856fdaf-7e68-4470-ad06-c2d273f952ec", "value": "1536:dQEKKlutXQuqu285bVzMXK87CrmP7gdw/LWm:JKiuhrL5ZzP87CrmjgKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190973, "uuid": "546e17ec-3e1d-4e63-8e4c-4199ccea46c0", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190973, "uuid": "bb113aae-6434-46b2-bc1f-cda7f9c6c93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190973, "uuid": "37cef288-ec5e-412d-aa2a-1c5348928ab2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8017525f-01da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770217338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217338, "uuid": "067bcb76-71da-497b-ab2b-d40ba583faa9", "comment": "Malware payload", "value": "1481b1e3cb0166011b57718e8f10170c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217338, "uuid": "1a7869bf-4154-487f-95c1-953134367fe0", "comment": "Malware payload", "value": "4197ba623bc40f3ab68102252f77909190989e7a6f7f413b76679d06d5ee7a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217338, "uuid": "93fc8523-c579-4dbf-aaa3-844badd40a01", "comment": "Malware payload", "value": "6d7cad1515e7c070bd5916427cf5de8bfe7ddd7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217338, "uuid": "b02f5d3f-8680-47d5-9e80-8cc778e4809b", "comment": "Malware payload", "value": "093f3982e2cee3fe8f5dc0b9038fcecbcbf873604a5478958c9ff4f83b78612781a0427973487499586b189dd6773ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217338, "uuid": "3319e6af-6fe0-468f-a2f5-fc683dafbf59", "value": "T1DD2361CD3AC6B024464A30372D1FB19BF87F8ED034488155C79AAAA5BD2935DE835F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217338, "uuid": "d4daa8fc-3fca-4e65-bede-c713f74c1a12", "value": "768:Z6gz0H9pHmDZqQFokCC+/2Gx3qjuYHRi3OiONrWh4vIQj/KbPtcXeuFa:KH9RiokCEGxSuYHR/lNrbQfa9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770217338, "uuid": "fc6c5746-46d2-4872-9561-bbb1747ee658", "value": 47248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770217338, "uuid": "9ee4226b-f183-4c1e-aef1-25b5f7f1047c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217338, "uuid": "255c6a95-2c38-419b-b466-088660bbe223", "value": "Telex_payment-Copy INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1e51e8-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182110, "uuid": "7ab6c6d6-5914-46d2-a152-742e913da42d", "comment": "Malware payload", "value": "8c0d3924f0260e338321f18c3444b5b7", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182110, "uuid": "c3d31263-4b7f-4f34-83b1-28fa703d3fc8", "comment": "Malware payload", "value": "433fb9e1a6382fda5f5f5ec00a4258934f1037308531a1cad74d398ce8a193d6", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182110, "uuid": "36b08019-f850-406e-9efe-39f63ede3f05", "comment": "Malware payload", "value": "d6d88294bc58636e7de270b100bfa4c035818a41", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182110, "uuid": "4dd409ec-2647-4c32-8406-cdf4ad33a0fa", "comment": "Malware payload", "value": "adec00620c2493d9fa8f3e447a74391f82957cf2a9e97f41f15ecca439f9d1eb18e1d2e4ab78bb3e6f1faa88afdb41f3", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182110, "uuid": "4ff9025d-58bf-46eb-938c-8099b7281af2", "value": "T11051B0505AEA11C871BB1F56ABFAB0F60876FD649C39E6FD0144894D47B1A81CC32F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182110, "uuid": "b3aa330e-6004-4778-9fdf-f2540c930a8d", "value": "96:0/J1/qVCOR8S2Zm+9kjsVsVjdgmcVz/++6Fd:0R11u8S0qgml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182110, "uuid": "16e35dfb-e8db-4549-8dc5-4f7eb10ffaa5", "value": 3134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182110, "uuid": "2db88d6c-9453-4c91-b5ec-156d714e35f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182110, "uuid": "50028f5d-a115-4ff5-9b41-3a4c5c605606", "value": "433fb9e1a6382fda5f5f5ec00a4258934f1037308531a1cad74d398ce8a193d6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e61c40-017e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770177907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770177907, "uuid": "1572c205-2989-41f0-b915-8f5523129b25", "comment": "Malware payload (Gh0stRAT)", "value": "f0bd5b9dbf7db0f859f5f6b570b545e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.B!ml", "colour": "#1ADE99", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770177907, "uuid": "5a92e508-dbad-44e2-9180-2ce52870986a", "comment": "Malware payload (Gh0stRAT)", "value": "4399c0889ab9ce999f4724d78f372dab4f2d31e1c4b229c409f1c6da942be435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.B!ml", "colour": "#1ADE99", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770177907, "uuid": "ebf947e8-6fc5-4fd3-b9b4-81cc2ece8627", "comment": "Malware payload (Gh0stRAT)", "value": "3cf61e8531efa66835c8557605d0b957e6f9fc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.B!ml", "colour": "#1ADE99", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770177907, "uuid": "b0624825-79fa-4249-bc17-0e404e32b013", "comment": "Malware payload (Gh0stRAT)", "value": "90c2e727ae45d02bbe10e9037e2069a64c46cb610d6181d0192c349d95eca1f3e915b90a123917eb24ada80374d302da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.B!ml", "colour": "#1ADE99", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770177907, "uuid": "38789281-e965-48ce-aa0a-98478caed59a", "value": "T106273313B3CF613FF0AB463A4A72D122457B7B616A224C96C7E848ACCE295D51D3F706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770177907, "uuid": "8a4e435a-9f67-4395-b2f3-d5bbc18c3459", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770177907, "uuid": "44e49922-560c-4808-811a-90ad97fa9b97", "value": "393216:pTqH3X6Q7t76BbTO9NW5bYYDhLt4b3LkfmCRYfGG5WJsPBRcMXRYDOP6:enxt76qW5bNt4DLzXuG5WXB86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770177907, "uuid": "9731efaa-80e5-49a9-9bcf-63a7d61e0681", "value": 22090960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770177907, "uuid": "ff448b2b-7e0a-43a1-ab10-25fdd8da2ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770177907, "uuid": "4fc30775-5179-45a6-a19f-1bd0944234c3", "value": "569Bxgo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a483e9-01f3-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770227949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227949, "uuid": "44f20196-8106-42e3-a92f-411d1caefbfa", "comment": "Malware payload (PureLogsStealer)", "value": "85f729eb83f21ddc7de30cbf07419906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227949, "uuid": "bf871968-482d-4278-a680-a0f02727087c", "comment": "Malware payload (PureLogsStealer)", "value": "43cee7b614906341cc511f6a014271a983dc24f3c85aae50d3c26bbe39e8e0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227949, "uuid": "e74fd163-d79a-40d7-b765-10f8c4b981ff", "comment": "Malware payload (PureLogsStealer)", "value": "aef4409b3ed90086e5e9362a8bad529e31deb97d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227949, "uuid": "c67f9ede-9198-4296-b486-d0d708b6088a", "comment": "Malware payload (PureLogsStealer)", "value": "9c434b600e021f8347736d3a577f2cbdb14e303e7328438bc3ec2bb6ba3fcbf6a17e1ea8ab14b130fee5c9c9f8c6e13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227949, "uuid": "58cd846c-3bab-46b6-a0b2-f923221fcdcd", "value": "T1B68423426217AFE1C9D2D6349876EBA48BDCA205057DCFBDB65E0F2F4D0B34BC6904A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227949, "uuid": "bc2c07ed-ec22-44b5-af25-f764ed8b031f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227949, "uuid": "685bd4d6-a2db-4af6-816f-13278ebc926a", "value": "12288:HM+Vrye9HRNvrufyuJdVH+AubwOKhngyYupry:s+VTHR5ruq6PHtubwOKhgyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770227949, "uuid": "c6743f45-8c69-4f75-a3e5-3b81d097bc1b", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770227949, "uuid": "a0526510-100f-46ef-a52a-227d3cd6b3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227949, "uuid": "10b18db9-757c-4db4-a2aa-8dba210aaf1d", "value": "43cee7b614906341cc511f6a014271a983dc24f3c85aae50d3c26bbe39e8e0c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adb60f8-0163-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770166219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166219, "uuid": "71256685-f94b-448b-985a-b154d36c1449", "comment": "Malware payload (Stealc)", "value": "d66e17e17ae2ce983bb6400343ce5d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166219, "uuid": "80c46fee-549c-48c5-bfe7-dd6e676654e0", "comment": "Malware payload (Stealc)", "value": "43e6b647136d5c6073e7205f5d13b8b3c4c9ec21f1d177a03c8a0255ce097c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166219, "uuid": "7f4b42a9-679e-4f71-8d74-b00fc5c3e883", "comment": "Malware payload (Stealc)", "value": "8553e0a3d0637c1a7e1986a50470cc50a669b2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166219, "uuid": "011aa296-6f7b-4f84-938c-041bdbcb5668", "comment": "Malware payload (Stealc)", "value": "d0cd6e75b7be1fc8b4117ab4979d6dc8661577e10a4627ff8d7e2def242239825f6895fea29a6b7b22b9abc59b20d366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166219, "uuid": "3955c308-2594-4c4d-bea1-80c396b8cdfb", "value": "T1E7264AA2BA54CE61C99BE139F87161D46230B40B073535C36FE61EAA5C2B7C8173BB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166219, "uuid": "b8b72d52-7dd5-4443-a18a-78ed2e3873a2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166219, "uuid": "c8da713e-4e64-4174-af76-7f0f00d8b34d", "value": "98304:kp06koaDil+XmMpn9+vPmC3yPWjjIu4PisV7:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770166219, "uuid": "7fef5e78-9a43-49e6-a967-b927e01c003b", "value": 4814464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770166219, "uuid": "726a39d1-98d8-420d-980c-98c702e82ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166219, "uuid": "b3d3cb13-fe91-4122-b264-e9fd74a721b0", "value": "x43e6b647136d5c6073e7205f5d13b8b3c4c9ec21f1d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1182e62-01c6-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770208804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208804, "uuid": "e9f2e603-c508-46f8-9e7c-b862f5763f2c", "comment": "Malware payload (Vidar)", "value": "7596f22dd26903e8846660d88db2bebd", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208804, "uuid": "91d75651-9bff-4593-b248-635d0dbe8702", "comment": "Malware payload (Vidar)", "value": "46f550934b61fd5548379296d8f50eb91f6176f4e2fa0ffacdd887bb1eea5b9e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208804, "uuid": "42ed4ffe-5484-41f3-be97-c694bdbc4d97", "comment": "Malware payload (Vidar)", "value": "dced593e820911fcc3f78416a8b75adf5d89b941", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208804, "uuid": "69ccf297-5f85-4579-9611-1d4e0b7b3ce9", "comment": "Malware payload (Vidar)", "value": "f0fe0af2dc7370f371349b25a841847a522b4a98957570d1a19085c87383e110362f7c001a698724fbf574548f033a6d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208804, "uuid": "356c45b8-008b-4a50-8492-66959a27504d", "value": "T1D7363A6B7260D2A9C15EC63AC093CF00F5F371791B33C6E756A103689A979C99F3E660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208804, "uuid": "e9a8cd6c-02b9-4de7-b64e-462362b7585f", "value": "71f78f4628cb6313a1d0643cb0123fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208804, "uuid": "e491a709-fbc8-4a65-a4cc-e110511cb723", "value": "49152:QbDzejgtRPTasHYMJ8DUAGxxYvSikQSVnRYOBS1njE/4ABdxH0JP44vQEmd:p8hH0JP44vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770208804, "uuid": "9a66fa8c-8be4-4920-8697-e0d5dbe1975a", "value": 4943872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770208804, "uuid": "62eaaa4c-0b2d-4a09-a49a-100a56b573fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208804, "uuid": "924a61ca-add1-46bb-b4ce-3b3fadfffdfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b1571e-01ed-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770225636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225636, "uuid": "36dec39d-dc21-45d9-8f70-a6fb94c251a0", "comment": "Malware payload (Stealc)", "value": "047aba7a5cd0c2af1a8ddac3e41f01c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225636, "uuid": "94b46348-4634-4e73-b231-1e7739d645d4", "comment": "Malware payload (Stealc)", "value": "46f6c964b0b21a46c6f367e3375e60d04ae9ec80ea45c4652c1e4b8cde3f2023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225636, "uuid": "ccbd0c8a-f600-4d8e-896e-6089d8d9ef83", "comment": "Malware payload (Stealc)", "value": "d186f84c3c3647114e0630a46170943881490eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225636, "uuid": "b33da169-fd4e-4b84-b84d-d955dc37f2d8", "comment": "Malware payload (Stealc)", "value": "ad325a1910df38106b0fb80df6439a11ca895d5504c9307bade2b28658d683dae204b81bf116cef53245b37689b00a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225636, "uuid": "5caae6cd-df49-474b-bee8-c15a1952f790", "value": "T191E5BFC9D16E44D2DC053FD9A8142BC79B2447328A7800683A6FBD499F774FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225636, "uuid": "8cb04c17-820d-4d30-a4dc-5ca18de67f16", "value": "dd06eacba964d059f38507da7aad1e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225636, "uuid": "001ff63a-06a8-420d-9ccf-90219991bd6f", "value": "24576:eLnhVDpy2tc6oKkqmXkgc4QzHJnFSqDC4+tnK4zKti/Zt/hVphdY69ZdXu1g9oi:8/1gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770225636, "uuid": "b8b7abe3-3c21-46ee-b951-cafc0392f61c", "value": 3034091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770225636, "uuid": "9eb658d4-b647-41d2-ac99-c882409db56d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225636, "uuid": "477d0f0b-b336-4b24-8185-fcd16365f2c8", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d6c29b-0164-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770166827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166827, "uuid": "b6e4d809-1b80-4503-9f54-e29a55d4cea2", "comment": "Malware payload (Gafgyt)", "value": "079688a05e660343a5a701c6342d4a7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166827, "uuid": "cea888d6-d044-4807-af1c-5fb2c96f26db", "comment": "Malware payload (Gafgyt)", "value": "4714a6681225bd25e3c9eee967bf9305f655f61fecc502270fbc177acd0ebc1c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166827, "uuid": "3c033efa-0737-4c81-a3e9-a36562f371f4", "comment": "Malware payload (Gafgyt)", "value": "5c8adc513d614bd87c50f45b7ce0c58e143201b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166827, "uuid": "ceabf92a-16e9-4d66-970f-0c64a163df6f", "comment": "Malware payload (Gafgyt)", "value": "bff16488d22ed7de16118abd06436e8211a7685e1960dd26ac12b32f8481173664424d2fe6f421c25679a7fb589ca6d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166827, "uuid": "446b7398-c7eb-4e7e-aee0-b4027d5f5ecb", "value": "T1474190CB3360CAB8ACB4696F3229741071F9A0B69BBE9F441BD834D9848DD1C30C5A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166827, "uuid": "53c79de3-8ab4-45a8-adfb-b2718523c36c", "value": "48:1e9a/seuXErhKAvqZA2YIOUo8oZ3v0biEvvSZXrvNAfE:1U4hKAwYIOUo8oRcI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770166827, "uuid": "e0fa8fdc-719a-4eab-97f5-dfaab623972c", "value": 2036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770166827, "uuid": "32788eb2-94fa-48a7-bb9b-770f89394ba0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166827, "uuid": "352722f9-f7c0-456e-82cd-2f0e655589cf", "value": "pXdN91.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755304b7-0202-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770234500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234500, "uuid": "9a5ba548-4b63-4133-895e-57c87c26cd6d", "comment": "Malware payload (Mirai)", "value": "8fee6aafae4c652ea01827cb4bd6666b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234500, "uuid": "84dcef08-863c-41f5-bbde-7fb907d36f57", "comment": "Malware payload (Mirai)", "value": "472b7054018bdbdd7606258ac6cda1da873bb45fb5dffdee16044e79dd0ee3a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234500, "uuid": "e38cd014-31dd-4623-8865-226be6f50313", "comment": "Malware payload (Mirai)", "value": "dcb6aa3115ba7bbf5e2f9a5bca2f3c639cba33f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234500, "uuid": "488b1ea8-f433-43fc-b983-a804967ef287", "comment": "Malware payload (Mirai)", "value": "98726932fbf2a94614b0f53b86c1094447472f149294ebb007234fec44449fd136f5967d97ae2f690901fe3be7b38d76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234500, "uuid": "105a0a11-2f99-4835-a297-1d26c8ec0a87", "value": "T1D9830882F9829613C6C112BBFB6F418D776713A8D2EE72039D256F21378786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234500, "uuid": "a8c35387-f7a2-449b-aa20-196ebfec8c0d", "value": "1536:oKDLhQ3BlLywjmConIxqPONj6uKBJw3o2zKPTfqtGgg8q+j0An+Hfv:oKDqXjmConIxq2Z6uKGzoTfqWA+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770234500, "uuid": "9b69ac21-f084-4dab-95a7-d16c34dc8b1d", "value": 83444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770234500, "uuid": "c499b1d7-1c83-40d5-ac9d-de5f69572743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234500, "uuid": "b425cce6-2aa6-4c53-a53d-8a3fd6dc22c1", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442475ca-01be-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770205212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205212, "uuid": "efaede2f-cde4-4a5f-9d2f-1d482c19f0f6", "comment": "Malware payload (QuasarRAT)", "value": "d7c2c222aa07ab435c6d2b0ac018c705", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205212, "uuid": "73d2a105-263d-4987-9957-5d022d55804e", "comment": "Malware payload (QuasarRAT)", "value": "47ff081bdf4d8189b5502692f0899cb4e9f7495a033555f913dda52da9a168dd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205212, "uuid": "ec753fec-e3ad-458c-bed9-a63acec0f928", "comment": "Malware payload (QuasarRAT)", "value": "a08a7c92da8b9c1f6d05399a347e6769d40141fc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205212, "uuid": "3fba2e99-314f-4bbf-8719-ebacf6da467a", "comment": "Malware payload (QuasarRAT)", "value": "0a67a1861e26a7608f1ed25d739d5953ef9b1f0555c042899dd601b7d840a60cd0818a31ef53b3c79b7e1da1772c455f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205212, "uuid": "6ab128a4-215a-4713-a8de-3fac8488ce41", "value": "T1D464E0387B80EC00167EF0626699DD373DDACBA3DB2711E791184E64187C787A788DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205212, "uuid": "69ad46c8-1bc8-4ac6-a4f1-75af190ac25c", "value": "6144:YZ7PGBYbO7I7CD1VfuMquX2b5vW5hTciDomtaTnfYUa4lz:YZQKYNu99uhDMmmwmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205212, "uuid": "43fb4ff6-256f-46f0-912f-f24a22457c91", "value": 322687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205212, "uuid": "69b865e5-adfe-4eed-9d13-f291ce5955b2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205212, "uuid": "a11cffb8-9c5b-45c2-9fc5-7bf8369da3bc", "value": "BootstrapperNew.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61284ed-01cb-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770211094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211094, "uuid": "3a5b8434-3152-4e69-b6c7-95334d3270f6", "comment": "Malware payload (LummaStealer)", "value": "89e25a8b7701914e63c11aeed4424f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211094, "uuid": "9c0421ca-6ae8-489a-b1ee-83d1ecd44058", "comment": "Malware payload (LummaStealer)", "value": "482f127885b676a2d1517e68d925eb06a05b3fc626b990f54084b129ac51df95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211094, "uuid": "cb0fb778-b4a9-481d-9bac-494997ca66fa", "comment": "Malware payload (LummaStealer)", "value": "eb9afe0a644f51dc9b8b893e34b0ca598d7b945a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770211094, "uuid": "55ee18ab-b3bf-4a4e-95e4-0af932f4d6e5", "comment": "Malware payload (LummaStealer)", "value": "a5b5065a78835c71eafc90f125704e54b2a85084272c088d2bb5f5cb921ce70de5651c4bcdd66fe4a56d4a77dfdb0366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211094, "uuid": "eb57b6db-f31b-4ddb-902f-cb6e1a6eac12", "value": "T1C73523E6BFD684F5D3A225B3043053A39BA3F9674825C93B6F054E5EFD30A908A14E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211094, "uuid": "2c401068-02dc-4710-8e4e-0a3bfbd20469", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211094, "uuid": "20ba9fd2-94e9-4f6e-8782-284f82784415", "value": "24576:Hlg3UtfVWX04FSLDb7exUT5Rg9CFNaMkVT1baOSg2oVW1j1N:e3Utff4Mz7exAUIkbaKdW1j1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770211094, "uuid": "9b1c1e4a-2744-4dc6-8c74-7e2d1af3cf32", "value": 1080906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770211094, "uuid": "849a596c-bb54-45c1-b3a0-685cf8cb3a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770211094, "uuid": "fa089f9a-9072-4de7-9c7a-aadb76f215b1", "value": "482f127885b676a2d1517e68d925eb06a05b3fc626b990f54084b129ac51df95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804ff676-01e0-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770219916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219916, "uuid": "7b0839c6-63d2-4f77-9a88-04d24214b16f", "comment": "Malware payload (Vidar)", "value": "ce92694def633be63fea92b3e31386ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219916, "uuid": "5458d2a4-1c6b-4f15-9c23-cfbf8345bbb0", "comment": "Malware payload (Vidar)", "value": "4975c866b434abcb8686dfccbbde15009b33e61167536e91d2dcbf5d8275c930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219916, "uuid": "2c4639fe-7b17-4f65-aa24-98cee924ea6f", "comment": "Malware payload (Vidar)", "value": "b3a076fcf6f050927483b2d035c0ce2e2a4273ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219916, "uuid": "c2cd8c60-ad4b-49a8-a5c3-4c29893a6531", "comment": "Malware payload (Vidar)", "value": "3964f88d9fb85458949e5a3e3583dd00b0a136a81f7d25def8fb3bdfc5c39fd584341cb8b28a429ba3fbce83de0bb01e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219916, "uuid": "0d3ce94c-71c2-4189-9807-a92ff6f37ace", "value": "T12DA5F138C695CCDBF29A80F468D051433866B662D3798BFB0790E22DEA091D11DDEF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219916, "uuid": "8ceb9601-bdaa-469a-b4f5-f8aadffe3881", "value": "8a4ce3087bdf40c7b66139698159e2bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219916, "uuid": "bb285d9f-2245-4362-8861-e3cbb1bb8a6f", "value": "12288:ad4IA8+XKomu52YFDE9xIQLX51eLNxICvmjJOOmiQpWJV+mNs/BQUDp+rLE:MApXKNC2IQLLeLHejoeuMV+mNKB/iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219916, "uuid": "7f03d53a-458c-4896-b242-8f1759c253cf", "value": 2240000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219916, "uuid": "c9a836b1-5f5f-403e-b31b-2fb1a95a6b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219916, "uuid": "aa2701b8-365b-46ca-96b4-decaf17d1ce1", "value": "is-bootv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760a2ddc-01f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770228488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228488, "uuid": "c3b264b2-088b-4aa9-b9b0-efd2241f9b3b", "comment": "Malware payload", "value": "8d2fd4b21106077118a9156c429c07ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228488, "uuid": "56a9110e-7ebf-4315-8476-bac4e44851cc", "comment": "Malware payload", "value": "49838e8bdb46e26c2375b848b23fa08ea93765c4b50b7ceb125870c14bdda0f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228488, "uuid": "01e62266-fea2-46ec-9ad8-be59421e5930", "comment": "Malware payload", "value": "d14812abf8d1a2277b9ec81fb0d9b5cdd09ae2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770228488, "uuid": "1cd348dc-a31a-4794-89e2-0a8a1e4b97ad", "comment": "Malware payload", "value": "59b47dc3e26ee99e2a71a97db217ae7ce87b406b8ac822a60fb4501543b56e0c0f4c1c863ecf23e88d390cbe995e6f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228488, "uuid": "4aad62ca-f9bb-4553-9431-070f323d685b", "value": "T198D45E0CBE91E80FDD5A39778AE710D04BF12B812A319D7231457AE88F7736658E627C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228488, "uuid": "e6ac17ae-03d6-4f3b-ae99-05ecaafa7837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228488, "uuid": "dae96e0d-ac12-4d55-96ab-4248da4b949a", "value": "6144:wA0duASTJV64+znnCo6Re6VlWT8b9NLiDc8di6bfmVeW/OwbP+TlwF9kfK8rpClQ:fnpV67b76RPVle8TLb8dmV1kPgBuj/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770228488, "uuid": "df585601-9149-4797-a806-826a1e7a2e79", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770228488, "uuid": "b9470683-55af-48d9-9a24-5aaaa683642e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770228488, "uuid": "c0d0c0c4-4f82-4b84-b93f-b76cb1348c05", "value": "49838e8bdb46e26c2375b848b23fa08ea93765c4b50b7ceb125870c14bdda0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa46454d-01b3-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770200793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200793, "uuid": "e7ea84c6-7f3f-424e-98c5-4c3a0049c978", "comment": "Malware payload (PhantomStealer)", "value": "5c585101ce5dadd2d0ec8ee9c3e513b3", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200793, "uuid": "048d2c17-63ad-484f-8809-c1044a2afa48", "comment": "Malware payload (PhantomStealer)", "value": "4a34e6614acd4a138eb1f308c21be91a8f0c53f00c307a1a5cf2a178182b62c4", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200793, "uuid": "adc60e40-b559-4fde-b158-1aec07525aba", "comment": "Malware payload (PhantomStealer)", "value": "77457bf93819890138d0a7f02aafb874bbbd1503", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200793, "uuid": "7794970d-ef33-4336-9c15-a5b4d43d05bc", "comment": "Malware payload (PhantomStealer)", "value": "aff0bca3e84ba89e0eaed9244fd4a75869facfcf6b2d33a595bd520af8a6955d57150b5cc139345c70342bef21e1f782", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200793, "uuid": "1a03b42f-c9eb-4580-ae83-5649668d4de1", "value": "T16A061110C95ADE96026C8229206A5E8726604EA78C447B7A7F9F8F8D0F4F10FD5753FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200793, "uuid": "4ee52278-1b89-4213-98e0-1d9c9e4d0b1e", "value": "49152:IwzolxiByYZ/uLGNcBJYz7lTLYgh4ThXjCTHtsZEVvWW:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200793, "uuid": "b3c5a6c9-495f-431a-8d69-1d406da8e4d1", "value": 3730033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200793, "uuid": "59b5cc1f-025f-4f4b-86da-47b15ba83810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200793, "uuid": "48045940-9f42-4cc5-b906-210dc4bd946c", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1e3afe-016d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770170572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170572, "uuid": "385aaa4b-1ee5-41c8-8b2e-1a8e2f3126ff", "comment": "Malware payload", "value": "435a1cdeeaf15427dd3d2d2560b142a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170572, "uuid": "612cdb80-9d06-4af3-af64-9f448b59afcc", "comment": "Malware payload", "value": "4ac6cb82c8d5f7b2f0ccd73e316729360341942187b5b3c1a704c685af9356ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170572, "uuid": "d8332481-ddfa-4ba4-9fe0-3b6d6bafa76b", "comment": "Malware payload", "value": "26ff6c4f1aa006247f3b319ae01924ef940fc205", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170572, "uuid": "56e55538-1c52-4edc-ab3a-e3a448313488", "comment": "Malware payload", "value": "9ad2af0ba9200386068f4bd9050eeaba2fed933f3cfc9733873c7e9b2c3b624da41b400dc9eb849e6b3ce00954046278", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170572, "uuid": "20237993-51c9-44ac-9a17-6e4896825fd7", "value": "T1A6C423DCEFD825E8F39144759DB8FE74EF92386B6D92DFCB1C2251231E4A2920158894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170572, "uuid": "582aee45-aa74-4a70-b412-6b0f016f915d", "value": "12288:rrktZlEbDqIW0koF4qvRh+T8XV40vWgbXfjmaj7WMJe1:3Kc5/O8/7WGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170572, "uuid": "df6eeee7-0afe-4f57-b97b-eaf0e962e35f", "value": 562761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170572, "uuid": "75236222-8702-4320-9488-18325329f6ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170572, "uuid": "6c6aa686-187e-4709-adc0-c1ab50f0134b", "value": "window11.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614df373-0160-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770164888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164888, "uuid": "390984b1-e71a-4e82-b6df-9af4cf669eb9", "comment": "Malware payload (Gafgyt)", "value": "29487e461889473b73088b4d5b1d0a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164888, "uuid": "45278185-5e33-483c-bdc5-8f4fee7af7a6", "comment": "Malware payload (Gafgyt)", "value": "4b9ccfa76d51c9991a088f21ad40d10e93d74e6b7c11bd6b49ec35afdc68e537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164888, "uuid": "5b97e9ec-d771-434c-8a65-a227328d5181", "comment": "Malware payload (Gafgyt)", "value": "70dae1c23817aa0f9f15ac22953dda0551a38918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164888, "uuid": "2ea3cd98-a04c-421d-ab14-52fdbe60c69f", "comment": "Malware payload (Gafgyt)", "value": "0cf1afc223b6ab8e36fb122a905cd1ce0aeb2baa1b5e892f338aa9c36a9cb9f424b14d20645fc999e520fa5d62375cf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164888, "uuid": "a6584278-2df9-4074-9c43-dd995784de1e", "value": "T196B309A3F801DF76F00BD67644E74B21B630BBA20E536526731739AAAE761D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164888, "uuid": "3f1d053d-0dc6-43f6-bed0-700232d7fe95", "value": "3072:xPz7RAQZadZWy/HDKIPBIyMv+im5tDTJmGru0TO:xTZadZjHbuyM2im5tDTJVru0TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164888, "uuid": "a41b7e29-b5d0-4beb-8b79-cf307c688400", "value": 113535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164888, "uuid": "a2ed20ac-f5be-45da-8dcb-b5ded2588088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164888, "uuid": "3f94e8eb-62cb-4bd5-a837-1b9aef99e408", "value": "pXdN91.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee393bac-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164695, "uuid": "5a77a176-0229-4a36-a38e-4ce6ea8e2fc1", "comment": "Malware payload (Mirai)", "value": "e3bd0181785f2da94645fcbd60b477f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164695, "uuid": "432e98d9-d196-41e0-9c5b-39948988622f", "comment": "Malware payload (Mirai)", "value": "4c53eabe554050db264d95f5d47346d4f3e8a5e91dde12ca153dcded5060f7ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164695, "uuid": "175fef19-1851-4643-8239-121a4b67d169", "comment": "Malware payload (Mirai)", "value": "b83fa68bdc585f741003306a6d038b5febbe5fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164695, "uuid": "c46d2733-9114-410b-9c31-62887f2c7fd0", "comment": "Malware payload (Mirai)", "value": "1654f0db2530b0cfcc80557cb80fd34e99f668a05c0cb8b86299430858d1fa7d0a41e3c3ccf88299ee5d3330eb867f63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164695, "uuid": "e7f52888-8920-4cbd-8855-7e9fe5c00689", "value": "T153935CD2A740CAB3D14306B517E79F110532FABB1A6ADE46F36A7CF49E0A0847112F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164695, "uuid": "de010ee8-7974-4674-832c-a762c1cda444", "value": "1536:8BjU0BUNok9Rcjer6UVUH85OXR9fDhd/WfztFQzHfM5udkTQm9mhmacGxgAam4Il:8BYuUz9Rcjer6UVU9XDhYfzrQz/MwUBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164695, "uuid": "5f5dc1f1-434a-4eaf-ab51-f6707d54fc47", "value": 96106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164695, "uuid": "d1d8ef47-ad0a-4bcc-a756-a52cb45f44f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164695, "uuid": "616683a1-e3a5-460b-8583-43047901d4db", "value": "pXdN91.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16181810-015d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770163473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163473, "uuid": "7efe41fd-4676-4e01-b79b-8a7c58bee603", "comment": "Malware payload", "value": "6bbe60db6b82868c74ab8fa02c0d6b42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163473, "uuid": "ad48dabf-1e2a-460f-8969-9166f6f087c9", "comment": "Malware payload", "value": "4cc473d08efe4ec459ff98fd92b803445c90f36e2e4b4a518fb849898f2a232d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163473, "uuid": "e861d872-3e33-4a6e-a280-163e929dea80", "comment": "Malware payload", "value": "d150d49a3d22f3ea3023233a9d2d7f58146aa953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163473, "uuid": "f790d484-f2f7-4cda-a180-ddcd8897000b", "comment": "Malware payload", "value": "c5529c73f8fac9ac34415611bf458f9974f1efe9d40b5e3ba06b3c6a1e75c5e5d7259c7bbd3495dd16c5503ab96e3e17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163473, "uuid": "0a5d05a7-06dc-4998-b822-d3df466d3f2e", "value": "T192357C5BB2F374BDC063C43087DBD6A2A931B47446226E7B61C4CB302F66E641B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163473, "uuid": "5bf1e38f-48e8-45c8-9d7f-6fd452f17287", "value": "24576:8r+sB754krUPn6fNsQs1fWotpOiycQ7aR/YhOLTF:8r+A754krUk8WdvcgMQhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163473, "uuid": "7893b46a-e681-4faa-b013-dd0052a3b44b", "value": 1084712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163473, "uuid": "748079a0-0784-4e4b-b00a-7eb88b437912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163473, "uuid": "823eb1fe-e68f-42a0-8616-fae876974ec7", "value": "recovery", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7a9695-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189977, "uuid": "e71a99f8-654e-4bf2-87bc-ab05720c69f3", "comment": "Malware payload (Mirai)", "value": "07a7f7f27fc44f761e7c2d62950d1499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189977, "uuid": "e6ad63a9-7b05-4df6-b927-b9f5f05d503c", "comment": "Malware payload (Mirai)", "value": "4ebcfee9d5a2dd5534b90c9d2a7e890a80a85b032961a5c8192c2f6d9aaa9f09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189977, "uuid": "ff327efd-7c54-4a3f-8a96-d29b9d178584", "comment": "Malware payload (Mirai)", "value": "ede1cdf854d0376ebd7dc5b684422bdea50a550e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189977, "uuid": "203cde03-e1ea-4af2-8d20-872306c88bfe", "comment": "Malware payload (Mirai)", "value": "89770b0daf9f8a9ed703932c286cc7bda5691e9387626df7d8cde48805bd5fa4eee9d9583f28ada832e6a4160061bae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189977, "uuid": "7444cf02-2a2a-41c8-8612-18fa62c22932", "value": "T1C0A3830E7E319F7EFBAC823847B78A219209339666E1C584D19CED026E7434D741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189977, "uuid": "a3d412f7-ce29-428a-b51a-a40541fbc348", "value": "1536:cF5twgB0FavGLCpCiwxpmNtU8QbKpEPW9U27np2twnfRzOdZ/:uTwgB0mpCismNtU8C+j9U27np2twntO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189977, "uuid": "b2960152-8a55-49e1-b356-afaa91e6d8ad", "value": 105216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189977, "uuid": "80b24992-ce28-42e3-8a46-f8a4b26296e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189977, "uuid": "66daf7fb-a879-4ea4-9aed-e1881cdad9b1", "value": "nullnet_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134ed683-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192675, "uuid": "5fb2f9f1-aa5c-48a1-aac0-32faee6ed1af", "comment": "Malware payload (Mirai)", "value": "fce1ac7432d1a94a4f4e8a2d583f602d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192675, "uuid": "3c854457-a79d-40b3-b6c3-ef4e89d2d9ff", "comment": "Malware payload (Mirai)", "value": "4fd3225dcbd9cf14b2ddbf4f245463f81558e76e718efd03b9073c7863fcbcae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192675, "uuid": "76f65ee3-1744-46bd-a684-9ec9295e971f", "comment": "Malware payload (Mirai)", "value": "6bfe3e45ed033596f3c5620e9ee532dcb0f049d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192675, "uuid": "f4f3a2d2-2cd0-46bd-98f9-c9d86d5fab8c", "comment": "Malware payload (Mirai)", "value": "98f1cd26fc0018de5f7a6da821acdf4c910d69da4365c8cbc44db3e1461523f176c680852c46395564d933d57c2a0897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192675, "uuid": "f17895bd-febd-45c4-b1f4-ef37e09fa57e", "value": "T1FEC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192675, "uuid": "0df11413-2f91-4ec7-9789-92ca04388001", "value": "1536:6oB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dBJ:6KB4exMF7oZKJnCNYavJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192675, "uuid": "cb57a595-cc86-47b8-9923-12c9fc68493b", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192675, "uuid": "386ea8a5-a772-4933-b448-55eab8d4a0bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192675, "uuid": "a346ef7d-04a8-4eb5-bc7f-a5fe76fb9c27", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257b77a2-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770190987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190987, "uuid": "ad6c7b7b-101e-47e2-9e2e-4d5a3eeddc8d", "comment": "Malware payload (Mirai)", "value": "1d7f5fe93a49193020ab25f13ae6c170", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190987, "uuid": "69877add-b887-40de-ad47-914f1ae00f26", "comment": "Malware payload (Mirai)", "value": "50eb5a50663c0bf0014577b2abe1baff453aebc6a109aa7c283dbbbf20f7998f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190987, "uuid": "ddbce129-4999-4f5d-975c-37c9f6a5f2fa", "comment": "Malware payload (Mirai)", "value": "d78f90e2d5e3ce9612ee145c47ed8b3324d34568", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190987, "uuid": "b9544bc2-9bc6-4be3-b103-d6cf004b9197", "comment": "Malware payload (Mirai)", "value": "da99a408c69d87f8a6e8407fece761fe94f6ed76beb4419e402210684a817fb37e38b80b6afe3db4eeda999ae4a6ba9f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190987, "uuid": "255e8600-9043-4d03-801f-ec88b108b6b1", "value": "T1D831118E64B412CD89CFCE4070E54DC8670B9592F1942732EDC20E6BA09DD6434ABFB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190987, "uuid": "52ade4b6-4970-41c2-96de-43dfc4eafd6b", "value": "24:9Ddc+1mnmBM/h291bBV2wK6fwo7mgKLJ54HH9:c+1m3no7m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190987, "uuid": "83038a6a-c90c-4ec1-ba92-066f9f12d954", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190987, "uuid": "9e266a32-179e-40ab-94e8-1884d85a5a31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190987, "uuid": "7f08b27b-1dfa-4eb5-a300-64e8d12b0e5d", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95e6cf6-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770189947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189947, "uuid": "c990a303-c186-4173-8603-780bd3eb98f7", "comment": "Malware payload (CobaltStrike)", "value": "7aa06d439ff3a0154095cfde31becb12", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189947, "uuid": "30793d57-90f0-4186-bc50-f1d904623911", "comment": "Malware payload (CobaltStrike)", "value": "5267fff6399de9a9b8f1901e7596b641647a1fb6a542b391928c349074b34f6e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189947, "uuid": "cef429d8-0241-417c-87cf-101850364b3b", "comment": "Malware payload (CobaltStrike)", "value": "7c36c4b08e6574822b185de95e80d235358eab65", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189947, "uuid": "d7a17bb3-3d41-40aa-a335-52e4b62539f2", "comment": "Malware payload (CobaltStrike)", "value": "fc0de335a5b44e367be14ea6418c0da0b76115ebec0ab23c3caf88357eb2aaa2cc96c04b4e013bf62de18af85dba003d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189947, "uuid": "2eedf7ca-d576-47b8-813d-7e3eda49f7a5", "value": "T1FB753B17BCD118B6D0AA92328A6652A17B31BC441F3223D72E60B77C2F737E09E75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189947, "uuid": "36f0076e-21d6-4e5f-be8a-6a6391243a82", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189947, "uuid": "6231f9f6-e3e0-4723-b6e6-904786f470a7", "value": "24576:NKS0/K6Rc1HhIcGXCl2xz0GBkDOdbUY4:NKS0C6R5cGXCcRc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189947, "uuid": "e9871023-8eda-41df-9594-c36e3b38ce13", "value": 1579008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189947, "uuid": "683ffa2c-7a51-4ee3-85d6-69d9e569009e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189947, "uuid": "eeee3966-e753-4692-9bfb-147725740ff7", "value": "DataAuthSvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23200d6-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168084, "uuid": "15c0043e-9858-435c-b724-c0cc52409ce9", "comment": "Malware payload (Mirai)", "value": "0a9053c68b112c3e9cec21d8fe220b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168084, "uuid": "182bd4a1-b94c-4e25-8067-701a3797ef60", "comment": "Malware payload (Mirai)", "value": "527068bad9236a95a5b558505bbc2c452316d206ba56378be11e7de23b9c5d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168084, "uuid": "497e692e-2783-4e43-8bb0-745b85b44258", "comment": "Malware payload (Mirai)", "value": "df9f1a9f5db801775968af8bf1d4da5e2c05a180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168084, "uuid": "29bba5b3-d53d-44ed-9a1b-783d957a25e3", "comment": "Malware payload (Mirai)", "value": "40bbfd556ee83078ac8159fb543f90f6db114715d05901fff67b60e184081cc8d6b590815842ed553a73084a07b3ebba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168084, "uuid": "9e476d91-2600-4bb0-b79b-8e209deed1ab", "value": "T1F0732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAD2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168084, "uuid": "6f4adb25-fd6d-4a08-bcf9-5e5a5256db29", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168084, "uuid": "804162de-d409-4f56-b9df-09cdf12d73c1", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168084, "uuid": "2c2d0aea-23a8-465c-a472-26ee6e2a4089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168084, "uuid": "b35700b9-b6fe-46ad-9c3c-f7ed4414b099", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6063c43b-0160-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164887, "uuid": "447f0dad-c535-41ff-9433-ebfba2b1bf8d", "comment": "Malware payload (Mirai)", "value": "6b95c7f776c94c4fc9f3276a557a6b64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164887, "uuid": "a8a95d2c-31ee-4a59-be76-c9376e62e698", "comment": "Malware payload (Mirai)", "value": "554729ae1fc6a7c144dab6a0860a5930050b9a60f5277cb7744729922bd13972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164887, "uuid": "f9431108-98cb-439b-be48-e549df0eb144", "comment": "Malware payload (Mirai)", "value": "035e482036c301093ec168413cdbb4cb74850dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164887, "uuid": "e5d60311-8a52-49ba-b540-f284d224d4d2", "comment": "Malware payload (Mirai)", "value": "cfd45802343df992e951bd8dd1db7ba320b296632b99a272d9940e61d57ec2bd74fdd1ae687fe4cb0af8d0e90ae79eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164887, "uuid": "a37bbb34-9772-410a-998d-719410146e65", "value": "T1D3530275F1DE1A29E59F4132D5FEB362483960DA402083BACFB116FBD512EE10EED109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164887, "uuid": "3e9d8e2f-600c-466b-8535-b379b9d5c46e", "value": "1536:3A7CxBNulNPSUuTKdR7cwQix7dc6UBjBPmQhbC/Onouy8ZqJ+:wuxBNmNP5/w10c1BjBPmQe/OoutUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164887, "uuid": "530b1ffa-ee92-41bf-a837-b2ad1e59352a", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164887, "uuid": "c7597588-5831-4bd7-9113-9c1576fa607b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164887, "uuid": "f23556b4-4c88-41cd-b562-8dca790ee006", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856ab9a8-018b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770183417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183417, "uuid": "b2cf0ac5-ecd2-49ca-8c38-89c78d7a635b", "comment": "Malware payload", "value": "8f2a137e4829f33bfb59ab267e6755bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183417, "uuid": "935d52c1-5f74-4ad9-a552-91135d25ffb6", "comment": "Malware payload", "value": "5655095e0fbcb8f14a0a086f66dd9dceb92e126ee096eeb96c8718bf98481769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183417, "uuid": "72d6b272-1df9-45e0-af60-59f09f471264", "comment": "Malware payload", "value": "b3840fb4a6396472b68337bd19d2673e56c912b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183417, "uuid": "f8ad2616-0dc0-4e52-8e45-8e70bee38302", "comment": "Malware payload", "value": "751886ace612d671a517c401124741c8bc4538f3482747aaa12395a46e859ab8fd5e6b0de09400c98a302d2fa0d7017c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183417, "uuid": "aab90503-d08b-4e92-85b7-1602eb50428e", "value": "T15493F70AAFB11EFBE4AFCD3305A5174939AD691A21B52F3A3674DC1CF50A64B06D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183417, "uuid": "aa61a5d1-c89f-4564-9aa1-de2f5285c37d", "value": "1536:m5tcDVpHiufgBL5/dSoXLPji3hY0cKqeYCSIbS481dxuuW/btq9fZfqFX39wu7rV:mncJ0LPsE9wYYiiibAmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770183417, "uuid": "1ecc208b-7dae-4d0d-85dc-c4594c8ed676", "value": 89768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770183417, "uuid": "62bd3012-d623-48dc-8c5c-794d29e21e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183417, "uuid": "50cee7bb-fc74-4b48-bffd-f3d099aa7b05", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2fcff0-01f6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770229463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229463, "uuid": "789aa223-298a-4df8-9b8d-38f8f3cd47ed", "comment": "Malware payload", "value": "9da57684955dfc60f3edda14ca9a0b2b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numozylod", "colour": "#462056", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229463, "uuid": "8d22c706-30dd-4ab8-92b8-e54a7c330bca", "comment": "Malware payload", "value": "56fadf936077c6f947ad048bbc6e0aa2e482e2f949b5bdd9f7a4db7ed9bc08ec", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numozylod", "colour": "#462056", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229463, "uuid": "a64f017c-4ea9-488c-acda-93eed095904e", "comment": "Malware payload", "value": "6d3a5c8b65aef3ecc12427d64796d9f4374a73ea", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numozylod", "colour": "#462056", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229463, "uuid": "55820957-6606-44e4-98b1-e6e9efff9e71", "comment": "Malware payload", "value": "536f8f0c7f9db0f8afe499ad2fd57b20413abdc23c65c57b873c5bf45059170a4ceb156a28735c802e67e76dafc9fe62", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numozylod", "colour": "#462056", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229463, "uuid": "483069fa-4972-4fc3-8fd1-94ef31fa97f4", "value": "T185F59D21BD9EC536D67E4072AA68EB6B65BA7EF10B7144C763E83D6E0D708C11271F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229463, "uuid": "34dad6ea-64fc-4ee0-a88e-f0725501a749", "value": "49152:Bvgohlj9szAlopTyWD5AkEv53ruc39bfWW9CdDLwYj0i5MV3cQ3azCHknkQRAYYj:eoSTyBk7c3NEj0fk5gU9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770229463, "uuid": "29299c31-1b2e-4cbb-81e4-a12d8515b8c2", "value": 3649024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770229463, "uuid": "2064a3d2-36e2-436d-8659-0cdcb08890cc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229463, "uuid": "91a96903-0302-4531-b6b4-df1a6b9d2bf3", "value": "vi.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c7c523-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189994, "uuid": "a9259366-b4eb-4d39-9292-524c41134a6f", "comment": "Malware payload (Mirai)", "value": "82845dc5a43a83d8336e1da3f6fbf1ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189994, "uuid": "ccf5b874-3a2f-4f69-b697-edeb668c34dc", "comment": "Malware payload (Mirai)", "value": "574a4e182c529805b9a816175bb1064c80ac3e1ffcea385648bec1b80d2d50b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189994, "uuid": "d2b12c73-9b60-455c-8692-c4bbc0ce6808", "comment": "Malware payload (Mirai)", "value": "7dfb889d732e5c130f04ae8bf7bde87e8b21891e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189994, "uuid": "806d9f83-fe0a-4ddf-b914-e65bd00607dc", "comment": "Malware payload (Mirai)", "value": "020e1e1d9f003d1e16d5cf1f9c15d5a8c95a838cfac37ca0a74de845facb957d05f5c6f6291587a343d0e7baca601714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189994, "uuid": "f4dac08d-e4e5-4ab3-99cb-e237bf1d4136", "value": "T102B34B037B1D0743C49B69F02CF73BF18B69B9B116A361C0A21AEFD45772AB02526F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189994, "uuid": "7f6efb46-0640-41b6-a5f3-7e65230ed1d6", "value": "1536:na2jlqntGrJ77nScc+i4KT1FU2muwpVJ071oqia3jMmJ47VTJ5SzuPfO:nh8tpfP1K2K7J6o7aTMmO7VTJUzuPfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189994, "uuid": "b5d0ebb3-9e57-474f-b62a-01e8d9a928f0", "value": 108211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189994, "uuid": "dcfb16b9-23ee-488f-8e96-8a0b1f72eee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189994, "uuid": "84641769-6e22-4d0f-86d0-a58d66bcd2aa", "value": "pXdN91.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd858e5-01c1-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770206570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206570, "uuid": "927e668b-713c-4885-a076-a23c73bf98f9", "comment": "Malware payload (SalatStealer)", "value": "6e99d38567b9afd73542657b34abe920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206570, "uuid": "8ed3f0b5-6e35-4b6a-b432-d516c5b14478", "comment": "Malware payload (SalatStealer)", "value": "57d6e4e26be05d960103ed4fe8ac22323b4e00fdfa04d23260bcf632eb50cfa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206570, "uuid": "0d5a835f-6914-4218-989e-de6942e626a9", "comment": "Malware payload (SalatStealer)", "value": "14faaf209d2ea16516e4ae25272f36dc44be3f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206570, "uuid": "e412cf27-8b4e-48c3-86c3-43363f4884de", "comment": "Malware payload (SalatStealer)", "value": "e58c2dfb5967b5d44256aa213fdeefbd5cee7d34bcc9325bc7dc0f268870a55636b734e9877b0c3eb2d27bf4d4f0a50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206570, "uuid": "c8923b75-9937-4731-9665-fd632345973e", "value": "T1F4E533594D4A02C3C16604F9DDB728574CC44E7EE086A3F5A4F679C3B27EC2D13EA662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206570, "uuid": "c739a7cc-0400-4f0d-9520-cf415b74f6ed", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206570, "uuid": "6f82814f-eb97-4065-8a40-02fe5b496ce7", "value": "98304:8ut/Ox549cjmobS+5spyFg8mz5y6Gn7eNd2zATv:8a/Ox43uSMs0FKG7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206570, "uuid": "106ab736-c4fe-4c8c-8688-3b52011371ca", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206570, "uuid": "e750a0a8-1a83-4b9f-98bc-802e91b2f65a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206570, "uuid": "61e45a4e-d676-474e-a967-83bdc707a50e", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7773ff7f-018b-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770183394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183394, "uuid": "1f045726-c512-43e6-9746-b6800820f31b", "comment": "Malware payload (Vidar)", "value": "264a178552a1a123a6c7f148c4607638", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183394, "uuid": "9de1b95c-9157-4982-8c35-4b7aeb0385e2", "comment": "Malware payload (Vidar)", "value": "5879244258028de025460a83ec2ffb675eb377d2d1052a82915751108df82388", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183394, "uuid": "ae482f9a-9989-487b-98db-1c6ad8c29d01", "comment": "Malware payload (Vidar)", "value": "1f520df4738428695a1f25710f39f7d1a4f7af92", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770183394, "uuid": "d8176dcb-7641-4c17-8e8f-a24b17cd031e", "comment": "Malware payload (Vidar)", "value": "fc8b6b394706ce663b046412f1589dc86a0e4a92271eee6e5b244b280a240886ddf401635397a2d6cfb8b6af4cbaae0f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183394, "uuid": "ad7daa67-508e-4536-aa2b-9caa3b06ed8d", "value": "T15096297F729592A8C26D853FC0A3CF40E5F372761B33C6E7129107A9CA468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183394, "uuid": "6c75ae95-57f8-4d66-a87f-27add54e40bb", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183394, "uuid": "1247d4fb-8175-4a08-97da-70e0097705e6", "value": "49152:uNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgxQ49dpJM3dFxFdx:uz7Vp7dQ49dkDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770183394, "uuid": "4ba411a9-8289-448c-8f9a-b55b0d0c2055", "value": 8767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770183394, "uuid": "037e0419-5b49-4f27-8d74-4468e37fcdaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770183394, "uuid": "ac93bd2a-9f40-452f-9577-2f945e049a7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1820a052-0195-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770187529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187529, "uuid": "7b87fc1d-b62e-4a84-ab73-59586fcf47e2", "comment": "Malware payload (Mirai)", "value": "167bc2e0ba830b08065c305913a2c978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187529, "uuid": "ad57fc00-50fc-469e-bebd-039113e87c35", "comment": "Malware payload (Mirai)", "value": "58b186d458c28353bef4661768d909c659f7f399406f3a22a43e900166463fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187529, "uuid": "aa9d80e7-0b4d-4c32-80dd-a25ba561dcea", "comment": "Malware payload (Mirai)", "value": "60e63376edd87f09d02ee8cbf6b2dc9b91467128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187529, "uuid": "9b130345-3125-4357-97bb-774e5b28bf6c", "comment": "Malware payload (Mirai)", "value": "3bfbdc92312c97d188da68b6c60657c6c2af13fa1db7c09c1074f5cd84955551e9d83ac01917fa1de0b76da6bb9d4ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187529, "uuid": "2c292b76-3c42-4a3b-b668-5ed94dc9e43b", "value": "T147D33A05F5508727C2D327BAB79E465E37331BA493DB33215A34AFB42BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187529, "uuid": "13e3c01f-ce0b-49b5-92c5-8efa698c7031", "value": "3072:AZJaCSEXv6sCU7u0mEBFR2cj1WBwyDvpU+mXQ9azXN6X:yJaC7Xv1mEvR24+xU+mXQ9azN6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187529, "uuid": "fec7e687-8d74-42ff-b8bd-bbb675c8f6b9", "value": 134109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187529, "uuid": "f9211f4f-3c5c-421b-bda0-731aca3e9d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187529, "uuid": "30e85c5c-f74b-4f46-835b-bfa6811f117d", "value": "pXdN91.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cb596f-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168087, "uuid": "f4997a37-22b2-44a1-ab32-0f202285f738", "comment": "Malware payload (Mirai)", "value": "a1128b8c042bd72adf8edff1b9ec7abe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168087, "uuid": "db0cfe2d-4e64-4802-9303-b7e2bac1f955", "comment": "Malware payload (Mirai)", "value": "5a2190ee10c89b85b3908c5078516406ff125518310e1a06d95d97ff121bb54a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168087, "uuid": "541efc7b-749f-4d68-9336-5ebc6ef7a87e", "comment": "Malware payload (Mirai)", "value": "6f12fbde4235fa2e15c6a695f9ca91f3e23c353c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168087, "uuid": "e673d7f6-8d3f-4f1c-b125-c15eac15d0a0", "comment": "Malware payload (Mirai)", "value": "276381e021c896193334923b5334ba55d3117cb1d6a4b5e50fe2758d76cbea0c49082d6a503eb5d17ae8cd11f32d1f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168087, "uuid": "7e2e1e6a-045f-47a2-bd7b-8b2c8eca5462", "value": "T1CB6328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168087, "uuid": "417512d6-ed9c-4c14-9526-6460bdff75cb", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168087, "uuid": "9c034bdd-a861-44e5-aff9-1cee3a3ddffe", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168087, "uuid": "d6fac997-145f-4a06-aa24-8c1522a08678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168087, "uuid": "58c6d574-92d2-45a1-adda-8fd603f779c6", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3aa50c2-01df-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770219680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219680, "uuid": "08313d8f-05a3-413b-a327-2775947241f0", "comment": "Malware payload", "value": "8f8fc7f7442eb1d14acf3593e773463b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219680, "uuid": "947ad669-b5e6-4356-97a4-9c1cc89c7336", "comment": "Malware payload", "value": "5a616be3a292055d1bfb135bf6ad6ff9be4cd4e8019f819bead20937e2dd96b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219680, "uuid": "d116c050-3b4c-4288-8318-108b9e9a8ff5", "comment": "Malware payload", "value": "e8bff616100ccd9452362f90d0d3f94b860d2bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219680, "uuid": "61be38b6-a324-487b-90a5-7d2a00067534", "comment": "Malware payload", "value": "15907b94df90158fcdd2f6c08c1770cf2234b6aa17deef96575b3a69a1ec7783274524e7b34e7b949373b7513b83f54b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219680, "uuid": "f23c8146-0937-42c5-8094-8d12d46f0eb7", "value": "T173F6339973A508ECD8AEA17F91E4C25B63A170E703A0928F57F20D520F271E5EE35F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219680, "uuid": "947c0753-b4f7-4678-b72d-3b89211fa134", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219680, "uuid": "3fbc1375-7b9b-4358-b013-16917004ab63", "value": "393216:Xip6jW83Kq63hucw1+TtIiF4uARuAMdS9QVlNIIKQEM:1W8ab3hrw1QtI1uA8sMl6IKQEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219680, "uuid": "a1a58088-82f2-47a8-9db6-908e2e08c031", "value": 16402198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219680, "uuid": "0b38480e-2b63-485f-8b44-ac8a05caa92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219680, "uuid": "a0eac130-bf68-4f20-9bd3-98bf586ce284", "value": "5a616be3a292055d1bfb135bf6ad6ff9be4cd4e8019f819bead20937e2dd96b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39bea87-01ba-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770203788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203788, "uuid": "6cb756ea-c783-49c5-9757-13c9f4ea3b84", "comment": "Malware payload (SantaStealer)", "value": "176e52da5ad8ff6965b7ba77a516eda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203788, "uuid": "2fea3de2-388b-4071-8520-b6372fd8f287", "comment": "Malware payload (SantaStealer)", "value": "5a9a4061a9a2654f6248c4f4f2ed4c86e6fb23ba460f63d58007a5c5b81d5102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203788, "uuid": "f4654d47-4c06-4ff3-b52d-55538e84a906", "comment": "Malware payload (SantaStealer)", "value": "6acc70a26c18d5f5100620e97f75e87196cf034b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203788, "uuid": "24c5220f-d24c-4f7c-bc1b-752dc876e846", "comment": "Malware payload (SantaStealer)", "value": "5336a7ddbc66b91c1ce3104bc000de23ed76db07166390a33b8d0c1f5248bcfbd518064bfd7e0473d3d37306ddd11b25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203788, "uuid": "0c271004-ed62-419c-a9c4-cf54323ee8cf", "value": "T1BFD59D0AE65349D5CC6BC0BC838A7131EB357C79CB282EDB17D18B613E55B806729F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203788, "uuid": "92629f75-d191-446c-ab86-45853ab82dd5", "value": "bdcf6640dd39be2f9b3b5476d898a6dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203788, "uuid": "764b51e7-dc26-4683-8a29-4f6e9ef0e581", "value": "49152:hFV9AwLgW0B2MXHZeGLzCnx7Rt80JjIGr2yXEJmgS/scEIuBZ:YpW0jZeGLzkx9KAjcyTxP+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203788, "uuid": "e699ffe5-0e44-4608-8d12-ab6b6a7041ea", "value": 2984448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203788, "uuid": "eb68c1ad-2dcc-457b-9af9-b7236aa077cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203788, "uuid": "88329fe4-5f5e-4a69-8adb-786c794019ca", "value": "561I3N96Z085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1c2e30-01b5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770201278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201278, "uuid": "b1504931-143b-4ff7-b8df-46ffd193f45f", "comment": "Malware payload (RemcosRAT)", "value": "e92656c793d3bd9e3698d4b25b40b623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201278, "uuid": "c4ddca4f-9a1c-40be-8133-28d62d6c0f55", "comment": "Malware payload (RemcosRAT)", "value": "5af513338418844a6202140f439662cc703e801e8195c2c632161b63594fe93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201278, "uuid": "9025d1f7-5107-4139-aab5-09e32669c260", "comment": "Malware payload (RemcosRAT)", "value": "18383f6caa8a13d7899e5a96d9ceedbac414695e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201278, "uuid": "ea1070d8-aace-4bcc-86b2-3d253d0c0749", "comment": "Malware payload (RemcosRAT)", "value": "d0f951a151bd71ef9442d75f67f92fe0c2f36e1add8cc56eeb3013f725aac348ef11a15b1251d75e65fd45a940e83dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201278, "uuid": "643672c4-f00a-4d32-a8d6-03245b0b17b4", "value": "T165441205B285E177DAA009325DBAC67B67E0EF781197B31B1361AD1E3C6031DCE4E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201278, "uuid": "4c278786-d73c-445d-aa1f-35fb8dd12371", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201278, "uuid": "7f2cfc1d-3657-4cdc-a91d-3833281d3639", "value": "6144:LIw3fOJ2Scr5jQcBbRC/c+hHwn3kGCqQMi3B:7OirR9Bs/o3XCPMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770201278, "uuid": "0384611b-e2ad-4cf3-8ba5-0d322dd42350", "value": 271232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770201278, "uuid": "62b0f25b-df07-4992-8e83-28df93934318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201278, "uuid": "0046fb25-fc51-438f-8f21-994f1b0e4d3d", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7402405c-0202-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770234498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234498, "uuid": "687a81f9-bf95-4c37-949a-48c75d986619", "comment": "Malware payload (Mirai)", "value": "895b55a7837b4047273a393efda18a82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234498, "uuid": "9d7b7cfa-cfa7-4b2d-9d63-b1961fc39579", "comment": "Malware payload (Mirai)", "value": "5b8423e0a7a241ed3b4f336e7ee8f816b0627f736c8b1831202783109a356ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234498, "uuid": "fc278613-3857-4c2c-9eb5-edff14b25a7e", "comment": "Malware payload (Mirai)", "value": "c9e62c6cc63afd5034998d68c3595035b76175f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234498, "uuid": "3d51b419-fdfc-4624-8551-b515787e71ac", "comment": "Malware payload (Mirai)", "value": "10eb73919727bb9788f002a3d5635e504d55a5bb2d7b41499f4d4060064d4db89db95fb26f0625e3628e4aa88444a01d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234498, "uuid": "f120d002-e5da-4715-b969-9f12bf24eac2", "value": "T17DB3F78ABD815B11D9D522BEFE5E018933535B7CE3EE72129D205F2463CAA2B0F77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234498, "uuid": "5beda715-80b4-4322-b4a9-50a743c74aad", "value": "3072:bqiy9qVvpOFnQfG/7/0NZYjYhOn1NaVF7h1ubWczgflZI04MbZP:bqiJKdQe/7/0NZYjWK1NaVF7h1Hczgkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770234498, "uuid": "1ccc7a3d-caaa-464c-8c7a-c120358a5779", "value": 108572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770234498, "uuid": "a5055c3b-2d22-431b-a38f-ffcad4464142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234498, "uuid": "6d2ff746-585e-461d-af33-429fb7b1b264", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ceb44e-0206-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236377, "uuid": "28fcd59d-ab40-4610-bb65-916f1f6cabe2", "comment": "Malware payload (Mirai)", "value": "b413e60f61e411af78872bd6739a0ce3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236377, "uuid": "011617ee-f851-40f9-9e9d-4a2dd898f3e5", "comment": "Malware payload (Mirai)", "value": "5c0fa4d86c8f1b433dbaca4d842f597ff92797429ee96a6df7a2b284d2f8f16c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236377, "uuid": "1438d4cc-2734-41b8-814b-4861f573462f", "comment": "Malware payload (Mirai)", "value": "1037ee815ce7c1fcbff7c2acd3c289b2661d121d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236377, "uuid": "effae5a7-5526-4f69-89d7-5a04b25ccd2a", "comment": "Malware payload (Mirai)", "value": "116d9e01fda8fd6001e274d5be0c70558e0f20648caecd8dac06698c6099c105f6dc34d3c77dc40489c8c0dd40248ad6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236377, "uuid": "1b0ea0b5-ae45-4d5c-9c81-e6294db4e880", "value": "T156C3A80A6E12CFBEF65A837447F78E21969877D72AE1C541E16CEA401F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236377, "uuid": "5199e963-0722-4c39-b6f9-19dcd8d86520", "value": "1536:4iYn6VptBfjYpt/FLi6wf1YzoRaE/aseM48HZwLg9cEeriOfdXcR4:/p/fsptg6wfSoRaPseM48e4cZdXo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236377, "uuid": "acfc9b2a-be66-4280-af62-7455875b9b94", "value": 122440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236377, "uuid": "0e8a5477-86d6-4e10-ae3e-b8ce78f01be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236377, "uuid": "4cd86acf-8b6f-44c2-a7e8-71f49d5bf911", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e37453-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770181960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181960, "uuid": "3bf445cf-b0d3-4147-9fdb-df6e5e7ed672", "comment": "Malware payload", "value": "7e94fbb8330f2a994eb2f707aac45c14", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181960, "uuid": "26121606-0ff6-4f11-9eb9-9ed107accdea", "comment": "Malware payload", "value": "5c70a7edff808a2fc109f26ebffc728cb39a3b28eb492417302167292f83dc44", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181960, "uuid": "db4fc2d9-1b9f-4597-9235-cd3c22798ef6", "comment": "Malware payload", "value": "1a016becbfbfe9d4a8cc28511c096942b415bbe7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181960, "uuid": "5bf1bf6d-ab08-4607-85e7-203514799cd7", "comment": "Malware payload", "value": "7e417121dd7ef892a7f0b707e6a218c49118aeca0157c79b81f17ba4a0bec91e19371c924ddec37bae28d8d56c99140d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181960, "uuid": "915e2e7d-07f8-45a9-938a-4f899284e98c", "value": "T117B3BF2EE74F0915DF55A6BB034A4E490AFCB33DB38140A139AC977437ADC2E466287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181960, "uuid": "27ea0f7d-7bde-46db-b7ab-8975158ef360", "value": "3072:MBKQCtr8Fa2PGFkrKvxXwT66wP/WlwVI+fBjeghaMn01oOHr:H5roZShWjwHawVIEAoaMn+oOHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181960, "uuid": "01354fcb-b6b2-422d-afa2-d37f59322720", "value": 115645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181960, "uuid": "7d3793df-a93a-4941-a5bb-0492bb36254e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181960, "uuid": "1fd99241-b9e4-4c5c-b5ec-0b3a85b7ca64", "value": "5c70a7edff808a2fc109f26ebffc728cb39a3b28eb492417302167292f83dc44.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0b6de1-0200-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770233631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770233631, "uuid": "668e71ef-430e-4826-83bc-734f4a5f7ba9", "comment": "Malware payload", "value": "e970e2d981aeb3c75dff5c82d1e62863", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770233631, "uuid": "727ef53a-f4b6-4013-93a2-4a8b5ecb1747", "comment": "Malware payload", "value": "5cac6ca41c3b7e3b107afa3e5db6b8cdf2a3cd819366579eb632a7fc4623e5c4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770233631, "uuid": "c68ffb08-d7c9-4a6e-9824-b537fc9c425d", "comment": "Malware payload", "value": "8e0bb1fcf4a6577b43548d769a8267f504ed1eda", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770233631, "uuid": "2a9ea104-a3b6-4f57-a47c-18a20ee8e995", "comment": "Malware payload", "value": "9d33af14b1d7a0b56e8a3c4d938d0e962b6ada08f307d78399428701b8a49ab06e15ad110b6be2fc65726ccb9d5a4cc6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770233631, "uuid": "95e2cc4b-9ed9-45d7-a6ac-6bead9641e70", "value": "T1785733BAE4228B8FC87B4175C9F1592F62753F386A9159771064B2A96073FC273FE102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770233631, "uuid": "7ff54425-59e5-4816-81b8-4df250b954aa", "value": "786432:0Matu0QdCV59ydUEDGkm0vyXgFCWK0IWVLOzrUipHft5i:1sZQdCVjCpWXQRLOzrUipHji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770233631, "uuid": "0f3eec34-226b-4c6d-bbc1-2b5df13589aa", "value": 29466624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770233631, "uuid": "2ae0450d-62e1-4e8a-90b6-24cef3901b41", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770233631, "uuid": "2964f5a7-af59-4b5a-a3cd-f8cb20aacb99", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6dde2b-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236603, "uuid": "9eb905b0-30d9-4121-9557-5c47ac367ace", "comment": "Malware payload (Mirai)", "value": "773248a91b8a8f4936901333b2eb0346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236603, "uuid": "937ffdf7-e82e-4b8c-9418-e8739782c7e6", "comment": "Malware payload (Mirai)", "value": "5d31d18275f1f82fb746d0b51be9eea2695e148a51f050637e842915ccd78e9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236603, "uuid": "185c32b1-d2a4-491f-aea9-969942e2f7c1", "comment": "Malware payload (Mirai)", "value": "c1960a9fb04a0f9e128eeae28d948680a3906314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236603, "uuid": "45432f40-6e37-4999-87be-a9a81cda0076", "comment": "Malware payload (Mirai)", "value": "8e78bdccdd96dfb82eeb9083916788859cea6c23b1380ddbca2702f93b0dd2a3bdce07bb31b64b81067a3f5fa8e3e9e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236603, "uuid": "8026c97e-769f-4656-8dc4-f99d5be1de56", "value": "T1A393180377080F47D06329F426BB1BF087AABE6119F8B685751ABEC59370DF26142F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236603, "uuid": "53067995-1489-4a22-943a-66d57867a112", "value": "1536:SLBqCABm4a7b6YgWi5sjSmWhTYl8Pjvhj4XqaUcNqLgpNnrcOvFBKKPB/:SGfY932Q4v+NqLorT8KPB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236603, "uuid": "88c76136-b2e9-46cb-8dd1-6c8627538bd8", "value": 92944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236603, "uuid": "2c319a9e-1618-4704-a831-7e0782850624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236603, "uuid": "15db5dd5-61c6-4aca-b838-f70590229b99", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c276a13e-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189962, "uuid": "5376698f-e714-45c8-aa36-73c5c476aa06", "comment": "Malware payload (Mirai)", "value": "c5dd1035f2f5ddc158d6c0e52015198a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189962, "uuid": "52341fee-26e0-4078-87bb-f84c29671206", "comment": "Malware payload (Mirai)", "value": "5d7b181f932613223dce553bb181778a00f2733f083a2f1e06c2664283b211e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189962, "uuid": "7b10570b-fa93-4d7b-9634-f57d0599c993", "comment": "Malware payload (Mirai)", "value": "eb1da0d33b7b4bc2c661d603c55e07c5a61e766d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189962, "uuid": "c87b83ea-9462-44d2-9e1d-92e5b29eccdc", "comment": "Malware payload (Mirai)", "value": "735af5193a6b4a6cdb06ba97b79b433f42797b43781c455b81c3a5a8d341cdd37bde2683b189c534891fe66cd773c2b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189962, "uuid": "418aeaf2-a1e3-4145-91e4-b010d70ccb4d", "value": "T102B3930A7F600EF7ECABDC3746DA2749249D241A21997F75BD34D818F24A24F19E78B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189962, "uuid": "c0509e62-c764-4ae8-b8db-13480053565b", "value": "1536:XLRytC9YrjD+jr8CDaOs5ViW1GmMf0yrSxp8NMjhZKmACctK:XtytC9YrjD+jNDCF1GpMjhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189962, "uuid": "27fd2c4f-3073-432b-b62d-9b83e7e8565b", "value": 108704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189962, "uuid": "ee8a8c09-93b4-47a2-8812-26c1d4eb607a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189962, "uuid": "1b2fdbb2-0182-476e-be24-292eac21523b", "value": "nullnet_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93a59a3-0161-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770165438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165438, "uuid": "25fe90d3-1358-448b-814c-51a253a8eaac", "comment": "Malware payload (Mirai)", "value": "33c7593ca17ae875ba92b57880d8b2f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165438, "uuid": "062a30a2-337d-49cb-b639-1999f879251f", "comment": "Malware payload (Mirai)", "value": "5dc87ef613f5097165fd822694636c55fe52c867bed18136a8a29c85c5f955a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165438, "uuid": "c6862078-670f-45ea-9da4-990febedb40a", "comment": "Malware payload (Mirai)", "value": "609dc8dda8c1c104d9609e84e6e032df29bcc814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770165438, "uuid": "09e85c87-1cb2-4e77-a3fb-765643846d5c", "comment": "Malware payload (Mirai)", "value": "fdd594768b440f8d0598b03bf49fd35670735e75dbb58f735dbfda13905adab3861696a2cc7097d6563d85d68367d72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165438, "uuid": "ed4acca9-a4f1-42ac-8c0e-cba9392a2aa0", "value": "T12393F8CABC858B10D5D525BAFE0E618D33539B78E3F97103DE185B2E638AC6B0A37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165438, "uuid": "6545eab5-d263-4937-8be6-8c0de609b589", "value": "1536:u2nx9w+IPNz15ssuzkfiD/EBJYfUXqBwsWht0wDrl63QOqQf2lfgiqIXTZ:Y+IFruz6iD/EBWfUXqBwhywDrl63QO4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770165438, "uuid": "4f8f4053-caed-4540-9998-e17989afe380", "value": 89540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770165438, "uuid": "31e83853-702f-4e47-a9ae-61b55c1f081b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770165438, "uuid": "b78c5f09-8bd6-4053-9a6f-68ae3b18a15b", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b9c647-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164122, "uuid": "34f68bd4-bd96-496c-9bb8-c6c5a638fc28", "comment": "Malware payload (Mirai)", "value": "edbc38dbb63acdd030076aad806f1eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164122, "uuid": "0b4f08f1-fab5-4cc4-b30b-15d787745d9f", "comment": "Malware payload (Mirai)", "value": "5f310352417e71c4792bec0dd2f7ced42f2dff9d78a86189082ef639f4f31000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164122, "uuid": "9b8d59ec-7b0a-481b-8fda-384aa59aba29", "comment": "Malware payload (Mirai)", "value": "cbabc784029882762145ff70054088ec68c9617c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164122, "uuid": "1a54f60c-3f6e-440b-8680-51b72fe946b3", "comment": "Malware payload (Mirai)", "value": "fcddfc5e076147cd676250f62e376d6ddc6572bd150b3c811933cb6dad1310c91a4413723eeb595bb6642c7087add5d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164122, "uuid": "6be8e84f-5b37-4ce1-b48c-64cbe9fb8100", "value": "T1EA7302C1FDD92140E87BBFA32C5C7871BEF84DCE719DA90250E89E6927195784B060AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164122, "uuid": "20b22002-cb14-47fb-8ea3-b2da225b63a9", "value": "1536:qdxp/AkV0OC/G2dblDisxnroD2iqno6cudjBWr/4u+qgw01WXQ:O74kV0dGslDi2cfltudjBo4u+qgwoWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164122, "uuid": "e94bb678-e74f-47f2-ac22-f4130711483d", "value": 75656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164122, "uuid": "5308d458-f036-4387-9456-b1114da98ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164122, "uuid": "b53ba165-50c8-4d7a-860a-53c6b62f4781", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d87d9b-0202-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770234496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234496, "uuid": "a04f0860-42d7-4272-865a-77363653a9a5", "comment": "Malware payload (Mirai)", "value": "e172d9b72e3744863b658d859d968968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234496, "uuid": "285d2a17-0076-4737-8a06-788a02769be9", "comment": "Malware payload (Mirai)", "value": "606d2225d4fb8fb2da4db717d641d04d37ea532e25aad0653d94094d418d6d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234496, "uuid": "c7bf2261-b971-47d6-86b7-a2e01a9d990e", "comment": "Malware payload (Mirai)", "value": "ff231c30f84bb267dd77e7a4cd8807dcba5369e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770234496, "uuid": "35d09897-322f-485f-a748-ac8082c22a37", "comment": "Malware payload (Mirai)", "value": "cfe8c32155aea944f122738eb8b42ee27383834b243cde0f028942d2f2a2b16cd346959ec2ed9aff1c539cb745fc2ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234496, "uuid": "f4830d59-dbee-4c7e-8ba0-27b94ceac070", "value": "T1DA636BC0A683D8F5F95601751137F7375773F63A1039CA8BD764A832AD62600E62B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234496, "uuid": "f1574e65-7e28-4253-a7c6-7fe1d00c0fb4", "value": "1536:Xcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u8xg:XcICl3USMsTl9HUrS6qs3TJ7LYK4fQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770234496, "uuid": "5685db07-dae2-437d-8ea6-01254e0f105e", "value": 71620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770234496, "uuid": "85c299ba-5707-48d7-b2ae-247d496b73bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770234496, "uuid": "6f3281b0-0d46-415e-9ce0-c40fb25905ab", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f1763f-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236600, "uuid": "6f57b48a-a6b0-485c-9fa6-992c3078ce72", "comment": "Malware payload (Mirai)", "value": "98d33cd6a694dd7cdd343f0695dec060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236600, "uuid": "e71c982e-7d9f-486f-8e56-013b38ced14a", "comment": "Malware payload (Mirai)", "value": "608570099ca03cc14068c55c2066ea8a2af298476c926b10b5596d66e48572e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236600, "uuid": "c73c64ca-fdc5-4c93-9c2c-2d3a8cd899be", "comment": "Malware payload (Mirai)", "value": "68943613a9a1700e3f97febe978b1445ad66e2c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236600, "uuid": "c988ad5e-82d9-4cdf-86eb-567b5e865de5", "comment": "Malware payload (Mirai)", "value": "340808cd35a5afd5651533e4d5f31dff89c7a2ec4eb220335d733a47bb2d3c6d73910fe371c515bd7f69d4c1978a7b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236600, "uuid": "64698ada-96ac-43cc-ae68-6815bd6a6c1e", "value": "T1D783E842BA47CAF7D50718F041B7A63F8E32FD3A4832859EEB65FEA5CA231C15116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236600, "uuid": "93be0084-f5cd-4fa5-a6e7-2e79dad45882", "value": "1536:4fIieF1kIrmfIW6UugNnWqSyjk2sPJ2V7W5IM8etXGhi7aGAVWzL+8:4fJeF1vrmAWfNnWqSyjkb2k2M8eNKi7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236600, "uuid": "dda0c82a-56cb-4b52-966d-5630ac09a4df", "value": 87276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236600, "uuid": "1dd6933a-288c-4887-b330-0a215f6307ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236600, "uuid": "439fabc2-4e0a-498f-8dd6-d90d3aadf1da", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae906809-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182198, "uuid": "8967bb04-6de9-4914-b2c9-cdc43c183c14", "comment": "Malware payload", "value": "b9f212180b995a2119d83ab6a9bfd460", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182198, "uuid": "b54d6b28-591c-43c0-9e8a-c17db2867056", "comment": "Malware payload", "value": "613cba42dcb2a479eb613fecc31887ddb3e29f0b68eaf5992721198c8d292cd4", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182198, "uuid": "cdb62470-a349-4f18-b7a1-aea1c2342ceb", "comment": "Malware payload", "value": "b379bd5497c0e0a66a1209a5a8f66de2c9f70692", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182198, "uuid": "569e1ace-a188-435b-a103-4afc4bf0b3f8", "comment": "Malware payload", "value": "4d8a393513fd57f002401e741ceab5b3d40f843161a418a0835be163c8e7589963ce2c8757db6710a4d5cf76146975ab", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182198, "uuid": "3c4d348e-183f-4ba5-8396-fb2e9fc8b8d6", "value": "T18D752315F5824FA1E4EE3A3C85D2DAB611297D3A57946E23735A371B60337B202DB38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182198, "uuid": "1280cd0f-ceab-4238-aca4-664465c0cdd0", "value": "49152:t4EZ1xcyLedWf9K0uzGzdyk/PXfd21OYY2M6:m41xcyLZK0QIyk/PPd2Id2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182198, "uuid": "8311758a-9583-4dd4-8bcf-00341732ccae", "value": 1653760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182198, "uuid": "e45ffba3-8dac-41b8-af07-c79b55bfe163", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182198, "uuid": "200ada28-bfbf-48f5-823a-c3e0e533ecad", "value": "613cba42dcb2a479eb613fecc31887ddb3e29f0b68eaf5992721198c8d292cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce4390a-0179-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770175833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175833, "uuid": "8048f3fc-7a37-410b-9b2c-a2cb08b5349a", "comment": "Malware payload (Gh0stRAT)", "value": "b4a79aa404af3adc75326a9f9b3618a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175833, "uuid": "429041ce-e184-433c-a558-a61872e5929f", "comment": "Malware payload (Gh0stRAT)", "value": "6152b2d71d575a61f12a0d7cc56ac04387493c330b1fb8c934f5e1b9f755ef53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175833, "uuid": "684aba42-3cad-47f5-ac3e-f0a1bfc7c56b", "comment": "Malware payload (Gh0stRAT)", "value": "8df652dd563865dfa66649ce2f4b2ffdb4ec953d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175833, "uuid": "ab2ae8f4-d225-4626-9d4a-cc1612cf3340", "comment": "Malware payload (Gh0stRAT)", "value": "2a319cf869f7dd5573f369197fd0f09435bc54c8beea19e2c754ab058687012f70be8ed5eab5b091e01716ba754e3cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175833, "uuid": "9a2a0014-1661-4d21-8df8-52d9fadb2803", "value": "T1AD273313628B653FF47D8E3A49B3D216183BBA2165128C67ABF8485CDE160C52E3F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175833, "uuid": "172c2a47-b2b0-4611-8730-5093b967853a", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175833, "uuid": "43317c29-79e4-4e7f-8f90-8a764a059c97", "value": "393216:iwFgnEMjT/PZK4CValizrtAsrTcX2uZQIBM6SDAcaQ+/uv4XDN8Rw4NmoouqO8:hYEMjDcz0izBlrTc3Z39EaQ+/uAcgq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770175833, "uuid": "3fe85096-ad4f-45bc-ba53-2052d4a25dab", "value": 21717742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770175833, "uuid": "8abc4290-009c-4035-8539-74f8f8c12adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175833, "uuid": "76631862-ff88-4aa6-b7b5-9c93b10effb3", "value": "cloudflared_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640b076d-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168329, "uuid": "04dfbfd1-dcf7-49b4-9dc4-130b00877863", "comment": "Malware payload (Mirai)", "value": "525ac41d26f17fee12e6ba17754da505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168329, "uuid": "ea8ce1c7-cf1e-4837-84b2-bb5ec7884f1c", "comment": "Malware payload (Mirai)", "value": "61d94f86c9633a004a74c97e23af8e0a4764cf2f765f481c83cf035241e23439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168329, "uuid": "a480752c-a012-4e8e-a8dc-f232f27e0b15", "comment": "Malware payload (Mirai)", "value": "e48c90cd04747a1671c85a21935589de99946c09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168329, "uuid": "9e3c12e9-c2b8-41f0-bc93-154c9089af0a", "comment": "Malware payload (Mirai)", "value": "a751f9ab5225bd4b079531881a8318a5d157ba3dd1dc8c429afab1cfecf96b75bb3d03dfff86d0716c3dc1cc7d21edae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168329, "uuid": "8b81e885-9beb-43c3-9118-447757d39b37", "value": "T157633A87A54550FCC198C17843BB7636C863B47D537EB2A63BC8BF1B294AE605F2D40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168329, "uuid": "61db959e-3a17-42ea-a1af-7f184253da40", "value": "1536:GZ9CBJ9BdpojMJ2yFRPrkaajV84hCi20hZ0j25s0zLmju:pf9BdpAMJ2yFRDkLzCiRb0y9Lmju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168329, "uuid": "5d6b2679-8a02-4ef4-9cce-c37db75bb67c", "value": 67360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168329, "uuid": "180c00ea-1cb8-4e5c-873d-20107af6522b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168329, "uuid": "048dd05a-687e-433e-b505-3d1894649da8", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d46b8c8-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164318, "uuid": "7180dbcd-ba7a-4f79-8364-12a9bcda9fb0", "comment": "Malware payload (Mirai)", "value": "91a85e9b8d3be6f632b604faa80e219a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164318, "uuid": "9ae4e8dc-9a2c-4d11-9f30-94870f5ca3bc", "comment": "Malware payload (Mirai)", "value": "62a2fe55b09cf1558d762fecc3dc530fb4161e7713f4b84c53302cbea073b6f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164318, "uuid": "636999ee-b7a8-42ce-a9ec-70884a942907", "comment": "Malware payload (Mirai)", "value": "0ae14a6faa0b1a3d67ef56da88edc52b825c6658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164318, "uuid": "b9f7a2e8-d066-4522-b329-fb737ba536e6", "comment": "Malware payload (Mirai)", "value": "fc97194976180dd6bcaf0385f8e1c351414bb683611e85cec7ce6a2122dd9dff87f3601463609190a5c2849562123cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164318, "uuid": "23cb62c3-c0d8-47e0-a432-417ca038cb93", "value": "T14CF2F1119390F9F1E6E06D3AC5F0CB69BB5F50AEC0D93023391A01BC6DC98794B6E716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164318, "uuid": "551dc930-eaf4-448d-9c79-cff3a13ac8d6", "value": "768:PJzirzcvl1E7CVIwV6/eYgkwS0fW+92newLwz0VeJuo3U+:d/zE7COwVceGwS0u+o5Lwz0Veh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164318, "uuid": "d5696e01-b750-41ac-adec-27d342a2233c", "value": 36716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164318, "uuid": "d88e1139-8f52-4c25-86ac-afcd38076ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164318, "uuid": "cc76cb7c-ac75-4a89-aaae-83476675fed1", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be28d6c-01a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770193092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193092, "uuid": "a376ed6b-df69-479e-b4d4-f6592e44ecd0", "comment": "Malware payload", "value": "d2803e5546ed67f51f979d92e2f60bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193092, "uuid": "98d0c553-d825-4f81-834e-3d45e9c5cb00", "comment": "Malware payload", "value": "6374cf047c9280bcad84279ef1273c549710526df9f20dbc881874ae01524751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193092, "uuid": "1f21496b-46bd-461a-8266-46b88094bcc9", "comment": "Malware payload", "value": "6f920fab2342c847d27fa8ceecac032b6cdf6084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193092, "uuid": "783be0df-dbe5-4fb3-9810-36b8cd799a5e", "comment": "Malware payload", "value": "ce2db6cf6fe27144e569b6f11b007e80dddd1815ffa3be9f0ccc2b077ab0cb3dd42b4ee2fb3e39a580b2c43fd3d98a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193092, "uuid": "af50e915-447f-453a-b427-7f2b18c42f26", "value": "T128C733C4E24405A7F9A18539D5FD8B6062293EF3CBFFC65B35A8B24168373C2172B946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193092, "uuid": "8c5e22e9-c42f-43ea-8f0f-8ceeb8d2c660", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193092, "uuid": "1d856834-c1b8-45f2-bb0a-f3dc6e7595d6", "value": "1572864:31v5Bt6b3gIFyWC9r8obhdZZL0izz76+NNlfWxG3:31vjt6b3gWyTr82TZ376QfWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770193092, "uuid": "ec72eb54-0351-4407-bb34-8bb57a29c465", "value": 54439661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770193092, "uuid": "3e86eb03-cf24-4eb0-8e08-51b01490e698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193092, "uuid": "42c13df6-411b-4e7e-8672-b0574303b5dd", "value": "Legacy Launcher 1.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea981a2-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770176507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176507, "uuid": "430a14b2-b9e4-4d24-a5e6-6d2be00704d2", "comment": "Malware payload (Mirai)", "value": "654435e06214abafef626530d6e124b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176507, "uuid": "bdda7108-3a4e-4994-9fd9-87b3601819f1", "comment": "Malware payload (Mirai)", "value": "63833bea01a4c6ed403b246a80c39104b0fb89fbe831e33226e31af08c3e250e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176507, "uuid": "00001f27-824b-44ac-8c16-ba03dd33c5b1", "comment": "Malware payload (Mirai)", "value": "b47edee3c4f0855cb470578f70f2a67531cb335b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176507, "uuid": "ca914877-1eef-46d0-81e2-b83ad4df9be1", "comment": "Malware payload (Mirai)", "value": "8cc27aa141037f117b667ca3a4a27187746408dcb54b5fa0b062d93f51b82aacee17236103158045a8fabb4db68bc0b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176507, "uuid": "8ac4be2e-0d27-4e73-9c0b-63d43d987a96", "value": "T191D3F198F980CF32D2D5197EF74E1289331303BDE2E973068D149A3077AAA574E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176507, "uuid": "750c0b0d-ad32-4795-9d59-bcf211c5b97a", "value": "3072:rponhnSMawdzSV4LOR3QLZ6gnfGBGnapNiAeyuhG9CiYE:rUhSjwdzSVRSLU6eYnsPeyu+C/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176507, "uuid": "53f4dbec-abf5-41f2-8c5f-dfba5f42e02a", "value": 141438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176507, "uuid": "9cbabf20-b935-42a0-83eb-4d5f9f182007", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176507, "uuid": "4b48071b-d8b8-41cf-9679-4b867e58c346", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bcb3e2-0165-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770167011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167011, "uuid": "aa8fa57c-7ff1-4b8d-bd66-3d13e28e7017", "comment": "Malware payload (PhantomStealer)", "value": "50f3dc2a904d9b18ea1ae944d3a2d200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167011, "uuid": "52d8527f-637a-4529-b751-dfbbfb567d9a", "comment": "Malware payload (PhantomStealer)", "value": "6449bd456e9c56bb907670260049c1eae3b3a8e01913839f168bbdfcc1883e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167011, "uuid": "81af643f-b300-4802-a158-6b20080473f1", "comment": "Malware payload (PhantomStealer)", "value": "26761fa22163fbc940246a9ab654f3158896669b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167011, "uuid": "ccb59f3c-6b91-45ec-a6be-db9bff1bbbee", "comment": "Malware payload (PhantomStealer)", "value": "db5db39535b1177013726a5c16585493f7b9f8a4225c79b728db92b9f1099d556ecd785f62cd921608a9c99cb361678c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167011, "uuid": "0b03a5a8-8c03-413e-a860-5333ff587244", "value": "T15B94E1003281E947CEED06B449AF82FE4EB6AE7B99828F57F280F75E7C752C57924144", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167011, "uuid": "35c3643f-563e-46e2-91ed-04cd980e737a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167011, "uuid": "3735e1e3-5e41-4be5-aa94-21cd3adcae1e", "value": "6144:fQ606xV8H+lc7SGd7UQVk8ffdC7UpfqjQWNOLAw1q/OXpgKhWyjE8K8boaql:UecGGRUik8ffdCCw2k/IPWX8KHaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770167011, "uuid": "a59686c5-f85e-42db-8ff2-566b3b112b39", "value": 418828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770167011, "uuid": "107903cf-6b16-4156-97d3-c6659b53ff61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167011, "uuid": "fd903576-7550-41ab-b0ea-2ed5e2f5f57b", "value": "Payment Copy of US$ 75,162.57,.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64826b2d-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236619, "uuid": "b8b33e5c-1142-4340-9d4c-46de9422fd34", "comment": "Malware payload (Mirai)", "value": "357409d61f3747764ff8432c9922515c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236619, "uuid": "13317093-e201-4fda-820f-18e9d9e509d0", "comment": "Malware payload (Mirai)", "value": "647e892c883f08878fa28bda2a5d0ba3636ffe4058196de3ad0d5c5428561b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236619, "uuid": "91c4e557-f3d5-4f28-9d6d-af36de1881d8", "comment": "Malware payload (Mirai)", "value": "38c2743e47ec397e1d8bf34bd7a66b129cf3de34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236619, "uuid": "61c4269c-5a39-40a2-8b4f-6f0c4f9b9671", "comment": "Malware payload (Mirai)", "value": "ea724ce894e160695ac83c4af0f8c74085d3766e158e473edcdb8e23710b2756b9fcd41969a1cb01e0d4d1e3af65fe37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236619, "uuid": "88458a69-fded-488e-8ccf-a33bdc70783b", "value": "T12F93190377090F43D06329F0267B1BF097EABDA129F5B684751EBEC59271DB22182F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236619, "uuid": "3cf75ff4-9e7e-4a81-b985-144f1b36028b", "value": "1536:0L+U/Kk3X0NQHCOoDTZl4Wc10HeaauDq0eemJ6BX2pYXLIspMJ:0j3bdoJqAyamXwuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236619, "uuid": "6ecc4212-a1f1-478c-b7b0-f1619b58a3c9", "value": 92840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236619, "uuid": "6fda116c-7db6-4f77-aad2-16e3130a98e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236619, "uuid": "b946443b-f18a-416b-a439-356b2243fb54", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2572d7-01c9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770209901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209901, "uuid": "941d00f6-020c-43a4-8183-63ff66f82fe0", "comment": "Malware payload (Mirai)", "value": "807d8dc9b0a9eb163341b7df823bfdd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209901, "uuid": "fbb5b446-4824-4342-a0a8-15e2c4ba94f8", "comment": "Malware payload (Mirai)", "value": "65370cee8d5e697614273fe3f5458fe3f897968d883106306d39cceb61706029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209901, "uuid": "1b62ce8a-638e-4b7c-8d0a-5bdaecb082d5", "comment": "Malware payload (Mirai)", "value": "c720e5fa983aea08b585c21c00334bc5dda48873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209901, "uuid": "5feb9690-d0cd-4fba-a5a3-eccabd827e5d", "comment": "Malware payload (Mirai)", "value": "88e1116523d3508e8744824758d995a685eb5caade5a497211c7592efaccbd1beaa3efb40d53e4f4af5596b1cac015bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209901, "uuid": "dfdc1973-90fd-4d13-a074-ae572f71e636", "value": "T1B4C34B46EB818B03C4D51776BA9F424A3323EB54E3DB330699185FB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209901, "uuid": "f0147066-6927-4de7-bafa-2b80f77d8621", "value": "3072:pZbrJ6ah3P0srIGjE5L6wnezW1kxM/9DlJj:pZbMah3frIGjE5+wkW1qM/9D7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770209901, "uuid": "b0a4afc3-63b2-41bd-9603-e97dd54c8de3", "value": 128282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770209901, "uuid": "ceb42fa8-c3e5-43c8-82ee-f983ea1d9efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209901, "uuid": "65967506-45ae-41db-9104-be7a182844ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885c398c-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770219500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219500, "uuid": "b3212541-ad8c-4f56-bda4-8c3cfb03707b", "comment": "Malware payload (SheetRAT)", "value": "e3c9cd7e607d6a8c22ca2da8fcfdd85f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219500, "uuid": "cbb04eea-c996-41ab-874e-5dffbc49fe51", "comment": "Malware payload (SheetRAT)", "value": "65ec55211eab69a9e13861594366ec8e679afd34866893fc7a5c34976e379da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219500, "uuid": "833a9fe2-d861-4660-9168-6d7de5a469a6", "comment": "Malware payload (SheetRAT)", "value": "2e50b8c9cadd76b33344d5a376f0e5c35c393305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219500, "uuid": "01e35bad-9f57-45a4-afb8-18c75a0c2d82", "comment": "Malware payload (SheetRAT)", "value": "c2127778ef6095d7c5286f40622e15cd38ecda91a0790a214e1ed4a0781e62940cee01dd83c2b09dc873c310c6c0bb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219500, "uuid": "e239c53e-4e2b-40a2-a3ea-a71f4b749f7c", "value": "T14005428C7E50E80EDF0BFC7F8AA5D1348B3169925E92810160D5AAFD872737574A6B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219500, "uuid": "95dc56a1-1410-4340-9a35-7345f78725a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219500, "uuid": "3b7ef730-c661-4861-81ee-ad1d8ebc658c", "value": "12288:ly2bUA/D/PVle8cpRKyYaqQs8pBmnI7DTSFi14A:l3UAurKyYas8pBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219500, "uuid": "7a36fabb-088e-4c32-92bd-cc48e05fad0e", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219500, "uuid": "54b5b0ee-12f2-44f9-a7b1-0128c5751847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219500, "uuid": "42ab5f25-897e-46ec-b59e-1c2b8bbec68b", "value": "65ec55211eab69a9e13861594366ec8e679afd34866893fc7a5c34976e379da0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b306a3-0194-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770187152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187152, "uuid": "24b2eeff-d5a3-428f-ad1c-9a344335f542", "comment": "Malware payload (Gafgyt)", "value": "14c2689b10dc591449b08e2ded81f96b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187152, "uuid": "879ec13d-5a25-4b3c-9275-57ef7a46652f", "comment": "Malware payload (Gafgyt)", "value": "66388b5108fef8ce48a788723ccdc59b69112c0a9c0ab5f19c3f44cb75175176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187152, "uuid": "c4bb04ed-42ee-4aa2-9ed5-1f37cfa465ec", "comment": "Malware payload (Gafgyt)", "value": "04b2f772534da3c143aa00496f584751efcd372f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187152, "uuid": "583b331c-3524-4192-8d9d-99d58c267c93", "comment": "Malware payload (Gafgyt)", "value": "f13bf14141a3bcb76d1b26f361d00280a60a5e3265ded357d05a21db5e83cb6bef9933ff4a92f564f0c4a21b8f013a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187152, "uuid": "df07f59e-d5ee-4235-bd62-3c3e2066de9a", "value": "T1DAB30952F801DFB6F00BE67204D34B22B630BBE24B532966725739A6AE771D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187152, "uuid": "e534cab6-4008-4e8f-abae-ab248f7344d2", "value": "3072:x4QUxOhigBm61Vrwa5yL/LDiymO7VTJ39uPTO:x4rOhig06PyLzDdmO7VTJ39uPTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187152, "uuid": "f88c2360-4626-437a-9e1f-1dd24deaed0c", "value": 112843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187152, "uuid": "3c62f07c-b815-4fd5-a4a1-cb21d8e03eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187152, "uuid": "6602dc87-66f7-46d5-85e3-7f5a58911843", "value": "pXdN91.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef330cd-01a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192640, "uuid": "0b2716b9-4bcb-45e0-91b9-bfd13c8c303a", "comment": "Malware payload (Mirai)", "value": "6bf328d8b901f2eccb181a5ac9261fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192640, "uuid": "f1b5e420-18dd-494b-b3c9-61c40d74430f", "comment": "Malware payload (Mirai)", "value": "66bfd1c57bb7dc12ba5a712af051bdee07aaa52d4065d4067b26023d2f940550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192640, "uuid": "6d0de233-881d-4c8d-9ce1-1de3c7f78d1c", "comment": "Malware payload (Mirai)", "value": "b990ba48cdbbd2aec17ec2236ceb13bd7a369b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192640, "uuid": "6bc9465d-d706-4ee1-afa7-50f9057b78bf", "comment": "Malware payload (Mirai)", "value": "010a6f13411f6906300cb65231e5a98d16243f17e15dd76f0fabf8829ffff058efdfcf3190439948da0ad239a9a7030b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192640, "uuid": "cf1f8a46-7e41-4675-88eb-b3879037a4a0", "value": "T19CA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192640, "uuid": "87b5653a-68f8-46c7-89a2-96942a4c2557", "value": "1536:7RufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAr:8bU2RC4kPCtSzWu3/3L1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192640, "uuid": "9e79b28f-e537-4055-8d66-12901e97d172", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192640, "uuid": "d65d5975-a13b-41a8-a4d6-7cda6e633a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192640, "uuid": "fae37e62-e9d5-497e-84f0-76a680de3034", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52db296-01d4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770214877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214877, "uuid": "c2adaacb-7fdf-4623-b82d-24aa6c312abd", "comment": "Malware payload", "value": "ee43aa0a8f099e8ccaf1ff2c73de02b1", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214877, "uuid": "5df458e5-fad3-4791-93f9-cfc15d9333a2", "comment": "Malware payload", "value": "67043452cdaee42ad495bda8faded7f7836a1e1dd192d39b3fa7cd22b79a57c5", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214877, "uuid": "cfeb4beb-0105-436e-9548-3101e65a842d", "comment": "Malware payload", "value": "fbd060aec105d4d47deb74b606cb199fe858690a", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214877, "uuid": "f17111fb-a8df-4f6a-b279-7e9ba21a31d9", "comment": "Malware payload", "value": "963ad7ad4fe4376d0c472483e27c2e9423735c16efdc2059c0fba353bbfabd90d57c8d219642eadda5a2278e86b6a8dc", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214877, "uuid": "2e7024f7-5548-477d-b5d3-9cb86da57087", "value": "T12224206153801578B29F0FD65A3A6699F1F9E89A3D94444AFF722CFBED3BA0054B1330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214877, "uuid": "a72e0c80-f72f-4517-aba0-35736ce732b3", "value": "3072:2cppqlT1R0KC+E1r9ypOFl4undNmAYr734et:2cppqlT1R0KXE1r9NkudNmvrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770214877, "uuid": "176a097c-89e6-4e5b-8477-1f8f0b92f8ed", "value": 228275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770214877, "uuid": "43e03a7a-e0b3-4ffb-b863-7bce4941a68b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214877, "uuid": "d51eb376-aa2c-4721-a214-40c18f594635", "value": "Bank information changed.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83630de3-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770219491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219491, "uuid": "4457b1fd-001c-4ce9-a9a0-8d09dd74695e", "comment": "Malware payload (ConnectWise)", "value": "a23db69388207af64a4e585e02d96e5e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "screenwise", "colour": "#ED5AE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219491, "uuid": "3b305a4c-56a1-45db-8b82-44f57436f10f", "comment": "Malware payload (ConnectWise)", "value": "67240f2836742d702861712fd3460bfa09e1a134ca8d457892993fd53628ba36", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "screenwise", "colour": "#ED5AE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219491, "uuid": "cb1a7e74-bf11-4b2e-a55a-066fc6ea2a16", "comment": "Malware payload (ConnectWise)", "value": "65870cf7d1ddf8a18f261d9ea9cc97509cd504c5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "screenwise", "colour": "#ED5AE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219491, "uuid": "d1e8c626-e0c2-4e0d-910b-ff01b7fcd8c3", "comment": "Malware payload (ConnectWise)", "value": "a00793d4a54ded383b33f3b813c114d3808a86fb4ac96ee0ce365ef89cf70a8cd12c6c7d4bdceac4eb2b3d75a3885da4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "screenwise", "colour": "#ED5AE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219491, "uuid": "fad81eb2-2430-4376-be72-bb5f5e939f8c", "value": "T109A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219491, "uuid": "80c74294-0cdb-4cc8-8860-bb401b15d42d", "value": "196608:tKaLNkbgci4QlKaLNkbgRKaLNkbg7KaLNkbg:BWgciHZWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219491, "uuid": "7ff03f1c-2b4b-4e83-9bbb-d09d8ae200b7", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219491, "uuid": "d814d54a-fea2-41d9-9725-2d19d39e5e1f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219491, "uuid": "d653f6d3-29f3-4997-a044-4e688613555e", "value": "67240f2836742d702861712fd3460bfa09e1a134ca8d457892993fd53628ba36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6812d0-01c0-11f1-a129-42010a9c0007", "comment": "Malware payload (MintLoader)", "timestamp": 1770206244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206244, "uuid": "ac723fff-5cec-45e6-924e-84bc9bd65fd2", "comment": "Malware payload (MintLoader)", "value": "2e49fb0f864cb318a46e80c1eddca8e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintLoader", "colour": "#9CC675", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206244, "uuid": "0522f657-142b-4202-a4c5-e994020d8707", "comment": "Malware payload (MintLoader)", "value": "685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintLoader", "colour": "#9CC675", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206244, "uuid": "3526eda4-6df2-4b57-9394-d1ef5c321dda", "comment": "Malware payload (MintLoader)", "value": "968020fb1e31931dddfe88972391897cbbc2f9f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintLoader", "colour": "#9CC675", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206244, "uuid": "02f087c8-d588-47df-b333-f7dc51828aa3", "comment": "Malware payload (MintLoader)", "value": "2e151fb4d2b182e9198049e81dc1bfd9fd7323ab7c1b0f33df4180832043ec02f090b283fb9dba3adceb59c824dbd9b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintLoader", "colour": "#9CC675", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206244, "uuid": "b8e4c89e-77fe-4eea-9718-bd9914a0e653", "value": "T1E8F39621A3FD4109FAF73F84ADB462655E36BCA6AD79D2AC1261004E4AB1F40DCB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206244, "uuid": "2f35b66a-b038-40eb-be2f-b2aa5d251580", "value": "3072:NP5olJ5o7YZ9jD2GSI8IHmKoy+iD2GSI8s:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206244, "uuid": "ab0c7780-78e5-4ef5-a38a-0857770dc0f4", "value": 172072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206244, "uuid": "cb029177-ec91-4b24-949b-e39d9ffae54d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206244, "uuid": "ebb1cd88-8d46-4e44-9c0b-477a911bc8f4", "value": "window-sticker.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8a708d-01dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770218084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218084, "uuid": "cca05ac6-670e-4106-9b66-c557e25b6464", "comment": "Malware payload (Mirai)", "value": "cdc5feaaa0b31e71e899839cbac0567a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218084, "uuid": "4126af0e-86a4-41bf-a616-f5210ffd4057", "comment": "Malware payload (Mirai)", "value": "68b6bbafc9a770abc00dfb0075e0a0a6a956896de2f36ea8b21b99529ee7eb84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218084, "uuid": "bb369b49-496d-4ca6-8efe-f32e91e3bf24", "comment": "Malware payload (Mirai)", "value": "d242a3186ef6060f558492010eb15dca6ca11be1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218084, "uuid": "65ac4a6a-176c-4bab-b9c2-b858068d0022", "comment": "Malware payload (Mirai)", "value": "113d3ad659d13a870aeefe6f33da00381e6e41c4b8b70ed85bfcac30f160ddd5d960d536c02936a5dc0c212ff2f69db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218084, "uuid": "1171cbbb-00f1-4212-9b20-94532c345598", "value": "T115E3D70F6E25CF6DF3A9C33847B38E31A35923C626E1C645E17CE6112E6028D581FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218084, "uuid": "57bb78c4-9179-40e3-8d01-3ec476854a21", "value": "1536:0mcsD7T4yT28sv8jYlpZSDsW2BZO/Gq08z8l5EGlsA5lcEBaGWneWyuaAb1M:0mVDoyK7TSDsW2BgtO9sA5lnaGPAb1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218084, "uuid": "117379f7-b576-46e1-9344-f8552955dbcc", "value": 143828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218084, "uuid": "2804918e-c208-4f27-9faa-19bd9be023a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218084, "uuid": "2c42518a-b9c7-4dbc-9dff-91206db13367", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4332480d-01e5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770221961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221961, "uuid": "e219ddfc-d882-4d34-ad29-a1a221ec40d7", "comment": "Malware payload", "value": "a4af1b44f371e53cd243eca483f3111b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hackbrowserdata", "colour": "#494355", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221961, "uuid": "2904a335-5d96-4153-9105-051e7982aec1", "comment": "Malware payload", "value": "68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hackbrowserdata", "colour": "#494355", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221961, "uuid": "4e1dfa68-7cf6-47c7-b542-711173a7a43f", "comment": "Malware payload", "value": "dccf8ffe112865253fd752672a2626bb34c96aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hackbrowserdata", "colour": "#494355", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221961, "uuid": "75510812-3b6d-442e-a642-dcf30e0a0a6f", "comment": "Malware payload", "value": "6995c2ad345c14119f8dd9174c10e55d5392f5028dd3741b6605ce4950c0d8b21da23ca2244e4e64a8c474b29235a7c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hackbrowserdata", "colour": "#494355", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221961, "uuid": "4d59454b-93fe-4733-bf5c-5f759c3adb5b", "value": "T152C63371CB8B4296DDBF4138CC3A111AF71DD6D5C16E3F9C76D0D6ABA2068E90B8D602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221961, "uuid": "32139d25-ee2d-4224-914a-ef8ddff776d2", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221961, "uuid": "f020ed7f-117a-4905-a851-7d1c2a1efca7", "value": "196608:wDTEq55J2U61tNKjpY2mg53cLEF3d3nafyDIfKoI3xosyQXzjIAvB3LDeiXs:Enl2U61PK1Y2zb3aH1mjjIApPeiXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770221961, "uuid": "4d5aade0-e29b-43c9-b972-58a817b419b3", "value": 11957199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770221961, "uuid": "315379b6-78f1-4105-a480-ae417bb9dc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221961, "uuid": "6423a537-98b5-4f6a-b31d-741be5b7083a", "value": "68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9074cfc7-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164538, "uuid": "01819ef9-c4e3-488b-9c68-5751d08281ac", "comment": "Malware payload (Mirai)", "value": "84eaa560ae04c6a4fccedce35dc20c75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164538, "uuid": "10fd7c0f-d8e6-4663-b044-0af16f781610", "comment": "Malware payload (Mirai)", "value": "6978232845493c01b361882303d188120056ebb7349e2f9d074cbdeedce28c23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164538, "uuid": "ee6ad0f7-7e67-402f-b769-e0d442ac2033", "comment": "Malware payload (Mirai)", "value": "f8e4e4c161de08734be9588aac43cbf3e98d6b99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164538, "uuid": "60c10e77-3999-4453-b719-49a5609e1408", "comment": "Malware payload (Mirai)", "value": "74c9366e762d50402f65c727390fd81bb4def27c50c3e9d2bc9c4fa5e7eb52b18cd9e9d6fd3da5ae6794caea2c54ec0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164538, "uuid": "15dccf67-c13f-4872-91d2-dac7a89cefe6", "value": "T1B044C70E6E328F7DF7A8833547B74E20A75C33D626E1D684D1ACD6115E6024E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164538, "uuid": "6c719a39-0013-4ab1-9333-234062bed636", "value": "6144:Efhi5KYQrPRLuf1hErN499D7d9oUk/qzN551wRig:6tapB7d9U81g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164538, "uuid": "6d1fd511-aa90-46a0-9ef8-474c3a224a77", "value": 273484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164538, "uuid": "c021e667-60ec-428c-b6c4-e2bd676feef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164538, "uuid": "e5a8624a-87c6-413b-bfbe-909ea5dca520", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b13ff4-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168055, "uuid": "d77d8d2a-8e8e-4535-9d52-6a53a7ce1242", "comment": "Malware payload (Mirai)", "value": "bb2d20a59137334f341f136e8e2ab654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168055, "uuid": "c81624aa-cc15-47f6-bd4b-bd3a0070f564", "comment": "Malware payload (Mirai)", "value": "6a42e7b89ebeccfa971ea18ff183e932ef6e8567bcb53984de9ea3badfae8f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168055, "uuid": "96cbfbc4-052b-4ce3-a180-ab115bcbc632", "comment": "Malware payload (Mirai)", "value": "3af938657380490e6be76026402618fe4690752e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168055, "uuid": "a0d78fc9-1e21-454b-b959-7290c33db550", "comment": "Malware payload (Mirai)", "value": "ea4de1bd451585fd0ec96c1d355a3d08bf409c034928081e2b29b9aecb9d703ac3abc1e665ed7d14ebaada52f3922662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168055, "uuid": "0c6c72f2-3921-4405-bdd7-1241d6d9ab31", "value": "T163C2E13092B918B1C7600532F6B816CA7E530FBDFAEE3C90124196F63941D4629EEAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168055, "uuid": "d8c81f8f-a42d-4940-bc44-2170449fd3b9", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEX0pYghymdGUop5h4:A8soTAZ3alkXLvFh8nNEX0pYgs3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168055, "uuid": "96d1bb89-4b89-4610-90df-9db152afd866", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168055, "uuid": "c1d1ba1c-5624-478a-8efc-d0bd5188d42a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168055, "uuid": "9864c514-f46b-46bb-bd8b-2d941fa3ee47", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4575314c-0166-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770167418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167418, "uuid": "e64ca8b2-0f4a-481d-8f32-1078e5433294", "comment": "Malware payload (PureLogsStealer)", "value": "443155951f38992b9317869050c22b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167418, "uuid": "d9228f83-85f4-4a82-8b3f-2ecf92ea6f8f", "comment": "Malware payload (PureLogsStealer)", "value": "6cf75711a6fd32c73e0b0f07ad1a7a1850037e041348fc01f65e2f3a01b8d964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167418, "uuid": "aec33c37-4d66-4f88-b0b4-8bb0a78ae8ca", "comment": "Malware payload (PureLogsStealer)", "value": "49451ec3791265ab3631f9cb77d32292d064686c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167418, "uuid": "9784c584-3b67-46f5-8c2b-e4cd8956aa31", "comment": "Malware payload (PureLogsStealer)", "value": "cf7a5ef91b5ad78c64db7256d97d92c247ed92c0b947259d748d35aa3bea00dcb1398724cefab99eb9f56a3c5486358f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167418, "uuid": "e092bcec-2e85-46e8-b3ae-15181e1e4a00", "value": "T19D54120FA53ED920D189A33E618FF4538B58D606622BFB257D1F33D014E3766CB9660A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167418, "uuid": "a040c556-84fb-4380-ba71-347b316217ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167418, "uuid": "e4c5fe83-255a-43b9-950a-9202d62cc1d5", "value": "6144:ijDYT36lUolu4oGb9qOfTSyetfMJPbPP9qnLAHkaD/YypZr:ijmKlUAu9G5qSmxMjqnykSAW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770167418, "uuid": "4bb95617-6070-42a7-80e5-565bcb1a5465", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770167418, "uuid": "60b1b940-b18e-4955-8e3e-00f77c171663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167418, "uuid": "fedd9a9b-d471-4240-8f3e-c43fed1e562d", "value": "443155951F38992B9317869050C22B4A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63790839-0169-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770168757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168757, "uuid": "5c25162f-2df0-444f-b076-a61c2c9a90a2", "comment": "Malware payload (Gafgyt)", "value": "f259ef707615eebc37a21593ca45eb62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168757, "uuid": "f25cefb5-e220-435f-80ab-3cddd2790dba", "comment": "Malware payload (Gafgyt)", "value": "6d23aa17a30f7c9e07485171ab0f5b81719cd824789e3be39ddfe51f388a9636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168757, "uuid": "fa2e11a0-ab12-4bbf-9976-858bf6bedfd2", "comment": "Malware payload (Gafgyt)", "value": "09f0078b02311cc4c7581defc91b9fca55f8b2d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168757, "uuid": "91e476a4-1621-420e-83e3-8b22f1fce43f", "comment": "Malware payload (Gafgyt)", "value": "dbdcf00bb430deeb0d526fdafde7bc32b79d435c8ffc316b1cb583262716da4243bdfc8218149b4be5ea3d07d0ec23ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168757, "uuid": "3f61866c-f9fb-405c-9bbe-2b6c723b38a7", "value": "T18DF34A09E6408B17C1E2277AF6DB434E33239B94A3D733155938ABF43FC2B995E22915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168757, "uuid": "8980a938-d2f2-4664-8c1e-b8d90e00171a", "value": "3072:2IVrjaaaiA5LltbmyQ29vZmTlyZPwM/9mjPxmKwgRUQEbX:3jaaaiAVlDQ21YByZ4M/9mmKwgRbEbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168757, "uuid": "fee45206-9a50-4a1c-a1de-0f97e7663d2b", "value": 171743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168757, "uuid": "aa8072b1-c96f-49c1-b7f0-df2e12182767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168757, "uuid": "21eb491a-8731-4fb6-9a74-840bc4291104", "value": "pXdN91.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e11d74-016e-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770170857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170857, "uuid": "f602761e-a1f0-47fc-b6af-fa468a12426f", "comment": "Malware payload (Vidar)", "value": "044959db8515c4f88d4d978a0bed3316", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170857, "uuid": "156bf2f0-3eb0-47cb-a04a-85da003de87b", "comment": "Malware payload (Vidar)", "value": "6d3d027eb0fade63d8bad7c7415e0fe343d2827a543ada353dd079f79fa1de9e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170857, "uuid": "f8f44b8c-b831-4bc8-b1f2-16e1991111ff", "comment": "Malware payload (Vidar)", "value": "8ab19df9e00dc3c50c26c41c3c1f7bf5ac662279", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170857, "uuid": "73775349-efda-453a-b9fa-08d23e3f2ec5", "comment": "Malware payload (Vidar)", "value": "7dd1661d9b1161be6c8863809929d56f12d7b52a5d5eaaaac5672b83b7fb1ae5ca3806a72028a7522a32074ee55e25a5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170857, "uuid": "73bc1f82-ac70-415a-8edc-98b365a4c417", "value": "T11E96297F729592A8C26D853FC0A3CF40F5F371761B33C6E7129007A99A868D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170857, "uuid": "566b23a6-232f-4111-ad63-cfadd4809c87", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170857, "uuid": "e052556c-16b7-4639-8acd-cf7e462bd01d", "value": "49152:sNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgZQ49dp0MXPPPDp7k:sz7Vp7dQ49dnPPPDp7Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170857, "uuid": "8f705896-60d9-4fcb-82f7-298cdf78f2de", "value": 8651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170857, "uuid": "0a91cbcb-137b-40d8-b508-27a3f3b1dff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170857, "uuid": "19a7edf6-051d-4a44-9d9c-fe5dff1b87b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ce8ab1-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189974, "uuid": "f318b7e7-4a0a-49ac-afd8-7216b7b9e466", "comment": "Malware payload (Mirai)", "value": "9ed45b57668fbf9f8cdaa1bac51799be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189974, "uuid": "589421fb-df3d-4239-954d-3e493e386da4", "comment": "Malware payload (Mirai)", "value": "6df4fec58306a6aed88c61a097c0df55ed93b2327a24b76cf935c12c328db52e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189974, "uuid": "7389cc8c-6ec4-4a06-b9f4-9c3431017026", "comment": "Malware payload (Mirai)", "value": "a3b0dfe63ff30f0227e695b0b2531a0873777e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189974, "uuid": "46b0c91d-86b2-424e-b47a-23fa9558b9ec", "comment": "Malware payload (Mirai)", "value": "63c6fe0780259c6f8e528898303540b129c06e342bfb7ab5a9cfad6d7518a48d5ada9a90095afff2b026c47475e9e6e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189974, "uuid": "16803e29-e9b7-49c5-a371-ce4a8448b220", "value": "T194735DC8A5C3F9F0EC040A783077AB71AD37F53F6179DE9BE7E96563A841602910229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189974, "uuid": "9bf925c8-242e-4bfd-bc81-b3397b92bbb6", "value": "1536:oJCMny54LiYugKbKz78/2nW6r/G81XpQkE18HbZNWNy44bzEleyb/4i0tum:oBnyqLiljiw/2nDr+81XpQ/CHb7cNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189974, "uuid": "ba5218eb-ad0c-49bb-b34a-46770eacb542", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189974, "uuid": "ec635460-c28c-43a3-aa5e-6c39dc77e495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189974, "uuid": "9d9a6293-fb71-4c7a-b033-0131014950c0", "value": "nullnet_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c03d85-01dd-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770218413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218413, "uuid": "0d275606-01f5-4dc5-b7d2-a6b6081c985d", "comment": "Malware payload (Vidar)", "value": "8f1b3237272e9fc6852b1118448996bd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218413, "uuid": "95323f19-fff9-4289-a055-c3be0d704ee8", "comment": "Malware payload (Vidar)", "value": "6dff75cc517d32b2a2313680192314e9bab38ab1be41e1d76a10c9a420d7167c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218413, "uuid": "0d08c227-41d5-4939-949d-eeae756dee71", "comment": "Malware payload (Vidar)", "value": "4890fbb42625a34315221475a7751ad958574666", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218413, "uuid": "2eb14979-d6cd-4f82-9075-5de59b8b9488", "comment": "Malware payload (Vidar)", "value": "f1768b8fb3a307337f8aae22c6713a53ff00cb853af38c119de0bd3c278d62c172506119f35100f083d67819bcd35f15", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218413, "uuid": "0a54f7c8-49c5-4ab4-9136-a2a7d661b25c", "value": "T10825121789D9F5DEE10182799061E3B5A824BCA593C80E3A8BF2C8395F725DCECF7941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218413, "uuid": "a218f15a-6ae6-4bc1-ba7d-3219bb050a40", "value": "79d835308ce55e88c91797546b6ac4c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218413, "uuid": "b049d59e-6e1f-4966-9742-137b2a6c2c13", "value": "24576:j9uh8rvGJ8dqlHFFEzRu18hKWttIaWKUIun00cAQBi:j9uhIvGsiFFEgkKWt1qIu0bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218413, "uuid": "086c613f-d4d1-45b1-be18-e40c5f7710e6", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218413, "uuid": "c178d4f5-2454-46aa-bd90-10f070e2c054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218413, "uuid": "20aa0e55-9c42-4508-be98-3d870e707278", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1573159c-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192678, "uuid": "202ade71-9a12-48b6-9c59-fba8dcb46cb3", "comment": "Malware payload (Mirai)", "value": "c7beba5cc84ee113a3a647eeb973cbc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192678, "uuid": "7bee9891-c224-4398-b6ef-50292765bbf1", "comment": "Malware payload (Mirai)", "value": "6e29b244afa34e79c0dc5ac4d38f6ace3e9e049996ab9fcf5b697ecd0819a5e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192678, "uuid": "08417b9e-2639-4112-8524-296e1d4b09ef", "comment": "Malware payload (Mirai)", "value": "7897b1044b8ba3a78c3dd829682e4408e9fc905a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192678, "uuid": "233a7781-c1fe-4195-9207-fe61da6fcc01", "comment": "Malware payload (Mirai)", "value": "757b3adf8a0d3a261a20a1a65ddf1bbacb41f5c9be65c78202ab2b7569ac5d6e428e653e92187e86bde096235338cf0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192678, "uuid": "651652f4-e6fd-44b3-bb91-57bc8c0d20a2", "value": "T1A3C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192678, "uuid": "c90c7e03-241c-4237-9fb3-ec0c7f0465b1", "value": "3072:0f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4wqe:0f0tJBR4NSALD7rnCrheibqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192678, "uuid": "311c893a-6260-49a9-adfb-5a5925eddd7d", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192678, "uuid": "5afccca8-cd2b-4100-a671-a18d53f6c413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192678, "uuid": "71f58fa9-fb06-4125-b009-ebbc19e9770a", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ac30ca-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182161, "uuid": "75a58ea0-ea5c-4453-b7f9-9451155a567f", "comment": "Malware payload", "value": "d2858c1e48153587974c5a574c2c7943", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182161, "uuid": "6dd9840c-5ab9-4996-8e6e-777d5e97078f", "comment": "Malware payload", "value": "70cf4b1875e79834756dcc7421487179c9dd78d8e34f1a716ec7c8720e1d7a03", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182161, "uuid": "19434145-a486-45d7-ae50-c0e6887d5e5c", "comment": "Malware payload", "value": "42883f8e3a7598f44880d0e8ff931bd71784901f", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182161, "uuid": "6ed4a8e5-83b7-4c07-ab19-58e0e90f9d7f", "comment": "Malware payload", "value": "c78f787a7127fa6f40bfa78805ec5bea2f5567a8dcdfeb103e86d04a39a3f319921f4010d4e45e76679222bd72ca7697", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182161, "uuid": "953db513-054f-49ea-b704-fa6e286c78e0", "value": "T1FE55D21C2F971DA17412B738225A8997E71441F726913D82C897FE0A8CDE8B8ECF1B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182161, "uuid": "3e5deae2-bf60-4472-881e-4af8ef5c0229", "value": "384:fiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiij:9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182161, "uuid": "f1cfbbde-862f-43a0-ace5-3ee9f93f9773", "value": 1333575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182161, "uuid": "526857dd-8f73-4ed0-8d13-e51c8ccfa7be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182161, "uuid": "99cca450-759e-48cb-8dbf-8c13629e82a8", "value": "70cf4b1875e79834756dcc7421487179c9dd78d8e34f1a716ec7c8720e1d7a03.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c71cc49-0216-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770242914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242914, "uuid": "7bdab5fc-a788-4ffb-99b1-89e0d0eec29e", "comment": "Malware payload (Mirai)", "value": "42c957e9bb58adcd961ee03bb1d7f115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242914, "uuid": "b2533bae-d89c-469f-90b3-0c12f89a9b83", "comment": "Malware payload (Mirai)", "value": "714679fe2be826f5b8abd867c1ad5e77fda1a83833b056ac2bee419f3ffb6ac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242914, "uuid": "deaee53c-67fd-4836-b8da-6875483be326", "comment": "Malware payload (Mirai)", "value": "5186febd71ff85c2e87ea1f3cafc40587782da72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242914, "uuid": "e2f2c513-743a-4f47-8a55-934926a6b1c3", "comment": "Malware payload (Mirai)", "value": "939223daa82e0e0b0dae4190d11afbfd3b9290588642e28b7551bb69e21a06ddadd8cf5e40831f0aa39ce944e7194f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242914, "uuid": "be32caec-1631-489a-b51e-abfd7e40cd74", "value": "T1D2732B077A428BAFC04BC1F807E7793E9922BD7E0A3AA1F5A7E4FD825D05CD05A1D524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242914, "uuid": "386de310-900e-4c2f-ad0e-12c87c4596d7", "value": "1536:p59Qjsjbujf7LUmBr0SR121Ql+d5T2muIE7F/bk9nhMU/K:BQjsjbufLTBrf12fdt8IE7FQ9hMgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770242914, "uuid": "85c1f77e-dcb5-4f96-8e8d-2183c92f402b", "value": 73664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770242914, "uuid": "7308e8d0-a0cc-4b16-8a36-63e88afd10e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242914, "uuid": "bbbe184b-7dda-419f-a1d2-0a2b3e6480f8", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ccac71-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182102, "uuid": "d114ea70-5f5f-4513-944e-c76870de78d7", "comment": "Malware payload", "value": "ce5173c154ea869f2093bda8a7004789", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182102, "uuid": "37880b34-289b-42e1-bfc7-f41415e0d621", "comment": "Malware payload", "value": "7173a83a6e60e124cb098f5028a98fc8a487c759208078383f02bd7f7f29feee", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182102, "uuid": "3fc98941-95c9-4bfe-a682-1777490f39b5", "comment": "Malware payload", "value": "c1ef513037446fc20c0e15c25d25ee139ca8b32e", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182102, "uuid": "4653e298-a382-4ee6-92cd-0a771cc5351a", "comment": "Malware payload", "value": "8be2b5e2a8ffd83643bf5d302942a4d2bd7cbe825c9c86f371f4b2396246824934eb616c37eaa25de9f39440ba9fa334", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182102, "uuid": "8d191ff6-142f-4765-b952-6fda60ea8556", "value": "T1376123105AEA51C8B1FB1F56ABF9B4F60C67FD64AC39E6B80144854C4775A808C32F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182102, "uuid": "5f34a4d5-a112-4f2b-ab46-5b582bc60dbf", "value": "48:FyKVa16NCoiEfsiuPLbUz1+X++9rRajatVatVjdr8cdOpVLv/++6F5tzbBf:rwwditKh5+9kjsVsVjdgmcVz/++6Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182102, "uuid": "dcceabd9-e12e-4797-97b6-8aa9eb0830d0", "value": 3254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182102, "uuid": "b44a37a6-35a3-4657-b263-fdb7d80dfa22", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182102, "uuid": "f5d59ff0-379a-4298-a9d8-c6fc3bda4296", "value": "7173a83a6e60e124cb098f5028a98fc8a487c759208078383f02bd7f7f29feee.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601cc935-016a-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770169181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169181, "uuid": "fb7e633c-0260-414f-aad1-917511911e26", "comment": "Malware payload (AsyncRAT)", "value": "a857a36ad55edd11feb85218f3129b40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169181, "uuid": "1ecc58f4-82ac-4c8f-852a-31a94b0c4bad", "comment": "Malware payload (AsyncRAT)", "value": "71fbd6c477cb25f200ef1dc1f7819d90ad32e805e0eb79b50c968c4314b21949", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169181, "uuid": "57b8faf1-ee8a-4257-808b-5e796bbfb957", "comment": "Malware payload (AsyncRAT)", "value": "d4e947a264f0e3eddf6dd31e2ec16c7256578fc5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770169181, "uuid": "e08fea68-5404-4c03-8522-77c7429f0c1a", "comment": "Malware payload (AsyncRAT)", "value": "8099de9d3c4ec85960cb5624876d1ad1cf585774200c0bbe20e5c5f332380a988d4bec30574c9020747418a5f1f82ec5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169181, "uuid": "fd217277-f137-4dfd-9815-993ef86f1f1e", "value": "T1E3052B2164092857E9DBA53BC4F7992F2710AE15FD516283E82F3D85F373B07EAC8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169181, "uuid": "fb58085e-c293-4d70-8a86-7ce243ddcdb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169181, "uuid": "4aa110fe-3815-4b20-a298-c68fc7af5cb3", "value": "3072:YuE2T0cE2Wfp3M3bBs13Ak411ejd6sMm+fKopu+CHjbhxHNgFTqSGqfo+MQCpq8B:YuEatb3b6iu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770169181, "uuid": "a861de45-cddc-4749-ad7b-b1d28ccdb595", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770169181, "uuid": "c7c6f3e4-2b8e-4bf0-a66e-9b90467801cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770169181, "uuid": "a22d86bf-8b57-4d50-93d0-0d67c7d5d1c2", "value": "wan.uk.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcbd9ec-01a5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770194413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194413, "uuid": "db51b490-1c36-43d2-acc2-c6e2fd010a6d", "comment": "Malware payload (RemcosRAT)", "value": "55339727037c1e51a4bb1ca56d56ebca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194413, "uuid": "3dbdac9c-8641-49b3-9862-eb6e4e0a9c09", "comment": "Malware payload (RemcosRAT)", "value": "722a9dec8671cb4896b18798e8465cd35a85cf7dca6765677b8093b0c3b14471", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194413, "uuid": "af218cf5-d467-4729-8247-334e88a8a8f7", "comment": "Malware payload (RemcosRAT)", "value": "26807e30af6b24c4c715cf9d4516c16d3d843cd5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194413, "uuid": "bf7e1b02-7c17-4691-8822-8774d95b8cea", "comment": "Malware payload (RemcosRAT)", "value": "a9058ed43a945d1c61d99c9b8400706b3fc94d6a58d8def760822eab09440f8e742e4fd017ada0337b27852e03282651", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194413, "uuid": "156679fe-b3bd-4f2d-8123-7fcbc296965d", "value": "T124962AB326C660D529BFFEBE572186305C572E23344DD918F5A1223260F5D26EE31CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194413, "uuid": "86e66eba-0a2c-46bf-a172-6cc6a9ecae76", "value": "24576:qz8qUv4nNFvBuEY2qX+rOKnc9OVuK1DsVRBME8Skqyzo9ro5+bzWAgXiq2LlyIdr:qY6oLC2Mi9uqexFVJG82v6vWzqF1ZNyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770194413, "uuid": "98ca9794-d43f-48fe-9d10-88d2215909cc", "value": 8677960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770194413, "uuid": "c290ee0d-3960-40e1-b526-34f0f9a29e8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194413, "uuid": "43bbb5a6-455c-4e40-807f-62425a0f1a85", "value": "Quotation 19023586 .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85014655-0191-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770185993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185993, "uuid": "239d763d-a699-4b9e-ad8b-ba7c151f3e38", "comment": "Malware payload (Mirai)", "value": "e5c2e19170363f04bde56da217798c9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185993, "uuid": "51917f35-c36f-4f6f-a31c-f1c62f2aa89d", "comment": "Malware payload (Mirai)", "value": "72357f3bf1627b2b45df7e337454af60aa6f87a4e28544308b598df4d0fa4fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185993, "uuid": "6ecbd622-ccfa-4857-913f-e6c72f128201", "comment": "Malware payload (Mirai)", "value": "f5bcc0bc2a1c577b1229dc4fa9c5bfa5d6b29604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185993, "uuid": "0521050f-5ce8-43c4-8807-d30824fc6b10", "comment": "Malware payload (Mirai)", "value": "e8d002c43db5bfd66b00a007debb1b6dfe781e1ce86467b19b58fb5a8865bd7b4d97946bdb001b42f159e792fa167cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185993, "uuid": "f0567c78-e389-46e3-8a4a-1b3572529e1c", "value": "T114C32905F9504727C2D327BAF79E479C3B351694A7D733116A38BEB42BC57882E3A620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185993, "uuid": "674a622e-db3a-4b84-894b-b2c28cb2f75b", "value": "3072:jBBmVjxJq4FWBaY6vWsQ7unyrEmo1rQPblbepuO:qVjxJmaY6vBbmo1rQPblbepuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770185993, "uuid": "a533613c-7da0-46d7-a44f-8d0db57936dd", "value": 121721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770185993, "uuid": "f5d02c75-f1a8-45b4-846f-f22c7aeaba53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185993, "uuid": "61cfd97a-2d87-40c0-bb85-8a9fe1a9b816", "value": "pXdN91.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bf626d-01b5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770201327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201327, "uuid": "09a03115-14d9-44a1-b1a9-b2cef02b146a", "comment": "Malware payload (RemcosRAT)", "value": "7670a59d8de13ab08c2846bc7180f6c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201327, "uuid": "395e8683-0f5a-4b69-ac33-131d1d00e3c9", "comment": "Malware payload (RemcosRAT)", "value": "731b6649fe84198817a1009d4a7b18198d147e4948a34659bcc9d802bb996436", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201327, "uuid": "d5c313e8-dc02-4d93-9867-c57f244ad847", "comment": "Malware payload (RemcosRAT)", "value": "f2b5aede29a5245dd7a3f9578e1706e4a55b0a3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201327, "uuid": "afb67f72-4a4d-4c30-9db4-7b0618c96e81", "comment": "Malware payload (RemcosRAT)", "value": "6bfa441b1023632338713a3299fe07b0632ef1559c664be415893f9cf5faa81b88f6388646f1b5deb90cf68e25545d8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201327, "uuid": "00e3b2cb-9592-4c7c-9df1-33a3abd12dc6", "value": "T1675503905AC3BB881A8DD76583397414BD2B059035AB2105B3FAC1EFCF9984ED6CE7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201327, "uuid": "f191f8dd-cbfa-4413-934b-30115b820c6b", "value": "384:ZNiUitaft/cprfqGf3fMdw6LJ5sBVK1K0I5Kamt4Z+wnnV6PCpHfO:cBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770201327, "uuid": "f8e987eb-7da2-45b9-ac18-9ec84ffe6ecc", "value": 1335144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770201327, "uuid": "b3741955-1619-41f2-9b01-9c396d465abe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201327, "uuid": "11dae465-de4a-4a37-a2f7-ecdd4e0ff077", "value": "Purchase OrderPO#0200200.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c3918-01a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770195657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195657, "uuid": "4ada7708-5b37-4d31-89e5-475ce2591fcc", "comment": "Malware payload", "value": "85368f461d30cdbe59314d2d546d7561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195657, "uuid": "2af19497-611c-4d88-9369-95079d02cd7b", "comment": "Malware payload", "value": "733645e23d41d9919434f7d3c6c061a51e220e8239d04b8dc43e5885927a09bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195657, "uuid": "c9bf3784-283d-49c4-b083-37a8bfc9502b", "comment": "Malware payload", "value": "aae5f04d5a5543385aa730c313330dbdd2ff8039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195657, "uuid": "ceb2f289-0a5a-4cc8-9bd6-09434a34b55b", "comment": "Malware payload", "value": "321efee76da1621f831c32da01f66098aa7346ed9504efcc11bbc82be6155528ae0921968ad7aac2342be50d6af60b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195657, "uuid": "56bc2620-c9d8-41e8-b04a-baed6cb1f4af", "value": "T1759533B2F3E98026C4702BF5ACE493638635BCF44E75860B25E66CDE1EF22545837369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195657, "uuid": "f189e86e-a077-46f3-b252-aa64f13251f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195657, "uuid": "a794b74f-065e-4d27-9ad1-6bf12b41cde8", "value": "24576:My0hKmvBXO6ns01UnC4E+9HBK8EZyguc4XDQ6nfKQ14PHwIoUCNVemSJipep5VTZ:70hDh3z+9w8iucC5K/fwIoURJfor0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195657, "uuid": "4e873a14-cd13-4b31-8779-48a4bcddafa6", "value": 1983488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195657, "uuid": "923e35a1-de8f-4727-b61a-609b32a542e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195657, "uuid": "521e7305-56b9-4982-b9d3-8c1be1599894", "value": "85368f461d30cdbe59314d2d546d7561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5952924-01e2-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770220891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220891, "uuid": "de2c700c-81e7-4e79-9771-844428d1ebbc", "comment": "Malware payload (PureLogsStealer)", "value": "a9e20365b5d2def256e183332059f183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220891, "uuid": "d131001c-5559-419e-9793-f569d0b4641e", "comment": "Malware payload (PureLogsStealer)", "value": "736b5cfb4a0d3c224c9921ff9aa0cbcb9642473518d28db87385cf97b47e43bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220891, "uuid": "3c15aa96-57d2-46d2-bbd0-b471b7b3d1a1", "comment": "Malware payload (PureLogsStealer)", "value": "4055aede50616c1cbc1520da88ca177aeed507c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220891, "uuid": "6571df68-cdfe-49e7-8d04-de25959df768", "comment": "Malware payload (PureLogsStealer)", "value": "3685a5f168fca873ec43864d1a2d87f29a19c49448830ac5290a4df232f8b0549a09c1053e73da07876c64729ee7fadc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220891, "uuid": "102ee167-b1a8-42f6-9e53-9a4c5da99922", "value": "T15027128217A3B3D91DC13683F127F308EB6984793265E60F5625F5FED8E97108A4B8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220891, "uuid": "c94789f4-5d2c-43ac-ac72-e10a3777e36f", "value": "384:7MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMD:O/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220891, "uuid": "4e84b027-cbb6-4e89-a1af-bb825cbed2ba", "value": 20619285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220891, "uuid": "40dd9298-2b64-4396-86ba-542e2fa95425", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220891, "uuid": "706a0bec-92ae-402b-bab9-f8bbd577a6ed", "value": "PaymentDueInvoice#DMOQ4U2V.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d518c50a-0206-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236379, "uuid": "f3659193-ce43-44a1-9068-5d4aabaed8f2", "comment": "Malware payload (Mirai)", "value": "837ed6ade745b06f2c6f29a288486dbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236379, "uuid": "d0088c89-460b-477d-a612-7ebbcc1fbe62", "comment": "Malware payload (Mirai)", "value": "73ce52a64c4ebc59ffd7e109fb3f30f2f3f939df009fb6e5e0b7e4e11f59ceb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236379, "uuid": "5a3cdf77-9562-4962-90ba-2023100a551b", "comment": "Malware payload (Mirai)", "value": "0d887e8073e24b68334a81e5d62f24a6baff86e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236379, "uuid": "b55ff416-5c2e-4220-821b-c576187e8af5", "comment": "Malware payload (Mirai)", "value": "f917701c00ec8c879072154b5f52a6c72578243a52b757f4c6a6374ef91fd740f2817912ccd764da7eff9ca5a496c347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236379, "uuid": "5d101717-682f-4eed-afe7-5399f53e6d14", "value": "T12CA30B46B9528A12C5C212BEFBAF418D33136F78D3EE7212DD206F5423869EB0D77616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236379, "uuid": "e72e566d-3cff-4924-bacd-450f2685f978", "value": "3072:IRATW47dybRqV6pO9ncfGU7C88z1A9sqDnaetwRfSSt4COEB+Za:ISTW47dzplceU7C5z16sqTaZRUCLQZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236379, "uuid": "9867a926-41e4-4793-b024-2ec83dd5f85e", "value": 103876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236379, "uuid": "684b0c84-853f-441c-bfd2-86fd5ee994a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236379, "uuid": "2da200e9-765b-4869-b812-00b48ac1e2ae", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5ba6e0-0165-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770167027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167027, "uuid": "49b0ad5b-bea7-4491-a425-7f649fc37423", "comment": "Malware payload (Socks5Systemz)", "value": "64d22d96fc7f7bba12656880442d4749", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167027, "uuid": "03cc0da4-f27e-46e4-9d98-e521e36645a8", "comment": "Malware payload (Socks5Systemz)", "value": "742b5bd4c9dbd20f38a8cdaf0328368ac1cb471547081a49a3ff1d9c8a32c60b", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167027, "uuid": "d58d8479-c196-4c07-9604-ac181c72ba9d", "comment": "Malware payload (Socks5Systemz)", "value": "9b12038fb00ed6a08f4417ff53e70c969a79651c", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770167027, "uuid": "3b3d3bd4-756d-4991-b6e5-d0e68a4bebd3", "comment": "Malware payload (Socks5Systemz)", "value": "f0334c29f2c273dc87089f3c14e0026d131cce8c59df9559685b98cfbc58775cc5ad2b186315689700d7772fe8abde5c", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167027, "uuid": "956ed981-3a54-473b-a6b3-e56ef26585a5", "value": "T1B8F53340242C1471C0F6CCF45442FC24D777FA4E7A3A94AA366F4DAC1BBA468DDD87AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167027, "uuid": "a5d13538-8244-4d95-9b46-056676fd71ec", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167027, "uuid": "32096ce8-a05e-46c5-bbc8-5152cb660048", "value": "49152:C9jZTRa8qrihzG+RE7XSnZtcf0RT8TdpfRS4fvH8+nPqkH//jvie/CHtn3yJ:MlRx9JG+E7CZqAI53HJXj6e/Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770167027, "uuid": "110d1c14-0723-4997-931d-f3945b0ed5a8", "value": 3367529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770167027, "uuid": "70d88f60-348d-46aa-9c7a-ffd013216ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770167027, "uuid": "cfecdac1-a452-45aa-98e5-cdc12ef586b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0792b3-01d8-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770216337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216337, "uuid": "16038bd7-7df0-4e5d-acaf-129aaf25a641", "comment": "Malware payload (SalatStealer)", "value": "6daacb2312d70a659ab12de5e1b5147d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216337, "uuid": "14b02a71-4be6-449f-80f2-f029e4bb06d4", "comment": "Malware payload (SalatStealer)", "value": "7453d6726b4bf1bae783e1f710c347b92c23f53d97c4db1b3312345e0bdb07b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216337, "uuid": "92da2cce-d1bc-4e2c-a50c-3991b525c02b", "comment": "Malware payload (SalatStealer)", "value": "ec9b17ce908d823ea657400972527d7a061a216f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216337, "uuid": "e1ecef66-9059-4f38-9666-5aab0fc44324", "comment": "Malware payload (SalatStealer)", "value": "8be57314c53469bf9f34c45f088a64c0ea170eaf0744a45bdc5460d0b2ebeb45e7f59ea2ff4d610d17ddb22191f27339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216337, "uuid": "d4f87b6a-188f-42a2-b4d7-dbb40defea31", "value": "T16FE53315293EA054C0522E39F974FC36FA2A7C78D3870A7A0D0D5025A2A63E6F8DD57F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216337, "uuid": "97268bef-0abb-429e-9d5d-ab0309b677e3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216337, "uuid": "5b452701-1b9c-47fd-baa8-5709c687462c", "value": "49152:j4BCmmTqRaFyj9cnoBDq/MOon2TgE1ZU8MrycA3beqsD8lbPAtqM8F:j4BCmHRaDnWDqXU6g0U84A3qh8lXM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770216337, "uuid": "ada0aad4-9580-4f31-a400-dac067ec4a3a", "value": 3298304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770216337, "uuid": "e9a252d4-81ff-430a-ad0b-777f55c8b80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216337, "uuid": "289badda-2811-4d17-99e6-5b0a021013f8", "value": "DiscordFIx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee8062-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198840, "uuid": "aba6fe79-3604-4090-a31e-af18c5b4d4c4", "comment": "Malware payload (MaskGramStealer)", "value": "02e525a3d4b1181b60159d443a974108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198840, "uuid": "b9789bad-4bb0-4241-87ca-834294b8dd1f", "comment": "Malware payload (MaskGramStealer)", "value": "74cb22393c1ee6ed38c891a3756448c29fbaa7170ba88a29c532929b40a76123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198840, "uuid": "6362e8e2-7854-4dd9-adda-276625ab9384", "comment": "Malware payload (MaskGramStealer)", "value": "00a93519f8d3b02ca588d6d6413f8cc51665619d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198840, "uuid": "a1660b34-550f-4c9e-b279-833d3ac28ad1", "comment": "Malware payload (MaskGramStealer)", "value": "f118c8826b633a27e23f1c9d510d890f98ffe778a9c77b0dd36429414628fbbf1f9f3852c036f915bff8c3b819886950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198840, "uuid": "5017a7d1-7532-4148-a7d4-adfc40673c9e", "value": "T14B17239BD9C952F8D0C34B74A68B12DE70D1715986FE4C1D29CF5C02BA21D9A928FB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198840, "uuid": "2a679bab-8317-4bdc-b528-023510c97fe3", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198840, "uuid": "0b3c743b-26a9-4f27-a129-386113a392fa", "value": "393216:fI9vSpcma1ZMn0f9EVjyXQOPDxBB95zoaSNAd6V:fIljmaMn0WyPDxD95MaSCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198840, "uuid": "bf85878e-df43-445c-9498-44e09dddd782", "value": 18917888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198840, "uuid": "b41a1b4d-b61d-4d79-8eb0-f9dd8aeddcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198840, "uuid": "c86be527-25f9-4dd4-97da-38ecd9789996", "value": "02e525a3d4b1181b60159d443a974108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391f7879-0194-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770187155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187155, "uuid": "6cbe4adf-9dae-45ed-af42-5a5d8c4e76e1", "comment": "Malware payload (Mirai)", "value": "418b196ec33976bf6ce4537600165a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187155, "uuid": "c0a9e034-57ba-4c99-b45e-c9f82c271b8f", "comment": "Malware payload (Mirai)", "value": "74ec8cbb2ad22501a88736f31c31ee1749782d25303c89d758b93dfca45903ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187155, "uuid": "ff19b272-9365-49a6-9ce7-e20a4e57252a", "comment": "Malware payload (Mirai)", "value": "2cc5d73a70c8ee534939f0bf24afea8f705e6059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770187155, "uuid": "092440fa-3d23-4862-80b0-6f3aee9b447d", "comment": "Malware payload (Mirai)", "value": "cd5dadc3975019b5880a4861a43eb6b1821dde9e60e3aa3c0216bb2853c097e55b8ced57410f050401e75c07171a13ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187155, "uuid": "4b421185-ba5e-45ac-98b3-8d21e88580a3", "value": "T156234BC4A583DEF9FC1506302176EF729BF6F53E2018EA43C799A9329D92603E54329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187155, "uuid": "d1865422-7a61-4c00-bbb3-9e36dcf969af", "value": "1536:ObOQ9NUKF5J+gWHFxr6j0u3F2F6u1Jag:XQ9NUKFj+nlx2QuVBu3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770187155, "uuid": "09121776-12a1-47f1-ab5f-f462c2363887", "value": 49968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770187155, "uuid": "7ebc6451-cd79-43a3-ada0-da3e8bb7158f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770187155, "uuid": "eff11026-7995-48a4-bbc8-4eca0712b4df", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679456b8-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770176495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176495, "uuid": "9569d915-6449-4719-966b-b29866faca6c", "comment": "Malware payload (Gafgyt)", "value": "c9d4ded3f53a540bf2605b11c13b7778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176495, "uuid": "9c21038e-c29b-495e-8add-7c1a4889af1f", "comment": "Malware payload (Gafgyt)", "value": "75a86d7cce2a9836fff39b675798b8ceb8e607f1eb98657ba1004857387cab45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176495, "uuid": "4719751d-cad5-4223-a25b-6de2c5e04a73", "comment": "Malware payload (Gafgyt)", "value": "5ebca8e2faf9fc0a5853da9bd5dbffa0320bc7b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176495, "uuid": "0c990a8b-9a51-4b25-8e9c-18f99a914243", "comment": "Malware payload (Gafgyt)", "value": "632133d61f8df05d431f6b02dc01cb028547c37459827af3e903f2d7011ac7420261ee7e88dda0b39b1174418e35a81a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176495, "uuid": "01feb523-47c9-4594-aa9f-21c5cb0250a0", "value": "T19EC302C2FDE291F1D5E382B3449B675A5336DB454008CAA6E32C2F15A8F1B37B55B30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176495, "uuid": "1ded1a9e-a138-482f-a3f7-baa95cfd7a5e", "value": "3072:rOlNTZa+Ef6j3GzTbc+qzMk4sGnR7HAgGD+yS4W+E:aPGfc3Ed/g5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176495, "uuid": "59ed289b-048b-4de5-a6d3-e3f0706c6207", "value": 126957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176495, "uuid": "5461947a-9da6-44c6-b299-7d6bacc18747", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176495, "uuid": "3936aafd-29be-4dcc-bbf0-8c325b3e40b9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d21e3ea-01db-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770217709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217709, "uuid": "bd9833c3-2b21-4a3c-9434-14b7fbd54d4a", "comment": "Malware payload (XWorm)", "value": "ee1002868fa5370dcf21358f5c3e2672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217709, "uuid": "f4f80ebe-e90a-44a1-8931-76901a1e6e4d", "comment": "Malware payload (XWorm)", "value": "762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217709, "uuid": "6648cada-d77e-4840-a26b-59ee582744dc", "comment": "Malware payload (XWorm)", "value": "be22d106c0fc2fa9a83984aec1e8494975e73989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217709, "uuid": "ebe9cceb-838d-45b8-9f58-d5093f3f22ad", "comment": "Malware payload (XWorm)", "value": "771810c43d7a43c9c52fed17c15b114fae34bbd38e6836e3b231c255ed6c26cab80d6dd2754c8c7b8084518f686007c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217709, "uuid": "85bebdb4-672c-4c1c-b91a-fee4cbc46b57", "value": "T1ABF25D083B944627DAFF6FF55DB371021670F5039913E78D48D89AAA6F237C085147AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217709, "uuid": "8afe5020-01ac-492e-bd2b-f022716d64c8", "value": "384:s8R5GuuaSQVCIgRedItL0nfiYPFbVcp464aKJmQN07pkFMAfNLTYOZwp3V2v99Ij:HDj5IxGfxdxcqmkbFJ9YNOMha3nze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770217709, "uuid": "52785793-f491-4c24-96b1-db6f0fed78a2", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770217709, "uuid": "b7d8de3e-e883-4cdb-a99b-227eb37327ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217709, "uuid": "bb239bfb-5fa7-4f34-8cb1-39ee44dffe69", "value": "762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f364624-01ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770226383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226383, "uuid": "b2b2dcb0-8d17-4d59-a26a-a74abe0ea0c5", "comment": "Malware payload", "value": "53626f9b31fb1ccf0b384db876457b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226383, "uuid": "21582454-f127-4b79-9694-56abf272ecb2", "comment": "Malware payload", "value": "7687c51970b2cc875e4da99336b380616ae602e8dade3d2b9aa7b667254b8dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226383, "uuid": "a8dea2f8-0984-44c4-a183-0b67bbc34888", "comment": "Malware payload", "value": "9d66a64f8b75f5ac776c279c0b70e869498726fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226383, "uuid": "4234fc4d-76e7-42bd-86ba-39fbd97a1435", "comment": "Malware payload", "value": "a0a55071f708a1bf8679fdd1b1088b879cf3ab9d1bc7d1e1695bedaacd5c043e5bbec7221670fb82d00d52c836f8b086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226383, "uuid": "6c5b0872-ca62-41e5-9a3b-057b3d416cbc", "value": "T17336EABB8E384C89C6C7F1F69781D6700DEA9E67A4E6E0FA51D109401F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226383, "uuid": "62a673b9-9b9f-49c2-8140-f457b208eaa7", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226383, "uuid": "a8b7eb5d-2a3b-4bf5-852b-080aa78a1c43", "value": "49152:3Cnnh5C/82NAawcTFNJ7fkgMZpknDS7o8xw:oZzAEpkn+U8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770226383, "uuid": "14496110-2150-4355-a25f-a9ca1334f262", "value": 4890624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770226383, "uuid": "8d172412-bd0e-44af-839e-e0a4d1d80ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226383, "uuid": "94860d14-f766-4345-bdf0-b98a379b0875", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc7892c-015d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163538, "uuid": "3130aae6-1ff8-45c4-95ac-a8cfa3b047e1", "comment": "Malware payload (Mirai)", "value": "e81eeb6a7c7af95d50ce69f861985d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163538, "uuid": "d7b5bb78-107b-4180-b294-9ce3727a006d", "comment": "Malware payload (Mirai)", "value": "76d4226256d2383a82642883b969918dbb3c2773a533c866ec794a69f03fff21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163538, "uuid": "3db105e2-c82c-4f19-916b-ae5ad123f730", "comment": "Malware payload (Mirai)", "value": "848363fcfc6bf6fcd3d13cb96821fdbd0349eb35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163538, "uuid": "19dfa222-57c1-4d6c-9ba8-5811a0e6190e", "comment": "Malware payload (Mirai)", "value": "0698c86a816eb97f2bb509b81f92fac11f8421b1600d38eef4951f512f62a18efa637d2b1bd99870b45b340e391ac75f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163538, "uuid": "ee3bf5fb-8f45-453c-8414-35165b85f7e3", "value": "T1BC241956F8819F11C5D422BAFE1E018E331727BCE1EE72129D24AF34778A96B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163538, "uuid": "96894fb9-e6b2-4c55-8b5e-3a2520b5a9dd", "value": "6144:vrE1rTbsPOawmbTXD+xI0awxxszLb4DwR5:vr+AmtYTXD+y0ao+zLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163538, "uuid": "514502a2-2127-4d6c-a9d7-276908b0da83", "value": 221380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163538, "uuid": "689a67c8-0350-4e2c-9700-0db7dfd425fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163538, "uuid": "91d12822-b0fd-4d31-8fd1-07bde2998ac8", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffbce54-01e1-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770220559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220559, "uuid": "ef6179f1-5f86-44f3-9b03-3052d44bc3ed", "comment": "Malware payload (PureLogsStealer)", "value": "1eee7cdf95bc1f6d48e9389786dc883c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220559, "uuid": "9c80fc37-a38b-49a6-94d3-b0c89824d8c5", "comment": "Malware payload (PureLogsStealer)", "value": "76d754762ecb00824648d80d2d4147278d1dcc56326cc961ca97ea10e11d6d8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220559, "uuid": "e990f8e5-8b7f-4294-8be5-cd157252503c", "comment": "Malware payload (PureLogsStealer)", "value": "705e5a2857ec2628d8a1e76c11ae5fc66716d12f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220559, "uuid": "24616685-5c40-4f1f-91c8-b43761387c78", "comment": "Malware payload (PureLogsStealer)", "value": "771ff0beb4cb48e76ba52a3377d5829d5caabe426d2bfa958aa0a24a3a7478f3076c0b41f5b539d8f5f8f901f5341407", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220559, "uuid": "37121884-29a8-4655-a16e-f54ccb4cfc3e", "value": "T177A602B205081171C6C27B6ACB437C1E5FDC96F473A5170EB9E096DE4D5F3AA02AA8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220559, "uuid": "a269abf6-a68b-42e5-ba55-91203fb6547c", "value": "768:mTKZXVRDkIU+JMNpG/EYq1ZSuvVZXW/P84Mh+fbnVur3ccALhbpcrhROfABqVSNq:jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220559, "uuid": "54e7981f-97b8-4199-82e5-fd95ed76bc9c", "value": 10250858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220559, "uuid": "07253066-9719-467d-aac7-595f4e196666", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220559, "uuid": "3e79eea4-f8f5-45ec-9537-c56f6d0ef68d", "value": "PaymentDueInvoice#PF0QJ99I.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfbf9e5-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168048, "uuid": "381eaec7-39a9-44e0-9a73-53a4f91bd158", "comment": "Malware payload (Mirai)", "value": "30f86a767ed74d5308f7a3adfb7d0cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168048, "uuid": "e58fd63a-e6eb-498c-ace8-04c85dcd94eb", "comment": "Malware payload (Mirai)", "value": "77a13fd8229b94027197584f9adbd5e5f439472c2c00c63775a9e82ee3665b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168048, "uuid": "0633fa3e-98a7-4e5f-b6ca-c18d508cfd31", "comment": "Malware payload (Mirai)", "value": "7a2dc157384fd502dfbf4c966af1ead41561d0e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168048, "uuid": "04a5e281-221e-46a4-a455-39781679fc0f", "comment": "Malware payload (Mirai)", "value": "641f7b96d4a3c9b1263910bcd9326da0cd2057c1061cf64809a23bfb0ece3c36653c9c9a0e2d5db7690dd590f2de61b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168048, "uuid": "35474eec-a12f-4458-b312-0ba3b5208cf8", "value": "T1F833F262676E29E291B09377FC33EC1A969C1AE9896730DA3CF0561577C58024EF27C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168048, "uuid": "a05fdf96-5ebf-44e7-9264-862d373e470d", "value": "1536:j9O/ZMAXIxNUk05fLcPqF1aBexo4opKZbQ:j9O/ZNKytfLGqFUFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168048, "uuid": "843d1b55-f66b-42dd-8976-e095753ba445", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168048, "uuid": "ee9d5703-9da3-485f-bd57-5b3ebde8254a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168048, "uuid": "8103bb8c-0fb1-47f3-83d8-81f6bc306d32", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5ae1e0-0179-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770175782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175782, "uuid": "bf76ce2b-ed1e-44dd-887e-3fdd589bfc6f", "comment": "Malware payload", "value": "327231b1629e2a52ffc80672661221f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175782, "uuid": "019ce897-cb2f-4f18-b62d-59695695ed6f", "comment": "Malware payload", "value": "784f91bd483172f27ff0a65795b1fe7911e3d4f2293b190ab4db0a79b9acc783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175782, "uuid": "19a2fbcf-a863-4614-a94b-55c741e60063", "comment": "Malware payload", "value": "16f16bb92ff50c805f03bbe2dbe1af7de9d69468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175782, "uuid": "1c0db29c-0530-4bcf-a492-5fd7fc6774e2", "comment": "Malware payload", "value": "8230ce779c0df7d0da0e2d6e6cf8f5241941fa2523a45096aa6d5d10dc2e7480f622c4e1d4e05d20c2be65445f7e708c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175782, "uuid": "ebea381e-f14a-467c-9619-a161b6108cc0", "value": "T1B794945AFBF610E4F5B6C1389562312AFC3238A54738E7D796849A1A1B30BE4ED3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175782, "uuid": "3566bd3c-f7c7-4d43-84d1-573a37a258a3", "value": "7fb3515d930c38f25e9d8d16062acdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175782, "uuid": "56994e5c-281c-40d4-8898-24ba2aba60f7", "value": "6144:bKntdMqC/GjGfZIjqL2yLLiXhNPit1x76Asj20diXzgtkTxor8ewcC:bAbMqCuwL2yLLiXhNPir7XzgtkSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770175782, "uuid": "851dc90e-4021-424d-92d8-31247a6c0725", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770175782, "uuid": "cb5a4ec1-b8de-40a7-9200-9a07c3c8e0b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175782, "uuid": "09fe8828-d44f-471a-b782-edf9a579ee1c", "value": "123321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44dbad8-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189965, "uuid": "b19edb5d-41ee-46c8-9665-42beb50c3dae", "comment": "Malware payload (Mirai)", "value": "2a5f0c1149f46406ec4697faa0d2516d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189965, "uuid": "4010e2d9-5b4b-4731-8030-e5daad459ee2", "comment": "Malware payload (Mirai)", "value": "79d7f9ea797edd9608ba268468b21308f29799c0d92daa25b58f8ddba842bd3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189965, "uuid": "11df58e6-5682-49fa-a395-e4124a440c2a", "comment": "Malware payload (Mirai)", "value": "7855911f6044c306073d185b42599079312f7a5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189965, "uuid": "ba451029-19de-4f7c-ac45-d787c0ca2faf", "comment": "Malware payload (Mirai)", "value": "ba4e55788f1aac6a97bab319969391622cabb564b9230ae82e3a12b8c4266df334ef319cd9f1dff20c0d05c0837483f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189965, "uuid": "201593f3-a4e8-4627-8592-ebf014abcd1f", "value": "T1D9734C42B98486FDC189E47902BF7576C426F1BD2239B1E737C4BF1B2C09E601B1E56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189965, "uuid": "84d9997c-86a7-46a4-8c4c-510c0fc4a4d1", "value": "1536:wM1FaL5wJ6x2oYIsJNbmtY+Oqeoe14PW0MPTqDy3cEN/CMMU9O:fYG6x3YIsJNQPOqK2PW0M7wy3D/Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189965, "uuid": "f58f76e3-b553-4bed-a425-f9804245c21c", "value": 79520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189965, "uuid": "2a926dbc-eab6-4ef2-b93c-aa4897c4313f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189965, "uuid": "5860302b-ffe5-4401-adf0-f26575c3e413", "value": "nullnet_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0dc34a-01f2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770227640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227640, "uuid": "579c6256-7e35-4f3c-9606-aefe5e711ee9", "comment": "Malware payload (Mirai)", "value": "e5d9d0f1442c49fae2f9b13b44c7ca89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227640, "uuid": "803d6289-57e9-4806-b15a-3186754b6e71", "comment": "Malware payload (Mirai)", "value": "7a2b43b9b1314c227137b5ecb119d3f4c92cb41e5d9784eb81e9c02affa2e63c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227640, "uuid": "35a969df-3fc9-418b-a7d1-127ed793c972", "comment": "Malware payload (Mirai)", "value": "648fbe87a95ff1c41f5130bddf70cf178121b88d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770227640, "uuid": "4fbdd6dd-b3c8-45f2-9acc-c58cc92f08cd", "comment": "Malware payload (Mirai)", "value": "e520b569c1ccbca19c5abd556c92d0a17cee174582f8c562e04ce8a40bb944ce93415216f1c4b35ce5a0c8e8f81d0c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227640, "uuid": "54886858-22d8-4e30-a93b-c21455c71a8a", "value": "T18263398BA54551FCC198D17843BB7636C863B47D137AB2A63BC4BF1B390AE601F2D50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227640, "uuid": "836d87dd-5f8d-4d3c-ba75-ba7ffaae5f13", "value": "1536:FDsiBpdh93ZYzsenC2b1fxY0KajV5Q0rEJdQ27ELwSGWzcKw2:lfdh93ZAsenC2x207PxYdxALwSFFw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770227640, "uuid": "17920364-5ca9-4362-ab9a-e6032f6118fd", "value": 67328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770227640, "uuid": "0507e33e-f218-4a7c-a686-7eaa0bd5cfbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770227640, "uuid": "8ff4bc8e-1b41-4485-a7d6-c830b4d61ec4", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c9388d-01a7-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770195462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195462, "uuid": "d73cc085-affd-4d14-8164-50af63b24877", "comment": "Malware payload (ConnectWise)", "value": "cc2fa5d1e8557b9db21b12766da0a97a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195462, "uuid": "13d07227-61a8-42eb-8d49-1a912733f010", "comment": "Malware payload (ConnectWise)", "value": "7a7dfe2d2f86e213819cf5c66a2b4b84c82baccd5dda1e3cb143e165d2ea04a0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195462, "uuid": "9377e26d-f9ef-4968-8261-6e7bc3125703", "comment": "Malware payload (ConnectWise)", "value": "ff7563fe2345860e4fd4d9ddd355a7951aa25e9a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195462, "uuid": "32086094-a745-44f1-91b9-efd501396c9d", "comment": "Malware payload (ConnectWise)", "value": "882014ff46588734407bcb6d8b43817ef61c1cc50a76841d436e46d84fdfc153c14dbdc7e0e31a57d2db208750e38d24", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195462, "uuid": "9a7dd45f-803a-42d3-b5b3-44616bf72937", "value": "T18662E712E80795328572523AC61B4C28DB97509320129C26BEDC450FEFB5B8FDAE52EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195462, "uuid": "320caec9-fbc9-4ba3-8224-6ad7be095fd3", "value": "192:OAEfbAU/M2uMna8mK/Mg8yv/O/8/AYAs/E/74/7/KdNgVs//H+p/GEk/7/n81j1Q:TEfEV2uMkHysYLoO/aXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195462, "uuid": "4c08bb46-9ccd-42c7-a478-886d1600238d", "value": 15905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195462, "uuid": "536475dd-96b4-4f47-9a03-36b4c7dbbe21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195462, "uuid": "bf5eabe9-ff4f-4f50-87e2-bdef76b4d117", "value": "Docx_xlx_2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10728dd3-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192670, "uuid": "35cfc211-2aa3-495e-ba5e-480d366ea895", "comment": "Malware payload (Mirai)", "value": "c8563ca81f26073e5b38208cf3468c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192670, "uuid": "3a631187-7f2d-4579-9433-435eea7c01d8", "comment": "Malware payload (Mirai)", "value": "7b4d33f3f6e14a5a929d778588cdf1fb82c939037610c88c0f0a0cfedaa43ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192670, "uuid": "703ffca7-771f-4ce6-8106-aab61ff96daf", "comment": "Malware payload (Mirai)", "value": "489839f6303518d0383dd5491da8e1b2f4d573eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192670, "uuid": "1312de1d-b631-4c1d-9f85-f5c05a655050", "comment": "Malware payload (Mirai)", "value": "caa69f6c283dcd1bd934b9e89b99d958bfb03a8164aff60b4c47e4067bf34d65751253abbb2e48c1a10fbfe976f1dc42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192670, "uuid": "7cc037b5-e96f-4c4b-b46b-41185656f81e", "value": "T106B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192670, "uuid": "5dcd7e6c-701d-4ac2-a1f4-13d30564fcea", "value": "1536:dUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvE:mixnUHz4Z+5ypkn3E8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192670, "uuid": "c3a63052-9ea9-4bf8-862a-6b45d9484882", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192670, "uuid": "81c17d77-7304-4acb-b5e7-a3f0510f90c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192670, "uuid": "69fb24d0-a2ff-4f82-a8d5-96f37461bfb4", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d27f70d-01bc-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770204395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204395, "uuid": "4c64e57d-98cd-4484-be5c-3d91922c2c8c", "comment": "Malware payload (SantaStealer)", "value": "7ae880f0f61764d85c70a42ddb145fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204395, "uuid": "25f9e90a-8717-41ed-8beb-f7577f090c32", "comment": "Malware payload (SantaStealer)", "value": "7b7d69d1b455cd4681e325b610e5053ac201433970ca396fb0c32d9719b0d8d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204395, "uuid": "c3aa41fe-c1a4-4ab6-bcb0-dfb4fabe8618", "comment": "Malware payload (SantaStealer)", "value": "2800abe5088c72f77a7e21919cc29e45adc9fe5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204395, "uuid": "28b52f70-8880-4bda-b005-50fc4c83a408", "comment": "Malware payload (SantaStealer)", "value": "a540bf58792ff29fc6c2a8242d963bfd87cdc80d91f18bad81330cbdd3ff991dc0201ae5d41ef10a31715c7e6dcae751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204395, "uuid": "8784d0d6-fd03-4377-a91a-50e3ee0713b9", "value": "T18FC59E0AE15349D5CC5BC0BC838F7131EB357D79CA282D9B17D28B613A95B807729F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204395, "uuid": "21abb976-5719-4a88-9857-e731ce6b287a", "value": "d6d4019539ab1757eb53b82c6691b682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204395, "uuid": "41e515b0-ce27-4fda-a91c-f5a3fbd119bb", "value": "49152:XwLgW0B2MXHJeGLzCnx7Rt80JjIGr2yXEJmgS/xcEIuaZ:XpW0jJeGLzkx9KAjcyTxe+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770204395, "uuid": "b5d0e00a-e567-40bd-afa3-39e88141a5be", "value": 2628096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770204395, "uuid": "8bf34a76-bae5-4a5e-9d09-205cff3d5e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204395, "uuid": "f7e31472-f9f3-43f6-84eb-2655caad7ad7", "value": "x7b7d69d1b455cd4681e325b610e5053ac201433970ca396fb0c32d9719b0d8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fd6a93-01b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770201296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201296, "uuid": "56921ebc-02df-4271-b402-ad3e0ea96487", "comment": "Malware payload", "value": "25100ac14929a5c873bf08b77a8d5ea6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201296, "uuid": "fbf86da2-e3f3-4450-bee6-928b5e9977f0", "comment": "Malware payload", "value": "7cfecc3e9ac8b904f2a93952bd9bf2e87bc21677560251fd6316fe693337412d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201296, "uuid": "829e15bb-7186-4d10-8294-0b4934721e2e", "comment": "Malware payload", "value": "e3434fc9726af64c109a2ac4997b01d642b7c8a0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201296, "uuid": "0f1eea66-3ff7-44f7-9f2f-7834ee238404", "comment": "Malware payload", "value": "fbb367596d6395232febe7be28b066043aec0587dc027d4f9b56845e244d9122f5df0cf46bf202e231507cdc13dc7365", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201296, "uuid": "b29eee0f-e2f1-4eae-9a5e-747f78044894", "value": "T16D083303BF46A164CA9D0E7F107B2B25472CBE40A06F66536B3931EED9F8EC1289D5C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201296, "uuid": "98d7ddcd-ee8c-42d6-9631-756c6f27d01c", "value": "1572864:2B5owUZsPlFsl+Ei6EJ5hwkxyTC91KFkfovMBBQnGrZ6g6b+lts:25owTA9irpwycYMkfovABQK6bWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770201296, "uuid": "12082549-6335-4ab6-9176-faaea761295c", "value": 80731792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770201296, "uuid": "1adf3c2d-0914-48df-afc7-ec34344aefbe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201296, "uuid": "d4b7fd6e-6941-48ab-a6ee-270f41e0df9f", "value": "Yeromas.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6f80f-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198886, "uuid": "d13d91d0-78f2-4e4b-a5da-12a55ba6ecbb", "comment": "Malware payload (MaskGramStealer)", "value": "02ec1d28e11832c185df015e3042f7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198886, "uuid": "6b8624a9-3469-43b4-8715-a68bb9a8a6f1", "comment": "Malware payload (MaskGramStealer)", "value": "7de9802ebed1949f74f037060f58608673a7e53852d2711ddf9ef195355dce8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198886, "uuid": "aca79ff5-10e8-40f1-91a8-b0877e7decc0", "comment": "Malware payload (MaskGramStealer)", "value": "655df04d128db75ee853bf69aa9029cb833cfa4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198886, "uuid": "52d755bc-326d-494f-aebf-0f124c476118", "comment": "Malware payload (MaskGramStealer)", "value": "c36ad9443c0be33c4c115e98bd434599bcfd0e3076163b94fdf7df9aba4c8a4c4ad961e262e1f605b62d220bc4edd881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198886, "uuid": "9b5fcb41-de6c-4ff3-b361-a325a2879a9c", "value": "T1AB07238BA9C943F4D4D34774668711DB70D0714E85FE4D2E3ACB6C023A21DAB928AE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198886, "uuid": "14fcba17-d997-4038-9703-9ec68f26b141", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198886, "uuid": "ae49fe44-6868-4bfb-8337-8a0c09eb18da", "value": "393216:5TdruQgg9AFrWXW2hp2isMqk6c/f6DxvjT:5JrPbAFyGEp2iiJc/fUxvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198886, "uuid": "a17b2dbd-dbe0-48ff-9bd6-a04a883444c3", "value": 17317376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198886, "uuid": "6de1577c-30ab-4ff5-a577-0b4820e4ed78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198886, "uuid": "94ac8773-a16e-49ca-8ae8-996148d1d284", "value": "02ec1d28e11832c185df015e3042f7e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035fae70-01d9-11f1-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1770216700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216700, "uuid": "d22ac579-b2be-4c4a-b771-2083bb7e4b15", "comment": "Malware payload (BlankGrabber)", "value": "35e0f4d4ca75d215732131013d3a6485", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216700, "uuid": "4382778a-9005-4dae-aa56-5fa2d2840ea8", "comment": "Malware payload (BlankGrabber)", "value": "808e9654ae979abb4866e8f1f1c567c75555d82d990e7c2832e87c51a07d068d", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216700, "uuid": "56a6b94a-656b-4765-bd35-e42679475a9a", "comment": "Malware payload (BlankGrabber)", "value": "ab0a6eef509e901c3006519f04f3785b2fb8922b", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216700, "uuid": "1388e195-e042-44ff-9cf0-32f46b7c4179", "comment": "Malware payload (BlankGrabber)", "value": "0605e4fd615cc3106707f591cee635756f66aa9fd611b25103648d5d3f439591b9c2544f6217ee17ffbd4f4dc91e9517", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216700, "uuid": "6cf36855-f084-4e74-8855-33a21d3f9e33", "value": "T13E963390E3E809E6E823D23C4605D466DBB379215B68D2DF53B843391F178E1D93BB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216700, "uuid": "767c4c43-360b-42f8-8cb3-438bcd0b6b68", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216700, "uuid": "a67057dd-96bc-4ebd-a4a2-d2fb97a6b5a1", "value": "196608:T8PmPU3xcdALjv+bhqNVoB0SEsucQZ41JBEPIFA1DRw:T8PauL+9qz80SJHQK1JKaA5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770216700, "uuid": "d401831c-20cb-4f9d-9765-e8bb1c62836b", "value": 8618819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770216700, "uuid": "7de49676-8240-43dd-9a3a-9ac6357349de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216700, "uuid": "8e5c4778-e07d-440f-b275-8bcde6c5acd8", "value": "BeamRUSTLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17581172-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192681, "uuid": "1acbaaa0-de0f-4cf0-8d65-38755f3c25c8", "comment": "Malware payload (Mirai)", "value": "4360814adb8d0452ab9246a0bcc2225b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192681, "uuid": "202ec8eb-c98b-4fab-b7dc-1df2a8ef8135", "comment": "Malware payload (Mirai)", "value": "811e37d35407d436e4a6677eb25664440773e12e5593feaa37575e0bdcfbdf9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192681, "uuid": "acac85b6-ad90-446f-9901-b974f0f5adcc", "comment": "Malware payload (Mirai)", "value": "71770a68a5da09ce1c4ce0530ae9945b6dd6b811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192681, "uuid": "36db1972-95cf-4bf3-8e84-afd630ed058a", "comment": "Malware payload (Mirai)", "value": "1a176969e2e34987bf3c16c2a31fc864ba67d4a0e545070cc07e7a3063f1e76f1b0be3b5c2dbaa1e67b42e91cebb8b80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192681, "uuid": "8949ce1b-931b-4f87-a09a-c49eb7401b27", "value": "T1FDC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192681, "uuid": "118f485d-b674-4abe-be49-8618cc21efba", "value": "3072:fsD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1U:fsD76aX9aKTcRQVnoiYq1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192681, "uuid": "5fb693ad-2942-40be-9cd3-8c551a039964", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192681, "uuid": "d3bc6085-8392-4f93-ab9a-9444c9a74636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192681, "uuid": "11bd2afe-290e-4a4f-bfb9-941f814a0e44", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ecdc23-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192654, "uuid": "ce83bff0-18e4-4ae2-873f-768d59d82ea1", "comment": "Malware payload (Mirai)", "value": "c01fb5b316674721b6c07a8f20c50ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192654, "uuid": "2371122a-38e9-459e-86e2-3f6f60e381ce", "comment": "Malware payload (Mirai)", "value": "81f3b5c089e018318bdb3fa94e11acd72440b657717ee428ece1035705f4bb82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192654, "uuid": "19803415-3df5-42e8-979b-936f07ac8032", "comment": "Malware payload (Mirai)", "value": "c1a658b369257f65be30fb055693c0ae38bcaa32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192654, "uuid": "c235530c-a478-4795-8a57-c022a41792ef", "comment": "Malware payload (Mirai)", "value": "db0c588215fa5c1e779748cca79f020924686288fc1bab8930e710f356f95262108de0de28933e1d91c5c7b2a8af8d76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192654, "uuid": "f8db30ae-403a-4b58-acc6-9af8298b9816", "value": "T1B0E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192654, "uuid": "b582f28a-1baa-4392-9a1f-22d72fc2be4b", "value": "1536:p+PTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxtdbK:polybKpzEOfGQ+vEubTt4ouftL4pdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192654, "uuid": "de03b059-b0eb-4ad7-88ca-ea723090e80d", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192654, "uuid": "6b36fd16-a574-474a-9ad5-7387d0cc5d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192654, "uuid": "dcd533db-326a-49e3-aa5f-18613fa25fb1", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac11136-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770193009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193009, "uuid": "bd64e0b1-9db7-4745-b4a4-be7aa4c27bd0", "comment": "Malware payload (SnakeKeylogger)", "value": "af26c57bb788fdab33813f656b634452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193009, "uuid": "bab22ae9-d459-484f-ae21-1c94a6c0c6a6", "comment": "Malware payload (SnakeKeylogger)", "value": "823e02bde8acad7fd8fb24bd0f5628fcf9faacbe61efed1d47dd115ec63b55f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193009, "uuid": "764cf916-66ee-4b71-b1a6-c17926a1b5d2", "comment": "Malware payload (SnakeKeylogger)", "value": "146f04baa63fc96c4280aa6de02384f6d8cf5eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193009, "uuid": "4d15a614-51d5-4fe6-aed6-8539e44ae8bf", "comment": "Malware payload (SnakeKeylogger)", "value": "450695b8b6c4d25a05ac98dff2c40d3b70671798b2ecc908ec42a7dc63253276904cba5bdcfdaa21142983075af2a9b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193009, "uuid": "47e16cd2-a0db-4a45-8e27-07a8d69ae1d7", "value": "T1373512A431958A12D5BA47F919B2E33007F92D9FA851D303CEEEDCEB3811B5619493B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193009, "uuid": "b9f47e3c-3b42-46bb-b8f8-999f196e0192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193009, "uuid": "55d6e62e-8917-4196-acc0-4f49778e4ac0", "value": "24576:u11ddpQ/l8GJLjDE2o4/OqRcxQNTGh65GyaozZ2wyJ:uBQ/XE2pOq76hryao92wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770193009, "uuid": "ccae263b-beeb-42d7-b35d-678b8d8ce6f3", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770193009, "uuid": "1b157e0c-776b-4a7f-9bec-d9b577036b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193009, "uuid": "e15421a4-cfee-41d3-b045-ac5747839a12", "value": "Request for Quotation \u2013 CT-2501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6480b66f-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770176490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176490, "uuid": "68c6e1a7-d423-4d19-897c-c98c34019c79", "comment": "Malware payload (Gafgyt)", "value": "0a23f498c3aa0979e69425cb0399cadc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176490, "uuid": "541088f8-a5e5-465d-940f-fef37a38ebbc", "comment": "Malware payload (Gafgyt)", "value": "83e99b642fbec10a8d2856d8a1ce83bcf992ff76c1a1c182a811d07059880803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176490, "uuid": "14603a85-8035-443e-83a3-fd49d652f4df", "comment": "Malware payload (Gafgyt)", "value": "403cef83004e0166e6291fce63f41869c242de38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176490, "uuid": "c0fea999-a06b-4456-a4e5-e288637276b3", "comment": "Malware payload (Gafgyt)", "value": "e3b400f910f54e83140026a5b16f7926473f948354d0a29e377f372fe11d409cc5602307910a8fbefc62d6ef138e6ee0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176490, "uuid": "83e02404-2173-4fe1-97d2-c8271bb562f6", "value": "T16AC3F192EEC285B1F2830471019B57EBDB35DE051045C769E75CBE60BCB63FA861B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176490, "uuid": "d42e825e-b36c-445b-94c6-b9b7a6efb089", "value": "3072:qa3z5a9yc6DtpGIj0gKY9k70Uok9l8eXhnwz:qqm10V1O70GHTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176490, "uuid": "6319a18f-d12c-49be-93a9-cb3dca730510", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176490, "uuid": "55ff6caa-7fa9-4282-b54a-acb17313a851", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176490, "uuid": "093b1103-5621-46fd-b6f7-14237125cfdd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf26a9c5-01f0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770226893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226893, "uuid": "35612a1a-fecf-4b74-a599-de6aab24e718", "comment": "Malware payload", "value": "a4ca22ac7f6a261f01e81bb2382a5a25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226893, "uuid": "5bd885d4-2bcf-497b-b8de-815182b0add2", "comment": "Malware payload", "value": "85971fef81728823070f1556b3bacbaf1f8218d572b5be4ef9f17c2b812a664d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226893, "uuid": "35e56309-3bce-4cf9-873c-828df43c4f41", "comment": "Malware payload", "value": "200aec06a9cf2f3fee68e22bd32d95a0ae80c0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226893, "uuid": "08e39ec0-3855-4974-8d2a-2537407af23b", "comment": "Malware payload", "value": "9a384a27dc83911c89631c8a4acced3618e9a90a0da96d88c1ea0f54ed8d0117b8f15c4531075d0dd34bf279ed82c35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226893, "uuid": "e60d99eb-be5f-4bdd-bc62-b3d491efab1c", "value": "T1D5366C93BF94C665C5DBE239D461A2956230B848033072E37B661E7A5C3B7C4273BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226893, "uuid": "a7731486-5327-4b64-b031-983c0a7e17d2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226893, "uuid": "9a2c90c4-c3d3-4b69-867e-abc3f4953958", "value": "49152:XLNMRtrb/TBvO90d7HjmAFd4A64nsfJlVCdhE4G1yzkK4yvxdKelTtGtPPVbj5rr:Yks9kehinVtBp/1d5Kr4sK3IAbb38Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770226893, "uuid": "b030f46b-90c3-4688-9f89-08420434137a", "value": 4925056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770226893, "uuid": "295679d1-5ed9-4f48-b637-a059fd320586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226893, "uuid": "8d18e623-4c3c-4aa0-a593-d1a9ce7c3149", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a23b42d-01c8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770209624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209624, "uuid": "b51f8748-0bc9-4783-9094-f06dc495df63", "comment": "Malware payload", "value": "d58598b7331bff9f56369aa3a51af713", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209624, "uuid": "4639a0a7-4349-4cbd-b081-693762cebf20", "comment": "Malware payload", "value": "87445f8cbb1734e7759489531d85ebefb57c5fcf145ba9d279be780d130acec7", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209624, "uuid": "a35c6edf-a4ae-4954-b35b-fa8bab0add76", "comment": "Malware payload", "value": "dd99b81d989152b5c3da4e01e4bc7da88e4c87dd", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209624, "uuid": "bf1e022a-2c55-49b3-990f-b5c13c8d1765", "comment": "Malware payload", "value": "6efb1f8bd369ca6cbd78ed1261f368a2da96a469baaa6515ea61d72908959dc8f47f24e1fb35dc97b61d435b41d28a10", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209624, "uuid": "e3cab7a7-c5db-4dcf-a04d-565e58b4b8db", "value": "T1B8A4F737BE695C84DF941EFE8231D5958DC9E9D391A6C0E1BC400941BEE9BC4F9183A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209624, "uuid": "b10b81a6-5be4-480f-8599-589b7daf3627", "value": "3072:N6/2x6A99US8N3aKOEv3OlGL1S99fAsfXoXMhKyD7GKF6SXtifUkz:N66hgxz3POYEAsh8FSX8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770209624, "uuid": "eeb50a04-ac5d-4e19-abcb-e7ea81fe9d69", "value": 458929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770209624, "uuid": "27f970d2-327b-437d-a08d-eff65fceb81a", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209624, "uuid": "394267a3-8fcc-438a-aa1d-802707e1fb89", "value": "game.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4d44f1-015c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163246, "uuid": "118e89d9-1b66-4d4b-8dba-685d4d2df16d", "comment": "Malware payload (Mirai)", "value": "604ff79843d7d1bc7f8ef6f4825ab30f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163246, "uuid": "693aa029-19cc-47ab-b752-f3c0c15a1252", "comment": "Malware payload (Mirai)", "value": "8751edc4dc95adea08f32568a9938f728a5918063b8aebd0edc375e49a0e7e35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163246, "uuid": "2be62db6-000f-482b-9886-7ac4a3b6cb2b", "comment": "Malware payload (Mirai)", "value": "885e135f0359614ddf44d4651235c7fe9da93e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163246, "uuid": "0b2dde20-a2f4-4947-9de4-570d7924ffa3", "comment": "Malware payload (Mirai)", "value": "b93c0a62e5d67fec1f61c4b535397940f25d76aec60d874091c74b54a2f6c0659ace3240fe2046fd89470c537bef6d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163246, "uuid": "09166827-a712-4479-887d-7b91a65814dc", "value": "T11C142946FC919F12CAD422BBFB5E41CD371A23A8D2EA7103DD256F2437CA55A0E3B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163246, "uuid": "8236ce9a-f309-4eb9-8a98-6e47b43bab77", "value": "6144:ccn+Zr5/XKAH3X+so4QdId9OgGLXDwRn:cC+3KAXno4cI7OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163246, "uuid": "b229d455-0c31-4cd5-9bca-e4d7aee21b34", "value": 209160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163246, "uuid": "7deb7f5a-ed10-4261-9c0b-4e3487a90f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163246, "uuid": "2a162742-8f41-4f36-a748-9755ad1f6771", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b16c3-01e3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770221396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221396, "uuid": "31553df5-5f08-43ac-b1e7-5c10a8466f89", "comment": "Malware payload", "value": "1383e309712189f66d42e9fda852a389", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221396, "uuid": "0c906123-f413-4273-b2a6-fb7a911b8ca9", "comment": "Malware payload", "value": "88235f67f1c524b73ece960f28815d62bc822f4586e292acefcbe5e8e9d7f5ad", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221396, "uuid": "8c8b3c47-03c1-41eb-8593-58e641702fb9", "comment": "Malware payload", "value": "8a00ee577458e9c6481c35658c4f3cbfafe149e4", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221396, "uuid": "a1b40365-9a9b-4e3f-af2e-487373f6c693", "comment": "Malware payload", "value": "14e79a91aedd065066a9a1c57a7cb2e23a5df2bb56431026bf2862f1a6c0c4910f7ad4fc852e8f52d5a9c4e457dd80f3", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221396, "uuid": "0c3e055c-14a4-4777-be3c-10ff83ad099b", "value": "T1F61833087D22259EFE3D9530C4585274E7A0022545B2ACF68A2E22D335D3FCB5B79B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221396, "uuid": "4a429ee8-9492-4320-a4fa-5138450749b0", "value": "1572864:OOYxI4pxtGhf2byZw25/L1eV01S2IaCWZDYt8OB/ZKp1CaQQhWWJoZgF0d73jSfB:OOKI4pSlRw2/I3025B/sp1CQh9OC+REB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770221396, "uuid": "5af26fcd-d175-4ca1-a8e0-7bc47d9d831a", "value": 91279141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770221396, "uuid": "43e59dd7-bcd8-4af3-aeae-cb831f19257a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221396, "uuid": "ba7a170d-fa68-41b0-85b4-fa80e131eaac", "value": "class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9552a7f5-016d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770170559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170559, "uuid": "c5f3fd24-2de6-4465-9c39-28a927feda82", "comment": "Malware payload", "value": "fd80b95e598326355ef026ba1aaedecc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170559, "uuid": "b488895a-e7e8-41b3-92e7-46ae63b040b2", "comment": "Malware payload", "value": "88aa280ce4103acb3ff4eae8a2f74196acebdeb5cef2f7cacedc6a93a6777b28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170559, "uuid": "7579dbfb-7c71-4441-be37-7146829e1620", "comment": "Malware payload", "value": "ba3ac0c0f65b08c58658823e06435ad7b296afa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170559, "uuid": "7155500e-be42-4d8e-a02f-97d785087bea", "comment": "Malware payload", "value": "b3e77fbfa4c9ee694d3f84b60f217a33bd0238b2187ac63efc0170227609aecc35b9c4472cf250a4256e379901d165ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170559, "uuid": "40815f0b-b82e-4348-87c6-082c881f1998", "value": "T153C423494EFAA0506784F02D82A7C2056FFB67136DF3B71F5E6551F30C2A66980CA68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170559, "uuid": "e86601e8-e21d-40c1-9bcd-92bf87d877ae", "value": "12288:IQ2VF6VKge4MBCPdsVkGe7ruWvUPIRD2imrNEbkWiZbj:IxVFkKghsVKruM92gyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170559, "uuid": "399ac5f8-66bd-4f11-b8e7-0c330396751d", "value": 562492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170559, "uuid": "c7cc07d1-e59d-4a00-8a19-dc0de2087b31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170559, "uuid": "be204e38-6b77-46a3-84c4-3847b9b0b2ad", "value": "unikeyNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221173a-0191-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770185989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185989, "uuid": "334be12a-f94a-4075-b107-66343a6b4b81", "comment": "Malware payload (Mirai)", "value": "945ccc998c7e9da021cd97acd75493d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185989, "uuid": "fe307136-8b92-4eb4-a659-e47253371ec1", "comment": "Malware payload (Mirai)", "value": "8942eaaac37811aed637c9f8b194cc3764e5d37c34b94e00ba7b9352bb631cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185989, "uuid": "6d214be0-1e1f-489c-bc43-4df86fbf5766", "comment": "Malware payload (Mirai)", "value": "1d1d7e12ee3f99da540c88bcc7b2d9a333fe20ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185989, "uuid": "1758a3eb-25d9-49af-8a95-725cf5c5c1f2", "comment": "Malware payload (Mirai)", "value": "34c76a875a2bb64b19eae0e3da4e8cc774dbc4d8183c28ecb36dedb19a66b2a024f9a65e75d3115aef9a62d661b5d3d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185989, "uuid": "f8cccd32-08b3-441f-bb43-0ac3353c76ba", "value": "T12BE3B51ABB618EB7DC1FDE7309AA4512108DA19612D97F6FB2B0C66CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185989, "uuid": "0af8f67f-80e6-410d-9587-4401d917b0e1", "value": "1536:agP7eTsFRlkHTmGiEMXZZMavPdZIj+1MQFRBLV6zZFqikmkfmWFiB6qNCZO:agPV9EgRu+WuRCJkmk+WFiBdNCZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770185989, "uuid": "cc7a4b05-77e5-47a0-b318-7c5cda3d3b00", "value": 143374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770185989, "uuid": "261ee061-f814-403a-8fe6-17786b98561d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185989, "uuid": "53680b6e-e45e-48a0-9c40-7cf87f495cb1", "value": "pXdN91.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1c7518-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770190976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190976, "uuid": "3da24f02-af31-4257-80b6-d0604e2e9a2b", "comment": "Malware payload (Mirai)", "value": "2cae31fbe331428183c9d602a9d674c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190976, "uuid": "3a26f849-494d-46e0-a644-d7424383194b", "comment": "Malware payload (Mirai)", "value": "89b6cae09fcf37842abf38e59af90a32faf00bd6cb3bc39fc7d4fba8ee0eb2db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190976, "uuid": "f1243aeb-8278-487e-a449-2a18e26c4457", "comment": "Malware payload (Mirai)", "value": "a1a58bed10a993b2744520328af2c1edd821bdaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190976, "uuid": "0815fe36-d3bc-4c46-ae13-e15e34235d8f", "comment": "Malware payload (Mirai)", "value": "1fc2841b69eac8cb021570e33b62a5f3a4193df69f59d28d9ae5f7ba92f3b568ab47673555860fe823ddcfa8ef9ff054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190976, "uuid": "2db344bb-917c-493e-8a0f-1df0f68917c3", "value": "T17C237CB3C03DAEC8D25C43786A354E3D9713E10597532DF6668AC666804BEACF60E3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190976, "uuid": "8f168a1d-2b0e-440a-8b25-3e19ca283bea", "value": "768:Gax/fvXvD56gqt5m7TprHNNhLOjhXtjqD6PCoC6pNo5FpS2CihTN:Gax/X7mXqjNNh4zPbpC5q2CiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190976, "uuid": "a980db01-7853-4392-82a6-58d926b647c1", "value": 48700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190976, "uuid": "f5e5770f-34b3-4d61-b8bc-ec157ce40ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190976, "uuid": "16a2046a-dba3-48ba-b3a6-292e7491922f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099f6ec4-01d7-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770215851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215851, "uuid": "8a3a756b-cf9e-40a0-a2c7-6ea278576c51", "comment": "Malware payload (njrat)", "value": "b8d8eb38b833ef2f195838e5cb7dc569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215851, "uuid": "5f19723f-919d-4a1d-b3b2-491cc60419f1", "comment": "Malware payload (njrat)", "value": "89e0de31f607dee0870ca12d4b460b46877dfb9f6118db546d7e77a789d18b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215851, "uuid": "d10a43b1-f124-4af9-914d-cf8279c1ab64", "comment": "Malware payload (njrat)", "value": "9c15ff14ec7eb6db69541cae91387060c2f383a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215851, "uuid": "01066196-83cb-4d31-8164-15393f9727fb", "comment": "Malware payload (njrat)", "value": "03a3b575515a42127189ee9564422050d6b9038809e5adfa555ef1b84bbc7c05ff50b44941f135c4ae7ee19f043fb923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215851, "uuid": "dfa8abfc-3e54-4bdd-bdbf-801e3c32afb5", "value": "T1FD0491350AE1849FCF451B3CF9D1733891BC97E1E862EAC4BE756895EE26E482CC1D84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215851, "uuid": "fd2ce305-8ee7-4b39-94eb-68778875af3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215851, "uuid": "e440c33d-e2e3-4622-9d5c-6217876b62de", "value": "3072:UO8I0d2weZYahlWZrYxxaHCFGGmH+lpJ:vZhurk9LmH+lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770215851, "uuid": "c9b8c80c-1695-41ab-a3c3-5ffc9c77acc3", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770215851, "uuid": "07331650-a8ed-4f3a-8e89-481c600dc417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215851, "uuid": "f262c994-6822-4ab1-aa7b-836b1111316a", "value": "SolaraHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ab0f6a-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770202978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202978, "uuid": "b42e4bbc-60ed-4899-9b34-499d08ef3b30", "comment": "Malware payload (Vidar)", "value": "e7bd49617abe329df13fa21ea4d83573", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202978, "uuid": "413e62aa-a7ce-4ade-87c5-0116df136c45", "comment": "Malware payload (Vidar)", "value": "8a2dc49e5889f850bba0fc5b0ffdc0b8bcdfc90558dfbaa44ee1b21b475f7112", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202978, "uuid": "ca068d03-2248-4770-aaaa-51c8a7f77aaa", "comment": "Malware payload (Vidar)", "value": "15bb6d7cc7b2928ddda55a6e9786729ae955992c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202978, "uuid": "5cc43857-f2f9-4c08-9737-a0180a205fb5", "comment": "Malware payload (Vidar)", "value": "8784f2098a07d7f22c15265003144d438810354da8bf8880f122a26e3e461730bda96a64f807a3eea3d0034000a5e470", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202978, "uuid": "5d4ea776-c613-4d8c-8d4b-43fb34504ff1", "value": "T155364B2B72A0D1A9C15EC63EC093CF10E5F3B1791B33C6E7529503689A979C99F3E660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202978, "uuid": "a385f5f6-e054-4e76-b9e2-c4920b994651", "value": "71f78f4628cb6313a1d0643cb0123fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202978, "uuid": "54008983-0b80-495b-b1a3-25855cc402c6", "value": "49152:dbDzejgtRPTasHYMJ8DUAGxxYvSikQSVnRYOBS1nVE/4ABhwVHx1SK:IGvwVHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770202978, "uuid": "7619457a-d334-4850-9e7b-86ca942ad668", "value": 4941824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770202978, "uuid": "70643b0b-f21a-487f-902d-ae1b6d6f72e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202978, "uuid": "848a877f-4c9d-4ee3-a92b-d2581daebd4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8095d5e8-0191-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770185986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185986, "uuid": "dfe4cdd9-3eee-4788-80e7-305e97a6760d", "comment": "Malware payload (Gafgyt)", "value": "dec3f65d2fb0a7f06357cee56600c4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185986, "uuid": "f79af01f-1f7d-466d-a0fa-9a344e0f9870", "comment": "Malware payload (Gafgyt)", "value": "8b279ece21d38c7ced805d3d96d4a67b884216ab3b8c6ea7ecdca79d17d3e643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185986, "uuid": "56eb7c83-2bae-4384-bcb7-f1f1c82ba379", "comment": "Malware payload (Gafgyt)", "value": "fe6cd83820948717e3f64b8a3c527db9c96a9861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185986, "uuid": "99987896-482c-4e33-9b17-48d773fc33dc", "comment": "Malware payload (Gafgyt)", "value": "ba3068a2906612e368c4f45735b15b423fc53ec9630f86db28887ec6d2d79712287818399f8c53d75e96c936bc165d2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185986, "uuid": "379d9eac-e19d-4397-a71d-e3af41a9bc00", "value": "T19AA32A0399A18FB7C186ADB525FA59300B17B8911B1F2B867139A7F8570F4CEB40FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185986, "uuid": "802270b9-e02c-4d0c-8384-a17ed6962f74", "value": "1536:oGQttwtioUM7aJc7itzKijco2wZUJCqzboRTsxOG+Cmc4GVT43qbuP+i:o5DZ2iOwZUJwTsxOG5mVGVT46buP+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770185986, "uuid": "3518a764-7637-4f4a-a965-991b0674b608", "value": 104158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770185986, "uuid": "41ba2888-e608-4801-8b29-3b869ff852ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185986, "uuid": "931b70df-7b78-458d-ad3f-f92cfe1d1f73", "value": "pXdN91.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4604a534-01a2-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770193189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193189, "uuid": "3ee8eb75-99d8-4848-98da-a3d18b6f6942", "comment": "Malware payload (MaskGramStealer)", "value": "1ffe6e8bdc1983910d12ef9d97f65b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193189, "uuid": "cae4fd65-e392-4b81-b668-fc3dc483f34b", "comment": "Malware payload (MaskGramStealer)", "value": "8c702723a25c5278e37cde31bb4ed662eb81a249a1d8b79ade5ac94c955fa3db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193189, "uuid": "1e3db223-f025-492a-b02a-45985237aa0e", "comment": "Malware payload (MaskGramStealer)", "value": "a99b293c18d3fc9551a11f7f5bd0a354207bb315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193189, "uuid": "6801d13a-6296-4645-96e3-769892e67b2d", "comment": "Malware payload (MaskGramStealer)", "value": "c41b95eeb00ec1e6198f44d63ac5e031d6dcc52e38a964a8363f1b29210adde3ced8dd598939fec582485b5fc7f78ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193189, "uuid": "178ae4d7-6837-4743-bad8-bd9575b359f9", "value": "T1B4230A2BA8E251FDC41AE5758DFB922E6877B8C0107D2A0E19F0DF0B2BB67B0531D251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193189, "uuid": "6068a60d-78b0-48f3-9ff2-69d6170339a9", "value": "1512861382a06675835d7a1b5c8d98e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193189, "uuid": "016274ff-234c-47d4-b45a-4b447b65ca92", "value": "768:jd/2s+WvVClkHywyied8E9QvMfzvXlhBgFZUSCRcQw8sCdfT:xb+yVgkSwyFd8E9QKXjWFZUw8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770193189, "uuid": "206fc5e6-71e6-4fe5-831d-da7525173035", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770193189, "uuid": "bd8a806f-e76e-4661-92db-0330d302e246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193189, "uuid": "5abdd0cd-007c-439f-8c1f-2b5b4ac7ab31", "value": "SecuriteInfo.com.Win64.SvitStealer-F.88895832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b47780-0184-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770180463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770180463, "uuid": "733a3c82-768d-4d4d-89b5-f90e9d79440a", "comment": "Malware payload (Vidar)", "value": "c7f4a28b8661235ae601b7d1ef2051d7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770180463, "uuid": "aa794aa4-fac7-43c9-ac1f-cca1e79475c7", "comment": "Malware payload (Vidar)", "value": "8cb621f19ec377eeb8f10c85c6037a20217dd5ef09a1274aa2f659132651402f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770180463, "uuid": "4f14f34a-2d1c-4af9-b032-84e3d20ede57", "comment": "Malware payload (Vidar)", "value": "0f47503d3a50121a5a8fe8dc760b4a0bfd9b6e2c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770180463, "uuid": "065df1a7-c699-4793-8584-29bc1e4dcf97", "comment": "Malware payload (Vidar)", "value": "242f42f8f31c388b6a9b506abdeab6fc3721452d8cac8a805cf225534b01d1a6daf95f60929e971e9c09f227f8846369", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770180463, "uuid": "116873ca-3728-4cbc-b563-ee074b502555", "value": "T10B96297F729592A8C26D853FC0A7CF40F5F372761B33C6E7129107A88A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770180463, "uuid": "edbe6923-a205-41e2-931a-ff0dcee5836a", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770180463, "uuid": "94f180c8-e165-44ff-a794-4fc68823aeca", "value": "49152:RNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgXQ49dpVMbzzWjvnV:Rz7Vp7DQ49dvjAgBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770180463, "uuid": "00e74cdc-0bd7-49a7-8125-3536029d3c46", "value": 8777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770180463, "uuid": "38bc254d-0df5-42a3-887b-ec39ba9d6536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770180463, "uuid": "6b2282df-eb17-47c5-bd76-70afd801df9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5ffe6f-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770210541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210541, "uuid": "16b5e1f0-ff0a-4557-9129-effbb1754304", "comment": "Malware payload", "value": "aa92ba5a60e204a7c39db1b92ffcc0a4", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210541, "uuid": "1ebe2c73-e0ba-44b2-acd2-6e19a3a2c974", "comment": "Malware payload", "value": "8d52d6d62dfb318520ccc16a9a7fcce4ae83bc528c0ea030498d873a1e8fc7cd", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210541, "uuid": "8a2661d3-4b4b-4ae0-9628-6350b0404340", "comment": "Malware payload", "value": "b3e65c85907dafac108ee6b46ba9076e12476baa", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210541, "uuid": "0f9d6cde-b779-44b9-a5da-ab53210fd0e9", "comment": "Malware payload", "value": "e5a63e342e328d573ed5be471c98701294beaa65f6ff223d71e1faa0182c30e8da8809bd74a849ecbe66dc9f9a969ac6", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210541, "uuid": "bc2635f2-fe32-4d57-ae5c-c90327832e12", "value": "T1D4A1810763A72FFB9A468DE85398620728F6C1BB38117A7DF7E51593742AE41BC31234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210541, "uuid": "6a789526-2b87-4a7b-8ceb-23c0283cbe13", "value": "48:Czw/GS0KrINGSa6k8GSaaZKrINGSa1Hn5yGSaaq5KvVGSaikGSaai:CV1M3DoM3nL35vsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210541, "uuid": "f8c675ea-834c-419f-8dca-ca2a6e98b47a", "value": 4895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210541, "uuid": "b4a914b1-b6c5-4017-ad3c-924ec778998d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210541, "uuid": "e29bbec6-acbc-499d-b9e1-76d17c7fb005", "value": "captcha@143.198.120.233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7321db-0198-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770189037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189037, "uuid": "b11b20d4-5534-4174-8605-84bdfa2cad04", "comment": "Malware payload (Joker)", "value": "80e9efdc555bcbe8fd1c4827ca3f7deb", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189037, "uuid": "b1b65c3c-18b4-448a-ae64-1a8062fa76e8", "comment": "Malware payload (Joker)", "value": "8e74d1b2ffb45a5774de04037add56dc47aab8b358007b0f9cf3dac40273525b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189037, "uuid": "24f5a37d-a3df-4ccf-96fd-5b2cf8cdfd8a", "comment": "Malware payload (Joker)", "value": "830c711f488779727011f6425eed4bce1cccd1bf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189037, "uuid": "c79d2a8c-c0d1-473f-bb6d-c2e36eb085db", "comment": "Malware payload (Joker)", "value": "dc329289add138aa22b5d468e7e5390ecd9ca8c09f309ad67b12663a953e8a78e71a490b74ccd9377d62d5190b67eb67", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189037, "uuid": "05ea10ec-2300-4ea5-beac-99771ee12832", "value": "T11797122AD70C7826CCB9B07AAE1A367632196CB82751D3D71501B1DD39F37E0875ABC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189037, "uuid": "a6867c98-9623-4fbe-91e1-da1a391af0b1", "value": "786432:joWNvXyrEClyLqQFbb1HU7ykebPse9it0r1LbVN8UV:joWpoaLqkb5HU7riX9iGxL/8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189037, "uuid": "c6dceb0b-0ce2-4248-a8b1-e9ead9df423d", "value": 40193123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189037, "uuid": "ca3b343f-6b7b-4cbc-9807-97f0a27c4220", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189037, "uuid": "fa1ab6c2-5390-4b2f-b907-ee9c5b2a1b7e", "value": "com.zena.facy.clean_2.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aebeb74-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168287, "uuid": "b3546d50-32c8-4cb1-8ecb-3496f65776ff", "comment": "Malware payload (Mirai)", "value": "1392a21d3a3d40acc89cf38687415686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168287, "uuid": "492a3553-37bc-4ce9-b6b2-d08e62146b64", "comment": "Malware payload (Mirai)", "value": "9034bc65224fcaebe0eed6e460129e23a038ecafcc6ee2ed86938fb785586fc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168287, "uuid": "299f3a26-2a95-495c-aa75-b27e6c15d658", "comment": "Malware payload (Mirai)", "value": "bd7deb18134a657e7ca61723dee610d3c56ba2e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168287, "uuid": "8437ab9b-e6d9-4b5a-b772-896c1bafb7d8", "comment": "Malware payload (Mirai)", "value": "d893886975cda6135aed0541eebf20746eed65d7781686cc498d869487d02d72823e3357538756e39991ca9f38d7fe4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168287, "uuid": "2cefe92e-abf8-4844-a255-faa99c4da498", "value": "T119B34C43BB1D0B43C49B59F02CF72BF18B6DB9B116A361C1A119EFC45372AB02526F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168287, "uuid": "059f9ab4-f641-485f-9e51-876b780ddf64", "value": "1536:aaMDq7AwS2giIYPTFByL2kRcI+Q0f/jRXeXPEO/PMm44tDTJ501u0fO:adQAEkEY3cIX0TR2P/Mm5tDTJ21u0fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168287, "uuid": "b0e0aea2-bdbd-4cf4-ba4c-e7ad2337d973", "value": 108467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168287, "uuid": "e954cdd9-69dd-423b-835a-21a14543f067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168287, "uuid": "a8ac24c7-bffa-49a1-b4f6-eb82be57a489", "value": "pXdN91.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbea9a1-01e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770219858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219858, "uuid": "182facb0-e555-4223-8a9f-b8c35501e5dd", "comment": "Malware payload", "value": "335544a5ab76170a5433d899e5ef0943", "object_relation": "md5", "Tag": [ { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219858, "uuid": "153036c2-27ba-42bd-887b-0ee2b05efb09", "comment": "Malware payload", "value": "909f1e3c4a4ef22220136e8f1ae02ef09fef0f853e3413ee59af14157c40703b", "object_relation": "sha256", "Tag": [ { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219858, "uuid": "c6d4c0e4-0233-4ebe-bed7-1f945684078c", "comment": "Malware payload", "value": "7c21ec9a37b680e865024c807444807a833d47cd", "object_relation": "sha1", "Tag": [ { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219858, "uuid": "a2427caa-ccf3-4ae6-b0bf-932e5596adda", "comment": "Malware payload", "value": "9de15112f2b7551fcd180c3c330147479ebfac6b444ce1c84ed288feecccddbbd7387e4847a72e4914d7d13698559efb", "object_relation": "sha3-384", "Tag": [ { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219858, "uuid": "249d5a73-c957-41f7-a30b-262faf5ca5cd", "value": "T1085195F71136C2C2D60219903C6EDE6D1D9B8BCE965715C25738E9BC64A4D4F134CDAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219858, "uuid": "7b5c425a-671c-43d7-886c-49b23419d1cb", "value": "48:bPEzRyOfsiVJAshJETKaAGLbPb46T9l86O:bsFyoVJgO6LbzJBlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219858, "uuid": "936d9bbf-7f40-4c14-b528-160d23209c87", "value": 2844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219858, "uuid": "74b133c6-cebf-4d26-b82f-e2145e676f23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219858, "uuid": "f53482c7-0ca3-4f19-85a7-c036a9b3fec3", "value": "909f1e3c4a4ef22220136e8f1ae02ef09fef0f853e3413ee59af14157c40703b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce725028-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168078, "uuid": "04deeda5-e390-4b32-914e-1e1b454d2c0a", "comment": "Malware payload (Mirai)", "value": "7d86a6dcd08cbcb799dead8e6fa25422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168078, "uuid": "e04d0fda-008e-47f0-9894-67d3dcc5561e", "comment": "Malware payload (Mirai)", "value": "914d57bc18ada454d603df9a9a4b47a3ff1d8cf66a08319ff630380eff27ab76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168078, "uuid": "f5ec63cd-96aa-4509-aaf2-895b16c92877", "comment": "Malware payload (Mirai)", "value": "818691ae10e0f40d8b75dfd43181b521dac1d3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168078, "uuid": "e56c7bcb-8015-48b0-a0be-aa0cef1bf39c", "comment": "Malware payload (Mirai)", "value": "3006548d8b031cc32183155c6ab707d4b61e1b3325aa1d6b962ecf40bb840bbf58b1108258299249687465c6fd52e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168078, "uuid": "5e47de24-3e61-494c-ba2d-d83c5629bfd7", "value": "T1135338C4E2C3E8FAE810087D316BAF729E73F13EB135D99BD3D959639905A02E10625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168078, "uuid": "1465e821-61a6-4cf5-9c89-b6ea8eb81151", "value": "1536:0UEMAWwPQk16qHTWKRmyaSkDu4eFOVur:0UEMAWwr16qHTWKRmyaSmu4aOur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168078, "uuid": "30d60daf-4ea9-4a7c-bd5a-d3ddcc1cf15f", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168078, "uuid": "78866bd8-aded-475b-9475-371eef7f367b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168078, "uuid": "7bd7120d-0ddc-4aca-8e2c-04bc1afc2bf7", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae11a21a-01e7-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770222999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222999, "uuid": "951f91cb-4fb0-4a27-8296-b0e608d48282", "comment": "Malware payload (RustyStealer)", "value": "1992dffcb86f4d82dc50f23ff35811ea", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222999, "uuid": "a8f3b7d3-7d53-4c1d-be10-f08a4deaf50b", "comment": "Malware payload (RustyStealer)", "value": "924c79d8d817dfc8ddc17e1cb843b766303ec5a6c23f78d32715e7b9b05c26c5", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222999, "uuid": "fba4e9d3-7b9e-4e6d-ab25-3fd481d72826", "comment": "Malware payload (RustyStealer)", "value": "43884cdd029553c208e9a0a75498460355ec8ed0", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222999, "uuid": "9e4defee-27b0-4ca9-90f6-257b06ef27f3", "comment": "Malware payload (RustyStealer)", "value": "60f902887556c6f54003ca5b91dee26695c9b22f05436e94bc425e424981a09b980a94359b04824b03d249a4f8f9de82", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222999, "uuid": "54485edb-7511-4f0e-aab6-098acf5f8ad2", "value": "T1FBA57D43E39581EDD1AEC5B8C7579732EA32B88D053076EB2BD05B202E26F909F1DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222999, "uuid": "978a62aa-2062-4de3-8b77-2b81ddfd0271", "value": "2bb3f0e4c574a56cdcfc891e42a56da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222999, "uuid": "a32970b9-5b6a-49a9-a515-306a861fb70b", "value": "49152:AMDWvLU6q1mT7Gb2Hme34pxyEiw+Ug9EVHliVccIU6isZ:AM4q1faB34pxyfV9M+sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770222999, "uuid": "e15ecd10-f550-4341-a3ca-6d45e2dfb1b7", "value": 2090496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770222999, "uuid": "0893a41f-0f41-47ef-a426-5f3ac0b27235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222999, "uuid": "e7ab98ab-c709-4df5-8569-5cd5eab06acc", "value": "924c79d8d817dfc8ddc17e1cb843b766303ec5a6c23f78d32715e7b9b05c26c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d956438d-01e1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770220495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220495, "uuid": "856021cd-0453-46a7-b508-c9ec706e397a", "comment": "Malware payload", "value": "78aef23fa47fc251415f30f6aae2049b", "object_relation": "md5", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220495, "uuid": "30939619-c24c-4410-8147-154e1adcbb02", "comment": "Malware payload", "value": "92e0425de63c10a95192e917c1ddaa8925fdf3712748b3d8f41bea2ef3ada96f", "object_relation": "sha256", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220495, "uuid": "b26754b2-8328-47c8-ac58-13504415cff8", "comment": "Malware payload", "value": "5557d3ad6ab2bf6044694d63d6be42eeb65e6982", "object_relation": "sha1", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220495, "uuid": "7bba4e1e-73d7-43f3-9577-feebf330879d", "comment": "Malware payload", "value": "78a0965c4affaece66459f202a3936457345b8a6b9c81464eb0b286abf931d11c9dc4984d52bf84df7692f7e31142c91", "object_relation": "sha3-384", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220495, "uuid": "4f0081f0-8ef8-4505-8d56-540826ea483b", "value": "T1144512BBE1B624B482A26389658CD0CDFF1F57035D9C79AB6F0E0EE780315478626ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220495, "uuid": "a20e689f-2769-457e-8952-4f97091a83f9", "value": "192:byyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyw:rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220495, "uuid": "e07d0b2a-bb27-4433-a29b-9a40b1a0da41", "value": 1248593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220495, "uuid": "5e3bfc6c-b907-4366-b81b-226230bc6420", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220495, "uuid": "c3ea1792-e9bd-40bb-8b87-254d9ea37072", "value": "92e0425de63c10a95192e917c1ddaa8925fdf3712748b3d8f41bea2ef3ada96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfd2a4f-01a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770195592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195592, "uuid": "25c5cc99-5f00-4fd9-965e-5c6b28121926", "comment": "Malware payload", "value": "40ba38d5fe6042da6a6d9b5b45239bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195592, "uuid": "f43ab9c0-b2ac-4928-94b6-6f4a9d9125b6", "comment": "Malware payload", "value": "9494c06be311366ce1eafccddbf38e2b925f7657de1918ca06b160dde72db99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195592, "uuid": "f9e9de56-b43f-4a46-b0e3-34b043bd606f", "comment": "Malware payload", "value": "70d20381da08902b95b1e3b79ee62a2ffc449341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195592, "uuid": "d23eb2e1-d59f-450f-b4db-0a8c93ee59cc", "comment": "Malware payload", "value": "54ea3e685f0b57e61927f5ada70aa58ef3ebdefd722317c3914562ac5d340637bb8357ebe0e8ed059618667008fb6536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195592, "uuid": "51906ff9-aaa9-4c35-95ab-2bf246af41dd", "value": "T1CC34381032A8C029E5DE4F3B8C6088E44A377D3EEA25C51F7DBEB78D1974B418954BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195592, "uuid": "9d0e86e3-931a-42f7-885c-a0ed535f147c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195592, "uuid": "e631eac7-b279-49db-aeed-f339d8f233b2", "value": "3072:d3pioChzAX4tn6OFUbhWOVH2cQubiHgC3ipiCM:dozAXb9bUU2ySbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195592, "uuid": "fc14fae9-02ec-48e2-8506-db40a5c09a02", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195592, "uuid": "24fded0d-41c0-4843-96d7-f8c7ac541eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195592, "uuid": "2b8660bc-1aaf-493e-af9e-83d98f53f61b", "value": "Seliware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b57668-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182189, "uuid": "16080e0e-b264-4b6a-a9e4-bc54eecc160d", "comment": "Malware payload", "value": "b6e87977f28d0af99dcc551b41bfa003", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182189, "uuid": "0363302f-9007-4067-817a-364b26ab9176", "comment": "Malware payload", "value": "95034e438f247173b65292e79f4a4d61bd379d35455f00a9d3f84cb5b6360dc6", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182189, "uuid": "9313c860-9e08-45b6-b5f0-a8df59ab443b", "comment": "Malware payload", "value": "3e447a137506b7902c57aae4bed5e55d9a49eaeb", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182189, "uuid": "839f4169-486d-426b-a300-b900ae1f7c32", "comment": "Malware payload", "value": "61f1968e19e4a86bba20eacd322bafba3ae86ebd9b618df70fb23453eb705a7652d5aadba1c5e732f244cead5b1f9da9", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182189, "uuid": "21400665-27c5-492c-9cb5-178df32d503b", "value": "T19F55330E241DA803DB099D6BBB52539DF8CC432D3036C99DA2B93A11F3A853D67E52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182189, "uuid": "c7e0caae-4e40-4fd0-aa1f-8750519fba4a", "value": "24576:1+kTRdVq3OHZdkOoY+cHoPlg4Wdpb1qYg+4c1zaXwzDDP/Li0tq6:1nRmrOxhKlgHpkY14ZXwj/Lie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182189, "uuid": "1b4d631c-048f-4783-8830-ce5f2049dac9", "value": 1375786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182189, "uuid": "88db7527-18f9-41e3-b4ff-8ebb22c0689a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182189, "uuid": "f8d8b66c-bbc9-484c-b196-4d0269733bb6", "value": "95034e438f247173b65292e79f4a4d61bd379d35455f00a9d3f84cb5b6360dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253657e7-0187-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770181538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181538, "uuid": "3af66bee-e61e-4a08-ae85-022babcfb4ac", "comment": "Malware payload", "value": "0f5ee3c0ff559cdd3c322e57de2dbe48", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181538, "uuid": "42d0add0-b81e-4926-a6cb-92921180617d", "comment": "Malware payload", "value": "9645d1974020b793786685f8f96603060c5699a75615a4da471ac10fa9db882b", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181538, "uuid": "68c22199-8049-489b-aa7c-0d119f68c031", "comment": "Malware payload", "value": "4b1ed734061aadfb8a981a7f0e941040164df853", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181538, "uuid": "00d2b8e2-859b-4e44-b912-65cec1c4b41a", "comment": "Malware payload", "value": "b1878ec2fe4451ae2ba97516d3e77727091ea4b92948cee7ac66111b581d52424136c0a4defc347dcce40d475aad2137", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181538, "uuid": "657296bb-10eb-476c-b963-b73144483862", "value": "T18B33F1B1BE96ED20F520C1B29173BB715198FB07E3D73351413DDA3297C5B805A8A6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181538, "uuid": "486e70ca-be9c-4ef7-8c10-6730af823c26", "value": "1536:tjlY6GGXjAbfeXIEjj64IsTgbtBbgfbuU:tjlXlcbfdE/aBBbbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181538, "uuid": "64a3454d-86a3-4be7-9c17-f0ffda514512", "value": 51734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181538, "uuid": "443f6aaf-b6be-42aa-8962-624d255d069f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181538, "uuid": "76460d1a-ef50-49b0-a394-0e941beff6f4", "value": "9645d1974020b793786685f8f96603060c5699a75615a4da471ac10fa9db882b.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a17fbc8-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236468, "uuid": "e2519307-323d-4121-897d-a6d3beaeee16", "comment": "Malware payload (Mirai)", "value": "957defdfae4a18680dc72a6abe02c9b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236468, "uuid": "e4e246f8-f009-47c9-9569-17fe09e37608", "comment": "Malware payload (Mirai)", "value": "97b405aea4b97abe1b581025018eefee43cd388e57019735b424ac68b3ab1e04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236468, "uuid": "1b7c3dce-ca66-4399-a63d-65404dbedcff", "comment": "Malware payload (Mirai)", "value": "6418f1b12aeeb243df10c6c7901e64bf962c260e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236468, "uuid": "6117129f-eac0-48b3-895f-6ac68af78e0a", "comment": "Malware payload (Mirai)", "value": "3b995dc62ce63846e8a5365e5ef7b465034810eb791ddaf5ad281e7958799468ea468d6f47ac87810bcac6fedbfa13a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236468, "uuid": "7af95dd9-76f1-4103-bcd6-054ac1199720", "value": "T199B30946A9429F11D5C631FAFBAE418933136FB8E3FA7101D9206F5423C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236468, "uuid": "08cafa22-a2cb-42c6-b769-c26693278c55", "value": "3072:0qxvPnNM5NYqVzpOJn4fGthvNOiLd8tQa/F7h1eTlKzyf53I04+b7Bz:VxvPnNMBmZ4ethvNOiR6Qa/F7h14Kzy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236468, "uuid": "394ad011-74bc-48a4-ac45-63851c5d5d9f", "value": 117220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236468, "uuid": "eaafa9ff-28a6-4c67-8694-f1b9e0461bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236468, "uuid": "eec52fb9-7542-4344-b6c8-1ea06233d47e", "value": "SecuriteInfo.com.Linux.Mirai.9838.14957.8784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7f71d2-01a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192636, "uuid": "8fbc33e9-548c-404e-bfd5-66e5226c6dbe", "comment": "Malware payload (Mirai)", "value": "1444bb876e983b49fab9b5a20a1bf250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192636, "uuid": "156f3c68-e29b-4774-a69d-1ac77c8a3e3e", "comment": "Malware payload (Mirai)", "value": "97ff91263d654f2e91f066adeaedc41269b037eb4e15662acda0f460f8ba6eb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192636, "uuid": "6e4a9a79-3919-4724-9cd6-184e2373ba85", "comment": "Malware payload (Mirai)", "value": "9c65a45cbc1d1ab534e2bfd598e9f38d63d5d702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192636, "uuid": "f182cf16-75c3-44c7-ae25-2240fe570be2", "comment": "Malware payload (Mirai)", "value": "e407aeddf54cd5c1c6c02a06c945e05344395f65153363ef21835bb2d7ee62f6dc3bf3e1cc094580cf6ad3fd25d88454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192636, "uuid": "64356c52-4802-419d-bd48-52843647857c", "value": "T1A623E1BB8719D1B8C37799320F4943CDD7BDB81569165A2B9ADA31FBE0232148C34BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192636, "uuid": "545f50e1-a131-4ed1-bec1-b49c2c1aa323", "value": "768:xZbRiuoU7K7guxHGETlQ+UFN+JzZKXYt+tPXXraqzXORnapQ0K5KtPcaLsA4Z:Zi1U7KkuxHFy+Uv+JYXe+xnuqzXORsKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192636, "uuid": "03f6c3bf-6b72-48b2-84e0-8dc880aecce8", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192636, "uuid": "1bbc666f-92e9-44ba-b8c9-758d145773c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192636, "uuid": "c7f986ea-8501-47f6-82d8-76e3bae16a72", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c6c296-01bb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770204228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204228, "uuid": "fa2aaf3c-3c4d-4dae-a102-22bdc5b253bb", "comment": "Malware payload", "value": "1f186fc73f106373b7744cb909d32df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204228, "uuid": "388366e9-8ddc-4f64-9f88-16c2f6ea75cb", "comment": "Malware payload", "value": "9819b8bcb72df8cbfb081e848b0105a7e5f38a520db29f10d199430874c94b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204228, "uuid": "ce87a800-ca05-4307-bf07-57aa62af6a78", "comment": "Malware payload", "value": "3f5a264438d021e4514969708522cdb8fae54a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204228, "uuid": "b460bbf7-7e06-4bcd-989b-2d47b1997b7a", "comment": "Malware payload", "value": "d81724a99569a215b515a81728b0a1a50dc453945c62dd4e6c8420ce9c01a6b5819bb7d2b9187a75bf6973f0adb82dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204228, "uuid": "86629df4-7a98-4bf9-bf85-4b2cf3d475d4", "value": "T1D054B348128364F4FDE3EC3A4399B75FB5906900189DE9338BA1DC5A683AF831DE71D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204228, "uuid": "aa000d6d-db2e-4b46-b894-e530950d683d", "value": "12998a4a20680cf0ba12a53605895257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204228, "uuid": "50a50678-423e-4287-ac49-180338d4a083", "value": "3072:Aif1fUZ1WwD/z3CnEJjdaQQ3+cdMHThF8LxiLWHHtSjedWGHP:pf1fM1WydufdMHdeLJAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770204228, "uuid": "a27f4546-977f-4176-9422-eb1778e5423e", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770204228, "uuid": "22b2a23c-3bfd-4140-8a8e-76a3d2122fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204228, "uuid": "6767083b-b2d5-43f4-b343-4a022d74521b", "value": "propsys.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3103343-01c2-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770207143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207143, "uuid": "aefb5c02-1207-4015-8daa-512577133d31", "comment": "Malware payload (njrat)", "value": "52602d918469e7b7d4eb5249f72e52e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207143, "uuid": "b3830577-4cfd-4203-939d-836aba6ede5c", "comment": "Malware payload (njrat)", "value": "98c97e9d13b3dc45e3cd593409b7d8ceacd4e094a1c6051804b2850b2c58db74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207143, "uuid": "ce60c1ba-d18d-40f5-abc6-f4a8ff52fdea", "comment": "Malware payload (njrat)", "value": "a2889297994890f1214cb0d0e0a56592a3f1be03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207143, "uuid": "85a2f22d-f9fc-4cfe-a581-2673b9b7b015", "comment": "Malware payload (njrat)", "value": "d5fbc4fac2eae123c62644505356ad6df81e1a1c6f8d4899b69239fa7efd486622f1e615ec268795bdd8a4073070c8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207143, "uuid": "6bec952b-4aba-408e-b62c-0113e97a2c52", "value": "T1D225D09177F4850BE1FF2B79A4B248194BB7B852593ADB4F0CD890AD1EB37408E507A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207143, "uuid": "e21ac4b5-5e05-4f00-b06d-2bd010d96fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207143, "uuid": "3b669213-5bbd-43a6-ada5-ed3c6e64b715", "value": "24576:yF/pyxJzck+uGW/yFoBkkAQ0Eok73LY+E:yF/pyTYjqqanTVr30+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770207143, "uuid": "741ae383-f29e-4a6a-8bb3-f6f7ad204666", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770207143, "uuid": "bbf5c848-d1cc-4f03-9dfa-8557be2f9370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207143, "uuid": "32f32d31-a2ef-49fc-aa4d-435bee4b5434", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea016a9-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189982, "uuid": "6ac799ce-3d28-4236-ba72-fbab3b26bd1d", "comment": "Malware payload (Mirai)", "value": "ee1d780df69354740d02ebf228bfa5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189982, "uuid": "f76d861f-94ea-42d3-87c9-03003f7b1ec3", "comment": "Malware payload (Mirai)", "value": "98d80783660c26037d3b3c32a1f2f5ce2bb2c2d6a5104a46546adac75b9f3f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189982, "uuid": "7051032b-1d56-46ad-b26f-0f6eedfc18c0", "comment": "Malware payload (Mirai)", "value": "dadca35ce1763449ae2f8b7dd47ad3c047bf7abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189982, "uuid": "7e5f74ec-fed6-43f8-8758-d9d8a7fc46c8", "comment": "Malware payload (Mirai)", "value": "0e90594c5d33e1eaf9ae190994ae77e99f1a0cd59e794c27117009099c51c5cb9733f1a079eb260c40715c1e702773bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189982, "uuid": "4f549c73-fcd7-486b-b8d5-8236613182f7", "value": "T15B730A82BC40A62AC7C0177BEE6F109E3310A7DDD1DA3246DC155BA47A8AD0F4D77B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189982, "uuid": "112b3cc2-35eb-4677-ac5b-b18d6abc6e10", "value": "1536:mAuFbl7Sfgy6BKDsVdWRNmkiQ5YqMornay7B8t461r3XTe0:4FJSfwh6O8DPV84Grn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189982, "uuid": "5bc192c4-609a-46bb-b029-e50d33320e70", "value": 74984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189982, "uuid": "2b5553b9-f40d-4989-a0fc-0695cb75190f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189982, "uuid": "071a23aa-cb22-4cd5-a6b2-81018ee85f62", "value": "nullnet_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab116194-01a9-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770196365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770196365, "uuid": "34e7768c-ddd8-49aa-aa65-91f00099f6ef", "comment": "Malware payload (PureLogsStealer)", "value": "8bf61dc7a30a52999b29a0363eeb7134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770196365, "uuid": "72dbb323-83dc-49e3-9e8a-914b184c63bc", "comment": "Malware payload (PureLogsStealer)", "value": "9914a65cbb8460e2b6d4fbe679149a21cc1ee73a9556362767c23f829caf64f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770196365, "uuid": "9312787c-575e-45a7-922c-abfa719fac4c", "comment": "Malware payload (PureLogsStealer)", "value": "9a4aded3eb39f5bba7df8da3613d4e1af9bb7eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770196365, "uuid": "e1266d0d-ae44-48e7-aa02-818bb6718931", "comment": "Malware payload (PureLogsStealer)", "value": "c3c2fa5fbe7fa9899c7d422efad46af7ab82380d33abcdf2b2023be1d3f8d4abe320344b81d141fa799c2a6eef0b4772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770196365, "uuid": "cad0021f-a922-4262-991f-14305c3cac54", "value": "T17EF42351F38CAA04D2F74A3E6BD2C452DBA6D7D40B615634BB2872021F53EAFC265C92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770196365, "uuid": "22b9b4f4-e72f-49c0-9bc4-cf80c7151a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770196365, "uuid": "acbb9402-2c75-4951-a8d1-c05dc17728bc", "value": "12288:cmKlr6Vc+x5bKIkou3E3DzRJjuQqtRuZdd9yaDO4DgrPOwDLcY:NKldaK5ORJqQcYZxyaq4D62q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770196365, "uuid": "8454cc77-7aec-4ba7-a95b-23e769603513", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770196365, "uuid": "596b3af1-2333-41e0-a456-81d784f287ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770196365, "uuid": "5fea93e8-9484-4b7a-9428-c25848c1718b", "value": "8bf61dc7a30a52999b29a0363eeb7134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ce881b-01ab-11f1-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1770197276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197276, "uuid": "70a7189d-a46d-47c4-9a64-c0151be7111b", "comment": "Malware payload (PureCrypter)", "value": "784ef985ae42c5f7e2575f67a89feb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197276, "uuid": "9231bfa5-4114-4d06-a193-2c2957b3a021", "comment": "Malware payload (PureCrypter)", "value": "99a08f994f044f9b229015b8cb264eb799c835f9806afa7ccaf2143fbd14cf1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197276, "uuid": "cf9ede65-b573-4fad-8208-1535b4ef9cde", "comment": "Malware payload (PureCrypter)", "value": "8b295b7e350b51dadc2d1784891d481ea300e78f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197276, "uuid": "effaa75c-6be4-44f1-b7f8-a123c79b6afe", "comment": "Malware payload (PureCrypter)", "value": "b3fc7a39d08638317a25a1db109128e5bcbd9047535c280cbd7ff30693e407f83ab8d2e64e4cb85c34212b6a48f03a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197276, "uuid": "b4b7cd20-fb2d-4512-a90b-5fa9b81a8d2d", "value": "T1998422C0FBFA6D9DCAF657BDC0C4558482E28890DC6DCF83B05E0B1AAD51752CAA7603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197276, "uuid": "6b06b6f0-2839-41fd-9574-c51cae24de07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197276, "uuid": "61ada5ef-98a7-4284-ab08-2fe892177994", "value": "6144:vTVOD3hL8xgiMoBIj5FUwKwpiAFb1cOUMzhPeV+0tm8iH4ZEqkNb69BgF1gZ:vJUx8xgwW+wFiAd6OUohGs0xYKSNu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770197276, "uuid": "583d3aa9-bad0-4370-9283-2c6f7134160e", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770197276, "uuid": "0766eb2f-3b22-489d-8b7f-e5102a562c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197276, "uuid": "2afa760d-b7d0-48b7-a3db-115021ca80f7", "value": "784ef985ae42c5f7e2575f67a89feb73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db58c711-01b7-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770202459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202459, "uuid": "53ff848f-a807-4daa-b24d-42915ea56a8c", "comment": "Malware payload (CoinMiner)", "value": "84770c1ace94c4dcd1e573556e3ea4fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202459, "uuid": "0f194305-b656-419a-8d3a-ad11f626a224", "comment": "Malware payload (CoinMiner)", "value": "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202459, "uuid": "f55175de-f214-40c0-b83b-fa3a00966555", "comment": "Malware payload (CoinMiner)", "value": "ad8cd2b9b0cbbc56228362a97d80ad1cd6c7739c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202459, "uuid": "f38a4d33-b620-4116-a154-1bd6085051d2", "comment": "Malware payload (CoinMiner)", "value": "bbb113c64cf639648e3b6ffd591d1f9ba87a6b78f5ee2c139526c4b4434c865b32650bd630e504aa6bab57b881c152a0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202459, "uuid": "c751063f-5691-4850-a216-d087883984dd", "value": "T1EDE5230AE7E804F8E0B7E27889634A46E3767C5A1371E78F07A465561F23690DE3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202459, "uuid": "9c596551-1725-48fb-948e-a2254cec8e62", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202459, "uuid": "03494861-731f-4a6c-9685-884ecf7d863a", "value": "49152:8DojF4Sjrsk5kLj9Zn6Ym9WvUJ+R7G+K+zsR12/PVK5XQeIG+I6:80qZpvUJSG+Kac2/9K5Aga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770202459, "uuid": "de439298-a15c-444d-ab71-d4456e981c05", "value": 3223720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770202459, "uuid": "c22b3103-dafe-49e4-b34b-cbb6b15a25f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202459, "uuid": "cb194bc5-3c01-4317-a7d7-5e30e952177e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7031188f-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770176510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176510, "uuid": "8e97755b-9bcf-4019-956c-9ae64e83d6b0", "comment": "Malware payload (Mirai)", "value": "61ea012f7a4c5cbe69ab0be191fa53f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176510, "uuid": "7ddfa841-32c4-4f59-b45f-e2141a0e9a56", "comment": "Malware payload (Mirai)", "value": "9a544bc1f8a0cf6e796a963f8f13edded6f77470b26958f3347799065b8e27d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176510, "uuid": "7337c2dc-de09-40c2-ad18-a1e631d3477c", "comment": "Malware payload (Mirai)", "value": "06c66334af0b2e6de3f7de4d451d93fa9100d804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176510, "uuid": "4c0074f5-6812-49c0-bd82-b48e3e585e08", "comment": "Malware payload (Mirai)", "value": "941352712d81bca19253037693ebe73155c5742934a873b39c5549b0464caf92b57a299cf58ab694a0095c59321177dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176510, "uuid": "98281163-11d0-497f-9550-44208b804b93", "value": "T157B3F1537690916ED2CEC2B60B67DF3B72B07446132467A6B315FA712E27E70222D7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176510, "uuid": "477605d4-487e-4a18-b0f6-2cbbdc5cf83c", "value": "3072:Nov4QV8UWY4GPjWB5BopRm1zQ/YSNabYtVfEKS0K:Nov3OUdi5BRaYScbks30K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176510, "uuid": "d1a87ed6-1340-4f05-8b0c-3bb4fdc574db", "value": 115521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176510, "uuid": "dd8ab9fb-dde6-409c-af7e-ac7f2a65bbd3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176510, "uuid": "f74c03f1-5aba-4c33-94f0-acf0f181234d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3192ea-0197-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770188633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188633, "uuid": "6e8b7b4f-c80e-4575-95c1-a32a79f533f1", "comment": "Malware payload", "value": "3f72e7bbbb37e5dafe6fb00445d0346a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188633, "uuid": "03ec6f91-a2b2-4a0b-b2aa-1230685a7900", "comment": "Malware payload", "value": "9bac0b11a81ec42bfab0e93729f2d6cb2699005c9ff8cb4ceaee37186fa87890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188633, "uuid": "c3646e12-6f31-472c-ba44-23dd9b8a5bf1", "comment": "Malware payload", "value": "ff2366c92a19ad3dfeb83dae5138642888303755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770188633, "uuid": "e8b7c60b-19fe-4acc-8123-13aea66904f4", "comment": "Malware payload", "value": "79354984a925f5c445b9174483350e9b6ad273b30057f1489bd69fdc2645150277b8beeb188724ad33784cfb35f5ebc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188633, "uuid": "1c4dec6b-b126-4db2-b519-1a2fb17b8ef5", "value": "T19FB1BE959BD51FA2C89813BCD19B0BA423B4F714A7D343330768CA143EC3654AF9380C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188633, "uuid": "49a65cda-3a6b-4b8a-be00-44bc5d66f5c8", "value": "48:g8YIjDGNLAJvoN2s5DzSDQ5G70LW0eKCgAlzTRAlAz0nmCyI:gUDGNLdNDvS8k70LW0eX1zTmaz0nmCyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770188633, "uuid": "8f21c89e-1b6e-4308-b16e-4548bd9ba722", "value": 5295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770188633, "uuid": "bd6180b1-0b75-46f1-beea-4206f35c5d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770188633, "uuid": "e320f355-fb87-4d56-a3ae-cd77b976fc50", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb867b0e-01e2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770220901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220901, "uuid": "70d08d60-c8a9-424d-81df-ec71f5c46385", "comment": "Malware payload", "value": "3666078ad3dccaed3ff06aa5d4c1f475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220901, "uuid": "375ba600-1f1e-4eab-85fe-80fcc3b52c9c", "comment": "Malware payload", "value": "9bc0eaff0d5bfacb40522a06548cdfe6c0644eaef046bddc460aaef481060503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220901, "uuid": "d444c15f-1e09-4fca-a92f-362c2e9048b6", "comment": "Malware payload", "value": "a1c6a896f10a3ea0a6cdcecff6a2a06450a35085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220901, "uuid": "6aaab8d1-be7e-4ea7-9c75-d88ecf800988", "comment": "Malware payload", "value": "3f1af921f9de18eec79c6a8c93234b81972fc7a02b8de26572acc5b8f01cf9cfe54f0e851c1b16494cb40e334e5736b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220901, "uuid": "6c9ff238-8430-4e28-9288-c82bb07d7840", "value": "T13C362902B8D204A5C27BE1305EB192527B32386943313FE75EA75AA61DF9FD4273E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220901, "uuid": "fedcdb01-b267-482f-a7fd-3ea58b692377", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220901, "uuid": "01f54a83-935f-4ec8-8cac-895ebe10be04", "value": "49152:2CHL/ZcUjUBOiGvG5JYBuK1phSSv+VMbtaqRHosXR2OtLkTcWldq4r34ahBGA3ed:HZXwYfbvQeG41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220901, "uuid": "ffb4ebf5-9359-4dfd-9437-8c9488a2df15", "value": 5149312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220901, "uuid": "80667979-b3f2-4444-995b-df0d3cb1466e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220901, "uuid": "19747d87-0459-40a6-bf59-1fe1825a9dad", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f748d7-01a6-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770195068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195068, "uuid": "f0c0540f-6603-4551-b08a-3f6c11e660c3", "comment": "Malware payload (Vidar)", "value": "885a4c010f3865a4777bfbb6ee22f23d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195068, "uuid": "19dda67b-263e-470d-819e-c110e41a398c", "comment": "Malware payload (Vidar)", "value": "9c3b57f82fd29910fec00117180f3b4376ae6c6ee6123ab21226a11bd9b72ff1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195068, "uuid": "f7e6aa0c-a0df-4aa3-abb3-3ec0d0e4a7cf", "comment": "Malware payload (Vidar)", "value": "6075c69c27333c9e87a6a65e8d6236a953e2c8d4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195068, "uuid": "3102f083-27ba-47f0-8214-26c7008a9af3", "comment": "Malware payload (Vidar)", "value": "639b190defacdcf0615622f10a0da8aad1135bf8202a1149692224302655a6a7550ce8bebdba9b461a9c8ba78b12d40d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195068, "uuid": "f099f85e-a777-4d16-b0c9-58aafac77234", "value": "T114165C53BE84C275C6DBE139E86191A56230B808073136D36EA62EB65D3F7C41B3BB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195068, "uuid": "afc3daca-e201-481b-92fe-96c1e37dadfb", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195068, "uuid": "5212fa12-64af-411c-8d7f-0862b90e1952", "value": "49152:j8Ev+5rb/TcvO90d7HjmAFd4A64nsfJy7T6I//ZEMVI3YkMFQy48HQN+mr7BsiAB:kIHuMVI3YWd17bVjcErDOrQh6e7f1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195068, "uuid": "243bb7f2-49f0-4da4-9e8b-68f2d46283e6", "value": 4186752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195068, "uuid": "fb737aeb-4731-494e-9ae9-5d80a345d471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195068, "uuid": "9d1544a9-a474-4085-85db-a3ab6806a02a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee1fe8e-01d3-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770214142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214142, "uuid": "07bbde30-e5e2-49aa-aaf3-7488f5eddcc7", "comment": "Malware payload (Vidar)", "value": "44294874685b6217980f76f5d5f50ebf", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214142, "uuid": "d421b786-eb69-4a26-8225-9bd107a94329", "comment": "Malware payload (Vidar)", "value": "9ce26c4dc94e741c6cf1059e2f4e0adf44a5d504079f739f90251d8c9461edbe", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214142, "uuid": "20b302df-22d4-4a72-813f-a98e8692365c", "comment": "Malware payload (Vidar)", "value": "040df30ea3adfb673e2347908b921fe9bb219147", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214142, "uuid": "d13987be-a000-43c8-840c-9db08bd524ab", "comment": "Malware payload (Vidar)", "value": "23a3419d49eb650dcad8dd4f61b5f8bd98e7cca94ae2196abf40e08f28065b9c0c4b1b1cc2f9f893abf10269dba9d47b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214142, "uuid": "73000581-383e-4e64-b588-410d6fe329b2", "value": "T1AE364B6B72A0D1A9C15EC63EC0A3CF00E5F371791B33C6E7529103689E969C99F7E660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214142, "uuid": "63779272-ae58-4ad2-a148-04433d568c6e", "value": "71f78f4628cb6313a1d0643cb0123fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214142, "uuid": "5df3ea61-24eb-4ea2-93a6-c0221d44238d", "value": "49152:/bDzejgtRPTasHYMJ8DUAGxxYvSikQSVnRYOBS1nTE/4ABZ1agT0hzE6fx:2QPLNAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770214142, "uuid": "decc8af6-8c9b-42a2-847c-d7debec8070d", "value": 5019136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770214142, "uuid": "451ad651-4897-47cb-ad94-7efaabafecce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214142, "uuid": "d5e9f01c-a57c-43b7-bd47-ce46e69746cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68430abb-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1770191099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191099, "uuid": "72c98728-a63b-46bb-8739-ade14c97bf53", "comment": "Malware payload (Adware.Techsnab)", "value": "87838fd2006e3b2dce09e04aaaa3b185", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191099, "uuid": "c1866a3a-4f76-42de-823c-c32c2ae0f113", "comment": "Malware payload (Adware.Techsnab)", "value": "9d69097f5a6e739744e99c3673e729cc77f7bb884eb78b5bbc9e22344510bf06", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191099, "uuid": "cde7d6a1-ad93-4545-b470-a4490120f7fd", "comment": "Malware payload (Adware.Techsnab)", "value": "022f9e5963c311f56aff9198be654389528e0f65", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191099, "uuid": "762ed330-2aa1-45c0-9b6a-eee986edd06e", "comment": "Malware payload (Adware.Techsnab)", "value": "babbb9002ff80a75b0951185dafe23c0991862bbae14aad0049bb189a1e0d452e43e842cfaca822e22a755dd2a1085cd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191099, "uuid": "6738a3f8-f804-4ef6-abdf-47211654850a", "value": "T10D363931B645C072D19B1B3E1EA6F3AA943B7911AF93C3C335804B5E09316E9BD39297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191099, "uuid": "67c7af41-731e-4af8-82bf-d7e859aeb291", "value": "b0857b7f29b53f204b1e02bbf09cdedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191099, "uuid": "e0ddb103-d330-4391-a989-3ae8c31ded50", "value": "49152:2uFXw82QxmV8Gza4DS3fMChhi3uJaPgd1ZoYwBP56A36NkBg1Zys0UkOkS6mSXCu:2uFXg8GzaKoXhhiA975ZyhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770191099, "uuid": "e850e38c-97b8-4f0d-9561-802fb5bb8485", "value": 5147784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770191099, "uuid": "00cdded5-6116-4d6c-b0c4-8ab6ad4c0627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191099, "uuid": "fd6472d9-06e4-48a8-a114-be7b2b2dab3d", "value": "022f9e5963c311f56aff9198be654389528e0f65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc05333-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163912, "uuid": "d1722037-bba7-45fd-b1ee-e3ebae5a9b33", "comment": "Malware payload (Mirai)", "value": "702533fab587ed53686a0ff4ce8e6497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163912, "uuid": "ed4ec714-9f2a-4b43-974e-47067e3fdd8a", "comment": "Malware payload (Mirai)", "value": "9df4a603a83c9fc399d22132f8ce9eef2abaef135e6207aeb761f8bf6dd264d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163912, "uuid": "9a4c8f20-2b16-43ba-8a3c-20edb8498623", "comment": "Malware payload (Mirai)", "value": "1980448325e1b0e674b51cd2c36d17e63ddfe89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163912, "uuid": "e2fc6f50-aeb9-457c-a9bc-86e9cfc321ed", "comment": "Malware payload (Mirai)", "value": "fb56d792bf6e521e05ab10cb8eb507a02634f9721e6ab53e416616cfeaa5564bc171f3decbb644045d703315db2cf8e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163912, "uuid": "3fdefe18-e373-49dd-a3bf-7f97224fc86e", "value": "T18D6318DA7CC5C602C5F061B2BB1E51CE375643B8E3E2B153CD19AB29670F8A70A37252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163912, "uuid": "d4eae0fe-2ddc-407a-a283-653ebe13532d", "value": "768:EZmB7Q97T7dfPaosDB74PhCLru6Zxn1s0nRDDbHdyvB2V+VXRBsbHdxTRWIhZZAD:J7TzyIh/Y01FzTVKXY4lDDYV6llXHvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163912, "uuid": "8015ac06-6837-4a95-a3df-a5d3e3fcbda4", "value": 71080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163912, "uuid": "f919916e-d612-4c67-bcb2-a360363b4ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163912, "uuid": "204d797e-ae88-4e99-8897-f5aa560027cc", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2efde88-01ee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770225987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225987, "uuid": "390cf317-895a-41f4-818f-c289187b08b5", "comment": "Malware payload", "value": "9a481cce3e9d4349e2386cce029c0fbd", "object_relation": "md5", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225987, "uuid": "e832db5a-46dd-46aa-9f2c-d96830a79692", "comment": "Malware payload", "value": "9e5c82720487df7a1593e1b9cc209cd8f38875354cc67b6b39923ae742f14143", "object_relation": "sha256", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225987, "uuid": "b46baef0-68d0-4c66-9075-37d422fa5d99", "comment": "Malware payload", "value": "a2eabbc7991629603be5cf93f73541d73a652a1a", "object_relation": "sha1", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225987, "uuid": "723e84e4-245f-4e53-94cd-229c81700a5c", "comment": "Malware payload", "value": "7c7c58e999febaab6ce4aef1e82ab86081ed896767abe828059a31a7fee39b646c7e5ba42cfc895903241d25da620213", "object_relation": "sha3-384", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225987, "uuid": "d197ee21-1f39-4d13-b126-60b102b751c6", "value": "T184D54B103FE6A685F5B6BC371BAEB7B48B77E2762F0AE35B2140525F6915A0CCB140D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225987, "uuid": "3d22d1b2-6f98-4fcb-980c-82edebd5e7bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225987, "uuid": "a26d5215-c914-4dd5-aef0-11b393d5ed85", "value": "49152:t8ubhOcsM6jiSP7TLjpZNXpCeJTu8o5QWfBOm:pbAcvhmPznWpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770225987, "uuid": "94a39c5b-ec32-48ba-927a-8235eacfc009", "value": 2797088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770225987, "uuid": "7699f01b-b81c-434f-91cc-b241c7e2498a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225987, "uuid": "8a36f604-f77e-44b4-ab4a-334c74c2e0af", "value": "9e5c82720487df7a1593e1b9cc209cd8f38875354cc67b6b39923ae742f14143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2410c2ca-01d8-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770216325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216325, "uuid": "09247215-dd4b-4b2f-832d-e2951867795f", "comment": "Malware payload (SalatStealer)", "value": "d414aad7827ba6e11d6a411b0f2a0c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216325, "uuid": "eefe263c-6e0f-4909-acbd-9d7450340c88", "comment": "Malware payload (SalatStealer)", "value": "9ecee046d64a795040771aa4c5733822cf839b3f7b561df61868ecf402014f10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216325, "uuid": "9633cf04-8d27-44e1-b7c5-5d25f3bc2a48", "comment": "Malware payload (SalatStealer)", "value": "3a6b284e5bc3ddc5886913b44ecfa73581fff5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216325, "uuid": "8720781e-bf85-4b88-a9df-69cc3832ca6c", "comment": "Malware payload (SalatStealer)", "value": "cb6dd07672ab0075f719071f8f2a3bcc52557a2307c6eb97db77190e87bfa2dcde82a7d72599e4bee55b5e08f4635b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216325, "uuid": "5b9d76f6-cd7d-49f3-aa72-d7acce5dc47d", "value": "T16124181BB3960CF9E56B8236CAC7E7729976FC195330F60F1A59D3023E199608B1E394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216325, "uuid": "db1d337a-584f-4267-a471-a5b9cc649f3d", "value": "daf58bc7ca8a9d416ab35243b0a3ed78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216325, "uuid": "e0064e31-9ec7-4801-841b-38c5955efb81", "value": "3072:89ljBQpewZaJPpAONNfveXDrgWtx+oQmOWALe194MbSf3fj0U0ubPPmfJJDs:GjBovIPvNXkDrbkm8LJMbS3j0U0fJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770216325, "uuid": "2a58288e-1151-4dda-8aeb-773770de6ad5", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770216325, "uuid": "c110e979-0b0e-42a4-9a50-5e75e65f4c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216325, "uuid": "871f0cc2-f5f7-42fd-8377-dcea17792a3a", "value": "Setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cfcd8e-01bd-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770205072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205072, "uuid": "dfbf493c-211d-4fe9-b6ae-19688773de13", "comment": "Malware payload (Vidar)", "value": "3ce126ecc6dbbac7d8f7a361548c6d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205072, "uuid": "e02e0dfc-460e-4dff-849d-692cefc422f5", "comment": "Malware payload (Vidar)", "value": "9ee477d4bb72c410d83d7d8fa755c5eab5b0988736ba3bb68524c4dbb5427f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205072, "uuid": "66cda17b-5282-47ec-b79d-f5df8b72a05f", "comment": "Malware payload (Vidar)", "value": "8c628a83433fc8e8e90d2aa5bfd9fe3c74c8f0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205072, "uuid": "59025615-7d4c-421e-a7cb-10e51fbc18ea", "comment": "Malware payload (Vidar)", "value": "5f181a411196f83a730de3db1fad9285d262d296c8de856d6e2931ba6e922d7b8bdeaa4ce5bf2005099a7b6fc9d3c139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205072, "uuid": "14c5653a-4946-48b0-a3b6-e25617f7211f", "value": "T161A619926E40871DD91BA23FE8E112C6A371BC445B7232D77A44326E5C7B6C4163BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205072, "uuid": "0e9b5da6-0622-4641-abcc-f7e375ef48e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205072, "uuid": "a369f509-f67e-4c95-8dd7-c383666ab0f4", "value": "49152:9kD1mi65lG9ijWIc+3+2Ee6VEamSxuK8N4evf17K2168mnKlEiOqq8/nZ1fUFlhi:9wZijMwL/S1sQkW2cnyaVPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205072, "uuid": "28f807e4-27e8-4e17-913a-8d3dee48d602", "value": 9731248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205072, "uuid": "c434d8bb-315f-469f-98a4-5a0ae6449a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205072, "uuid": "8c2a904c-fb72-4c75-b1f0-ecf365760f24", "value": "BuildRootkit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f8d012-0187-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770181484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181484, "uuid": "8aedf3f1-f3ff-4948-9cd7-a641e244d5a1", "comment": "Malware payload (Vidar)", "value": "aa48beae833842e60d63824faa269a90", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181484, "uuid": "3a59ee3d-a067-401c-9a19-459b5d580240", "comment": "Malware payload (Vidar)", "value": "9f37ace88273568e692b6fba41a0b908ce3983df54d77288b4fac28707069fa1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181484, "uuid": "2cd51f1d-eaf0-4a7e-936e-56ce165e771b", "comment": "Malware payload (Vidar)", "value": "6a7d2c43dcd4a300affc376134a812b4c92132f7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181484, "uuid": "a79bae3d-9ddf-4e61-a11c-132ec732d6bc", "comment": "Malware payload (Vidar)", "value": "b5ce9c69bfde53d9108a8f7491eda3e2e2e980b5d79dcbbca5167b1e9aeddb88aa4358806c1c2caa2f96923df0e2906e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181484, "uuid": "e4a9656c-2d98-4ebe-8b48-197faa620331", "value": "T10896297F7299D2A8C25D853EC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181484, "uuid": "e00ab1a4-e5f8-4304-a94a-5c1e337ea611", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181484, "uuid": "32f92ef4-f288-482f-9ca0-ae8af6dbbb59", "value": "49152:zNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgiQ49dpsMXVVlWEJP:zz7Vp7eQ49d37lWEJsO7wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181484, "uuid": "d19b9747-830f-4819-ab68-ae7c129cd577", "value": 8753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181484, "uuid": "e3e52e7d-5319-4fa6-a0d6-6ee27a89a603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181484, "uuid": "622e0a95-6c9b-4316-8462-3e4422896685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24612fdf-01c8-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770209454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209454, "uuid": "b35d3231-78c4-4048-95eb-b7bd6dbf1c45", "comment": "Malware payload (GuLoader)", "value": "ed69a12592a9d8145d33a560678fed15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209454, "uuid": "d9b8a77c-e44e-43b1-83e0-51843c682021", "comment": "Malware payload (GuLoader)", "value": "9f4c77ecb24e86f2ac41e31e87b17fbe329e31750b1cb2fb7d514975d194d693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209454, "uuid": "cfe0c09c-48fa-42cd-916e-bd749d8f583b", "comment": "Malware payload (GuLoader)", "value": "39589b4ac082393d0c15c2ba9b9c39553c817d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770209454, "uuid": "ea7015aa-b6b7-4646-b59b-b85a8f872cbe", "comment": "Malware payload (GuLoader)", "value": "6d367357e224538bdc16d17694d873108a1af0fbb8fb0314419434e6db15878fb566ae8ff40241bd64230478f6ad7818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209454, "uuid": "505d7777-922c-4165-a1d4-7472729e3259", "value": "T15994F1113386D547DEED02B144AF86EE0E72AF7BA9858B47F380F62E7DB26C57918110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209454, "uuid": "d3a91342-9507-4577-abda-76a2868b46d6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209454, "uuid": "02b8fcdc-f9fa-4612-8357-a9ac9f5adb82", "value": "12288:UecGGRUO0k8jY/7RSd9zIo7SFe6hOFxrs:Ue1GRUnjYId9pnxFxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770209454, "uuid": "fa7ec5a6-b1b1-4670-b36e-95cb2188c4b8", "value": 433056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770209454, "uuid": "d9a94fbc-5d49-4f2d-b314-ba55b7a3ee32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770209454, "uuid": "7856ab23-7cc0-4968-adf9-e6e43e49c713", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.47125.6004.30364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fe12d3-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236614, "uuid": "659332c6-863f-477b-a082-4136328d9476", "comment": "Malware payload (Mirai)", "value": "7f98b236884b337e91147ea1457487fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236614, "uuid": "45feb9b6-fcef-4b6c-88cd-f644a10d0c33", "comment": "Malware payload (Mirai)", "value": "9fb4d12628f3c416e0cee61b1718a1f9e92700b362175a1c83873c623d49f72e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236614, "uuid": "40d702dc-6f08-484b-9e38-8dd729e163f8", "comment": "Malware payload (Mirai)", "value": "fec3a3cb9543f67c0d9bb87abceff09a81b5489e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236614, "uuid": "3ed9189f-93d1-40f0-b026-7162c6a82410", "comment": "Malware payload (Mirai)", "value": "02938b3c60d8d65fae592898f07d745edc65b9c3ee823a07c3792a2d7d9cfe4346544be23d270fb8a6190350219d888a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236614, "uuid": "30d9c2de-2fe7-44ad-9359-fa1841d426f0", "value": "T15B835A23EA179F46D14365F0A1F28E754F22FC198D2B2EF664A1EDE48143EE8B5053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236614, "uuid": "d3a718b0-7721-45b0-b24d-f098d7f704e5", "value": "1536:Ybwt5UJeF9LdR03VijsGJTEiSxWEDHKrXBV7WAE/98C1cnn5fN:YbBerLdRAhUmqrbvE/98Tn51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236614, "uuid": "de8a2b74-0283-4445-a923-ed2a98a000f3", "value": 83432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236614, "uuid": "608dfaff-9d11-415b-beee-1040ab7d9a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236614, "uuid": "c206760e-7f73-42e1-b0e1-b626dca58365", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4cb3bd-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168341, "uuid": "27a67cf3-1da1-4555-a130-46e3abc1739e", "comment": "Malware payload (Mirai)", "value": "de7af48d0a5654ea3318f8f907f14843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168341, "uuid": "4f112902-5e93-4521-b47d-90aeed83e692", "comment": "Malware payload (Mirai)", "value": "a1207413cce9ea28702c0cff9bb35c23f217a03c412e6f4672b3f5acd37c8d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168341, "uuid": "877f67b4-4efe-439d-853d-7de1d38514e1", "comment": "Malware payload (Mirai)", "value": "910d27935dd56cf9c1afb6a5c139bed22d3c6ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168341, "uuid": "6d683378-29cb-4134-88a6-bfa2252168ed", "comment": "Malware payload (Mirai)", "value": "7fee712e4c2b77233345c3773270f744dabfc0c4acdf88a6cdd478528ae411d918ddff288e8a4aa8cd6e65051e48210f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168341, "uuid": "2d58ceef-aa4a-4783-8bec-de1d9013e50d", "value": "T1C343F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168341, "uuid": "f3da46fe-512d-49ee-83b3-d630e647d713", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168341, "uuid": "8148d78b-d00b-4f89-809e-420976267ee7", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168341, "uuid": "2308141c-dd68-417d-bfb7-25b2da856747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168341, "uuid": "a8d61892-3f0a-4f55-9cbe-a72a57a42ba2", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa821f8c-01a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192633, "uuid": "8d3237d7-c625-474b-b9aa-034f6b211028", "comment": "Malware payload (Mirai)", "value": "0663ea084490c2a5b5f8abfafefeb2a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192633, "uuid": "61db9eff-d8fb-4413-b766-dc3c9635514b", "comment": "Malware payload (Mirai)", "value": "a1a959b80cc8d75a4631444492b52d70b9ce035d6cbee1c28a685580585b5805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192633, "uuid": "3a739346-b245-48e1-af8a-67c0db74b17a", "comment": "Malware payload (Mirai)", "value": "07382698753785b662ff470df9303b312965f7a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192633, "uuid": "153bc7e5-1cff-4eaf-ad89-a925c48aebf2", "comment": "Malware payload (Mirai)", "value": "4a90f6416310de91ed486a05ba40e727831721d0aacb1b933e64df08b1ce18330c655661a6c4d2cd948624749f5aa96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192633, "uuid": "9d89a275-5954-417a-9bbe-91196fb9673c", "value": "T125B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192633, "uuid": "9f656d34-ffe0-4c0b-861c-2fd8b3b547eb", "value": "1536:D7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxn:PzPqF41OUBljSIxecUtCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192633, "uuid": "1074026e-58fc-4e7d-b8fc-e36d15657c5d", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192633, "uuid": "9b51bf4f-332e-4b52-a920-526f338f57f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192633, "uuid": "ca2973e0-437e-411c-9d68-87ad6b99da91", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c577d10-01a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770195240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195240, "uuid": "802a4ac4-c73a-4d75-b3b5-4e0ff6431cb8", "comment": "Malware payload", "value": "1d2b87324c65ca9dc6a6ff77836f4358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195240, "uuid": "3fdbe828-5d3f-414a-ab43-8ebce44eb76d", "comment": "Malware payload", "value": "a24ccc3c520e0cbbee0ab7a492fe0e0355f4602a25448ffe79decfb4d4665453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195240, "uuid": "c5dcaea9-163f-4247-ac3c-8cce1c781877", "comment": "Malware payload", "value": "33f837ca76f5e1ecb66252def6192e6088c8b5c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195240, "uuid": "d63b859f-6750-406f-8ecb-14cd555ac7c9", "comment": "Malware payload", "value": "fcfe5d3812222c6ed417c15dc9c04a8f1eaaca2da19c7d0bb3184d4f36df1975c4ab306f2c8f88d3964d5091782bf897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195240, "uuid": "a5ee93b9-8cd9-4c81-bef7-c1807665f6a2", "value": "T10285CF0973E441EDFEABE1768A13C50BC7B178450777862F0660AA766F337716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195240, "uuid": "15573295-1a0f-472a-b099-cc4f570c8861", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195240, "uuid": "8cdb4601-3e50-4a85-aa04-d5ba5de988b7", "value": "49152:N1H4jR2TYrQbDTrcAy2d/ecOghr/QwEsAJ4:QU/yk2WhbQwEsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195240, "uuid": "e3de8bbd-3ab2-433d-b498-c3507de77718", "value": 1775616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195240, "uuid": "0a6b16b7-16a2-4c02-9965-630c7992d6c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195240, "uuid": "05ff9b13-6670-4963-b742-638223a15606", "value": "xa24ccc3c520e0cbbee0ab7a492fe0e0355f4602a25448ffe79decfb4d4665453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a992a233-0179-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770175747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175747, "uuid": "dcac98f3-f883-4cf7-81dd-209930462c3c", "comment": "Malware payload (ValleyRAT)", "value": "62e89a2a45a9d63d602568425e404dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175747, "uuid": "5c0d1a50-ca26-48f4-a96e-e8f386667a73", "comment": "Malware payload (ValleyRAT)", "value": "a2c59ea0b830d2d773c08a66df43506972b780ed7bd26f80308763247be64e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175747, "uuid": "f06c0230-e4cb-4ee5-86b2-a76fc60d9e82", "comment": "Malware payload (ValleyRAT)", "value": "1d98161fc61b3fd569ea7e7e6a9a9aa2aca8696b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175747, "uuid": "5ec9d2c4-2039-4c19-86cd-2cbab26e9064", "comment": "Malware payload (ValleyRAT)", "value": "59e4ec6ced152f74342b7420a06a8e7e19693f1097d1b012682224ec77925632c0d0b40955067f3a3b0eec46a0464a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175747, "uuid": "8533cbae-935a-48dd-b5cd-dd60dd73a89b", "value": "T1F4458E16BBAC00F9E1E7923CC962C616E27ABC465361E7DF02941A5B2F339D14E7D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175747, "uuid": "c8a0b124-4eeb-4fec-b12b-e6e7ed86bb78", "value": "fc1511793129e48f3058bf759a59eb3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175747, "uuid": "762aa74b-d740-46e7-b76b-7eb2e879e3b5", "value": "12288:qH+Ec/7YYrbfCohS1M05yODD8EHETSXAVzZiB1HbDUHlhC00izdCZNaKhqT+:/YWVkBdEfYvDGlmNaKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770175747, "uuid": "feb99ad2-1991-4b0c-851d-3697be2610a4", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770175747, "uuid": "e7789fd7-03a2-4455-b31e-61f0ca3ffaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175747, "uuid": "6ac09c67-7a26-457e-9c89-305846177b93", "value": "64\u4f4d\u5b89\u88c5\u5305_\u7279\u5225\u7248_231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97955272-01ad-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770198050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198050, "uuid": "99b36ec4-22a1-4582-9bbe-8c559bf959d4", "comment": "Malware payload (XWorm)", "value": "e64bdffdf590ff465e553612fa59e557", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198050, "uuid": "41a0d0f9-1a74-4b6f-99a9-4c04e586e8a0", "comment": "Malware payload (XWorm)", "value": "a3446a5b9a23636ce98cf0feaf468777fa5956098d2d072989883885027bb140", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198050, "uuid": "b2e864d1-139b-4b4e-b72b-a4ea555f1428", "comment": "Malware payload (XWorm)", "value": "f25484a0bde76581e4005feec7a18754132fd290", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198050, "uuid": "7a4246ff-632b-4462-b876-bb27f3787f35", "comment": "Malware payload (XWorm)", "value": "1229da3da519b30e8b1c24c828900ca7308e99c0cd2e11a7c9f8e59cd9f5f537ae8c906460c6104550afd66fdfcf74d2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198050, "uuid": "a9f9eefa-2190-4031-b846-6762b8ffcb57", "value": "T147D502BB98B2A5536B604663EB0F2C1E339B19D53B14D342E901959C6F3B1D38F92723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198050, "uuid": "524afb1e-d494-4514-96ee-0a17842653c3", "value": "49152:VOc2yD4lTP0EzKaJ+zU6fZJ5GPKAXxTqm23E0iA+2+eo9uYIn/gNlx:VoyEFP/zz+zU6/qNeoon/g3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198050, "uuid": "ea68bcff-9cc4-4024-855d-42176ec53035", "value": 2966288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198050, "uuid": "7aaa11a5-b256-4ecb-bcf1-e8f0640801e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198050, "uuid": "6f0ae912-fb05-4fbc-9855-cd8233da2cc0", "value": "Pro-Forma Invoice.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d36fdf-0169-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770168862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168862, "uuid": "9218dd0b-cde3-42a9-954d-84b7c9ef9b94", "comment": "Malware payload (Formbook)", "value": "ba83262e0bb15d63aa45272ccb391573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168862, "uuid": "018904ed-9e7a-4c79-9759-75a48ab6c877", "comment": "Malware payload (Formbook)", "value": "a423b39b35918c0bf0833e34d224576f818fb6647f60f98050547b850029bac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168862, "uuid": "dba96177-25e3-4e31-84c2-3b8208b674a4", "comment": "Malware payload (Formbook)", "value": "6dceb297f6b5fe5a29823f46431525128fbe767f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168862, "uuid": "8f2c40cb-9f05-4f13-8a11-389e0cb51b64", "comment": "Malware payload (Formbook)", "value": "b51f6044c31c634bae3b7dd9a18944a55bbfbde1080cec7d86caa5417565754e50db770f1a1dd902863d8cc72eb35673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168862, "uuid": "44fe617a-1da9-4ea2-8a3d-608e2834d536", "value": "T16E45BF0273D1C062FFAB92334B5AF6115BBC79260127E61F13981DB9BA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168862, "uuid": "7bb5f8f7-e156-480d-9b68-90e3db1151f2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168862, "uuid": "cfe10f4c-1cf1-4f05-afa4-42da1a3539b4", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdaPwGuSe2yEIWhI1:APVt/LZeJbInQRaPwG3hIWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168862, "uuid": "b3e782bb-e575-4a76-862a-a84812cc01bd", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168862, "uuid": "4d3470a3-64a0-4406-8efc-6cab24446ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168862, "uuid": "0b725049-c8cf-4fff-bb17-2dfd4b8a60b8", "value": "Commercail Invoice And Dhl Awb Tracking Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692b1aa3-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770203127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203127, "uuid": "0e33d9d0-45c3-49e1-b407-0cf2d124258a", "comment": "Malware payload (DCRat)", "value": "78614392800910c88b3d2546b606a390", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203127, "uuid": "98b88c19-c0d0-42f4-870c-e5a88b7c0fce", "comment": "Malware payload (DCRat)", "value": "a4b88c6971c99b7365faa8b13bb16b117abdb8c4faa73f4c28ee691b015ef07a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203127, "uuid": "1eb2d16e-1473-42a2-a555-fe42095d17cd", "comment": "Malware payload (DCRat)", "value": "4b91c7491996699704fb6db618206c06a5772ca9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203127, "uuid": "bea42eb6-93fa-48a6-93c8-6a9563fe24d8", "comment": "Malware payload (DCRat)", "value": "c75c8754846a4c2d53fbd82d5271e0acee976ac988eead9ce84efcbf1429bd7a6d7046814edb6a927e29899f9a054113", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203127, "uuid": "58b35490-52c8-42b2-8a5f-3d221901111c", "value": "T1C4455A017E44DA91F0195673C1EF42044BB4AD512AA7E71FBEAA337E55223933C0EADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203127, "uuid": "7da92fda-886f-4c10-a8ca-0247a51ff8b6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203127, "uuid": "7c531c8b-a3e5-466a-a312-c88a93cd009e", "value": "24576:U2G/nvxW3Ww0tGwPiyeRnPpALJiMEsulCR+CU:UbA30GwPiRPpAMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203127, "uuid": "973287da-a207-4d57-94a7-25b3267d46aa", "value": 1164467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203127, "uuid": "2a298219-447c-4e11-a8e2-0528d299f5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203127, "uuid": "90fdac5b-752a-4624-bd7b-25705907d189", "value": "cutforme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543f5173-01d4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770214688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214688, "uuid": "16ccee21-939f-4353-b9fb-d1ef7478482c", "comment": "Malware payload", "value": "ecc2079798dc5e909a8b5a0a2520982b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214688, "uuid": "346ff805-8427-493e-8efb-632419660278", "comment": "Malware payload", "value": "a6703cc2ed950426b77302cf6b787f06163e66c25215da1cdfe37769a23057a1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214688, "uuid": "7844cb74-eb7b-4713-afe4-1131bf871b9b", "comment": "Malware payload", "value": "5b3d4fae9af6654ba8a296b37554a236695d7755", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770214688, "uuid": "031bf5e7-8f25-4cd9-aa5c-bc014fb52415", "comment": "Malware payload", "value": "5be4491029080ea59dbc144f17ed2b7a95626f17dec259a3088d009d942e08caea10c79da2da12760791ae0009f905eb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214688, "uuid": "fd79ae8d-95f5-4022-bdf3-8241702410dd", "value": "T199941296D1329495FFA36BF37B818252B77900025AC1BB6098457E8C14D2EC5E3FE63B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214688, "uuid": "f14f7e23-90d9-4c4f-8d30-fc9071310c56", "value": "192:DHhzMjsTMRspMrYxYTaGcVHVdQNcGdv2b0msgIjeot/oruYen2L7SklLE//j:q4SjOSGsNeoMnlw/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770214688, "uuid": "87443a9b-2e19-433d-9304-fbc061d95b92", "value": 436948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770214688, "uuid": "9c5ab65c-9c47-4ef6-9a73-9eb47e79f915", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770214688, "uuid": "1978a005-da2c-4e4d-a64f-afb58798737d", "value": "e-dekont.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fbf943-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168337, "uuid": "c62609e4-f708-4061-9c15-f34199b6d2ae", "comment": "Malware payload (Mirai)", "value": "8327bb5d840e5737ff9b4c0727a70482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168337, "uuid": "16b2b22d-1875-414f-bb39-06ae1f8c3f79", "comment": "Malware payload (Mirai)", "value": "a8f8cae5d3e5f8f5826212c463dc7a015b1484a3b1ae783660791f80b0df278a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168337, "uuid": "a8681f05-5c0d-4d18-931f-92b18b62da55", "comment": "Malware payload (Mirai)", "value": "a145636317c11480050c8e0183ce601b68523449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168337, "uuid": "9f570775-a8ba-45c8-b4b9-42efc4dbb04e", "comment": "Malware payload (Mirai)", "value": "51f62820d95d172bc9f72c5a69920e3c32deb6c7a8382c07cb0582ce0bdbd9a08094eea3ad8032251d320fb6e0aa6487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168337, "uuid": "c2072ad5-bc84-493f-9c15-eb0074f148ad", "value": "T180535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185A94FD74A4235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168337, "uuid": "82a85c51-7474-4319-ab68-2cb1a95abf3b", "value": "1536:fp3/tcoPzVx57hown8n4SVsgEZJB4kv9IZV:ptcEVD1own21VXSJB39IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168337, "uuid": "29abe9e1-a095-412a-81b7-4070a07e942a", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168337, "uuid": "176601b7-85c1-49f9-853c-3eb1c856b6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168337, "uuid": "81abc398-92c9-46a3-bc18-598a5aa869f7", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6936636a-0160-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164901, "uuid": "c3f45493-7cdf-4fee-bb40-2283ba142d33", "comment": "Malware payload (Mirai)", "value": "11bbaccab6b01e0d84ed2b124256f9b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164901, "uuid": "ab6f20c0-75d1-4e5c-96a4-d8a1a3cdaf9d", "comment": "Malware payload (Mirai)", "value": "a91c792a020fe26773500dd33cc0a43d803268497c235f2ca0f314b6f4a30253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164901, "uuid": "ae1d1a7f-c04e-4644-9364-85096cc8d0cd", "comment": "Malware payload (Mirai)", "value": "ab5a1649e13e18f7d91562d97d0461bc8eb7604f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164901, "uuid": "4f29f6f9-a721-4531-82d0-0131251dc8e3", "comment": "Malware payload (Mirai)", "value": "37983c0db55d91b163d0faa819463e6b9e854dd9d29ebc01a980b170057921cd2a9250f08ee11b928915a7e0dfd773e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164901, "uuid": "2843a838-97e0-4f0c-8eed-d69f1727ffaa", "value": "T1F1E37D80B783D9F6E80506712177AF72BA72E87A243ADB91D3A8AD33DC51542C5073BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164901, "uuid": "63bf95d8-f9a2-4b81-89f1-2ea5d0600474", "value": "3072:lTqTFtXGzUUHs4zA0oRPI5TUGK9nrI/dr05wZpwbZny:lT6fXGzFnE0wQaxJc45CpwRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164901, "uuid": "64647d5f-a928-4d37-b171-e798c4fc5f3a", "value": 152488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164901, "uuid": "a7b08a86-e644-402f-b6eb-00307419fd00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164901, "uuid": "67573386-d38b-4d43-975a-189d502c0bee", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44dc1bf-01dc-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770218392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218392, "uuid": "afcb18ea-f02d-42bd-8431-7045e79ae9df", "comment": "Malware payload (SantaStealer)", "value": "b3f9e623d46d8c192139c9fc64a85c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218392, "uuid": "79335f58-9071-43bb-bd6a-d7f6cefdf329", "comment": "Malware payload (SantaStealer)", "value": "a9a3cf0bfd7feb8c309fbb8e447b87301aa49527f36561caa6c5e328c77f6f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218392, "uuid": "ba3c725f-66bb-4ab1-8d97-cef9f6b73113", "comment": "Malware payload (SantaStealer)", "value": "955855dbcc1cc178c3cf0ac084de50948336859e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218392, "uuid": "bbaba12c-a9e3-40dc-a442-020de9e1e784", "comment": "Malware payload (SantaStealer)", "value": "67f2434a3e0e79af6a23efbf415cdba798311eb28ca4a5efebc1e7b87382bca763ce1a941146dde8a782780d4d205c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218392, "uuid": "6fe821e9-5bf0-4817-ada0-9b6210601bdb", "value": "T1B8A6BFDAD16E44D2DC053FF9A8141AC78B2447328A7400283A6FBD499F775FE805EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218392, "uuid": "4268739b-6668-400c-a08e-24d11441bd74", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218392, "uuid": "c3ff7482-1e7f-4504-abbb-907672476860", "value": "24576:Vo8xwcRppqOxpj0YsmlTthPfsJrDHpCJUBQprD6vPEAX3X9kHs02F7igySoNUh4G:Vo8xwYvm3nl6IhZ2WcmtVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218392, "uuid": "15462a70-5192-4f0e-b8fb-57acd9206236", "value": 9903548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218392, "uuid": "dfac23ef-3999-4bb7-890b-bc34fee1324f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218392, "uuid": "3df99816-042f-49eb-b44e-4c20013d2412", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0274486f-01e3-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770220993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220993, "uuid": "6fd85a32-d6e0-4dcf-b5b5-1a4c77a2edbf", "comment": "Malware payload (SalatStealer)", "value": "0580178cb7c81b6071446d94db00969f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220993, "uuid": "ecdd228a-ac13-44ae-839d-df6d97250068", "comment": "Malware payload (SalatStealer)", "value": "a9a7a850015e67c65456dc004ab3fd1910e2c65d005708eb5a0786adafa851b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220993, "uuid": "c46250dd-0822-43ab-8559-44bde71b07f3", "comment": "Malware payload (SalatStealer)", "value": "5d8d933ef920ede5c8a957e97c66963d8e7aaa23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770220993, "uuid": "c79bc976-f043-4cc7-8549-c0053e7d80f7", "comment": "Malware payload (SalatStealer)", "value": "aabeaa47475941a0db23479ddf09cfc14f73ad36de0d3e4b45a315df23d298840723dae1a9767ee1b6341c7afd4dde35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220993, "uuid": "7a9eddd3-e71b-4b29-b602-fc786593662a", "value": "T1F0C7339435B62CE1E42F54BB40A31A80833CBC778FA95323EB660B5EBB5778036B455D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220993, "uuid": "1e391b75-c710-4544-aa80-277f67a85503", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220993, "uuid": "ca1cd2b9-6327-43ec-8917-b746ecb82e75", "value": "1572864:Wr5dWeLfDzVXDfHgVeNvMYy+/rR7lVgD8YUjAk5yv+UEj42yNgGUMG1:Wr2K5XTgUB5brRmdTvSXvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770220993, "uuid": "d7b2d787-49ea-4c3c-ade6-40b91a291f58", "value": 57792700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770220993, "uuid": "57307c2c-2106-489b-9d09-83f396971f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770220993, "uuid": "ff28496a-6a83-4476-a7e2-4ceca463b265", "value": "ApexLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accc9712-019b-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770190355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190355, "uuid": "a5869073-0a4c-4c0e-b3da-ffdffe01e926", "comment": "Malware payload (PhantomStealer)", "value": "ba650e75ca3c98bf5cde03476204cd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190355, "uuid": "d33562b3-ae65-442e-8bd9-5d680ef97fc0", "comment": "Malware payload (PhantomStealer)", "value": "aa44a570abbebe8ef664a2ddd4466fd075bf595572e4c2c37f089182e79f364f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190355, "uuid": "6597a7c8-5ba0-4ebd-a27d-b5822371b0de", "comment": "Malware payload (PhantomStealer)", "value": "0115f14e9874da7aa58119bcbba48a2db826bcda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190355, "uuid": "f0d5685a-ffcf-49af-9f7d-aed3b62bab49", "comment": "Malware payload (PhantomStealer)", "value": "51c6c7da1abcfcd89a43e85437eb68075c3f4fa4a67f822e922f81f1cd72362cade634e2d55acb3a050e8498142fa3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190355, "uuid": "40bcc9cb-88fd-452f-a77d-83548c9b94ae", "value": "T1E165131DB775AEA1C20C273BC80B607D41E6C827D262FA552ACD7DE12F29B48C58FD46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190355, "uuid": "0014f5b4-c609-44c3-9505-0bea695cf9e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190355, "uuid": "a33f2e38-2a96-47e2-ab88-0e736e234db4", "value": "24576:A81GhgAoxvlybCWPSSVp9V8ND1f0oZPMl/TXt/Eio9eOIwtQ7tRKCoyHlfuv8ML0:GhJoxvcNqM9V8PJZET5Ef9JIwtQ54CoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190355, "uuid": "ceb54d69-6bf9-4db7-a84f-cd4377e2a2d9", "value": 1547776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190355, "uuid": "85b99a97-ac26-4aa6-9482-a9d1e21f63d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190355, "uuid": "23b5bc99-31dd-40cf-ac62-df6968e6a969", "value": "SecuriteInfo.com.Win32.MalwareX-gen.86229973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d14fc-0206-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236374, "uuid": "c1b585c6-9af2-4d57-aeea-6c49d0efa549", "comment": "Malware payload (Mirai)", "value": "7bd66d12d9c87a7caae46fc155868459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236374, "uuid": "9b8f3e96-4869-4cf1-b744-2afae1613726", "comment": "Malware payload (Mirai)", "value": "aa5d3f01ed7352a91e853e6f412c5480f6baae536514cbd8ea942cf994397054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236374, "uuid": "b6093bf8-24e7-4500-a702-4e7eacfa600f", "comment": "Malware payload (Mirai)", "value": "47e875b9a80a585c09cc84c726c3166059c22b48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236374, "uuid": "fc1e0243-debf-4a6a-99c5-df684f0c95d2", "comment": "Malware payload (Mirai)", "value": "cb24b248d31e593405c99824532644c4a8d16a70fdda5bd4c8e5b7c4338efbf386c6391a397fc41209040498f557c6ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236374, "uuid": "23fb1ea4-68dc-42ea-b42e-b215405749ed", "value": "T165930A42BD429B13C5C222FBFBAF019D37166B79D6EB3242D9217F9023868DB0D67251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236374, "uuid": "091dd177-16f2-40ad-899d-db18cfbc4e2b", "value": "1536:qIS2vc0ooLpy6avcDDejmConGrqMPbECizeJvkglyrojQADTvdhMUYcMRe:VS2vcOLsjmConGrqQQ6ZkIyro9TMXRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236374, "uuid": "0b5ed740-87e4-4772-8431-5c6e60f4bfe9", "value": 95664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236374, "uuid": "0e960941-251d-4cf4-992d-bb88a3e4ddf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236374, "uuid": "152d8e52-4b97-431c-9948-04954c5bbd75", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187d54c2-01be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770205139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205139, "uuid": "55701420-7e09-4cf0-8f02-ad05ea820a70", "comment": "Malware payload", "value": "e4f9c51ab3cb9d3db255b70c09f25fa7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205139, "uuid": "10fc3734-d8d1-4768-8ca1-da25adc98835", "comment": "Malware payload", "value": "aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205139, "uuid": "35686a62-22b2-4568-92c3-36eaabe115fe", "comment": "Malware payload", "value": "8b7103b2c68863f41353428397ad2ff385cccc3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205139, "uuid": "50526a84-7977-405d-94fe-de2726454ff2", "comment": "Malware payload", "value": "92fca1e424a3b0f424a599f113bebed6b472c1af77a4e25f8671818fba4bda2030363e7f0ba4b2415e9434817211c12e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205139, "uuid": "76fa4ef3-9d76-4df8-862f-dfd599897327", "value": "T1CA531B592748C72DC79E4A3DF071722543B9E20A3013FBD7AE58B8DE3916B8521632F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205139, "uuid": "a5d554f2-c00d-41c6-ae19-80526f05f5af", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205139, "uuid": "b4fce2cb-3e55-443e-8758-0613b6e8f382", "value": "1536:V4m9cFkjLh4cF5k5EIaG4YQtZGrpl07pK5cvyVul2dYjORuNK9sbCJyGS:yALScQ5yG4YWiplepK5cvyVul2dYjORx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205139, "uuid": "f4d7105a-61bf-4d7b-af6b-c4bf9ca8d5c3", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205139, "uuid": "160ca15d-fcdf-4a41-b28a-7e6e2aa9db6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205139, "uuid": "94861e08-1241-43c9-a4cb-aa6e11efd701", "value": "aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed9937-01ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Fuery)", "timestamp": 1770198224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198224, "uuid": "71b91f6a-deae-41bc-9ed5-22c1b4002e92", "comment": "Malware payload (Fuery)", "value": "8062d915d5ed08b274778880362de86d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198224, "uuid": "04305179-1065-4226-b141-8bb391bdd810", "comment": "Malware payload (Fuery)", "value": "aaefbeec8082e0205165604275b5f7fd9e5d9c75de06e97ec157a081fed3b57a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198224, "uuid": "277daf03-6845-42da-af80-33c49b3c8cff", "comment": "Malware payload (Fuery)", "value": "d29543076a4593dcc9cf53e59fc2af41c60ce843", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198224, "uuid": "438a4c0a-d2f3-42c3-ad50-b5ec4f5df2ce", "comment": "Malware payload (Fuery)", "value": "692eaf753a4cf7a1547b5b0e43e4ed27121603863b1927a65bb2cb733fdc9489f00cfeeaa6920bcd1712b0d49f6f494f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198224, "uuid": "0a0ab3c2-2e8a-425f-a657-b303b4ff15e0", "value": "T1083512653285C902C46A0BF91572E73403FA5C9E9861C34BCFFEADE77A25B4159483E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198224, "uuid": "282c73f6-8b82-4551-ad1b-2435222633c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198224, "uuid": "2f0f374b-17a2-4450-a1d9-ed04a04bd580", "value": "24576:Y1/dd8T3tuK/6tuO6Gh4t7yRvyRPn7UXKjACY1vfUvDwo66P:Yiztuk6tuE4KAPn7VY1vf4Dwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198224, "uuid": "9e061ac4-6d9e-4892-af7f-6f6c71107275", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198224, "uuid": "e70c2557-7957-4e57-a8b1-1b2ba54640bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198224, "uuid": "c6d6c0ee-1f34-4c84-8c11-83007d87a7d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7e6b54-01c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770206001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206001, "uuid": "bb0f90e6-68ff-45e4-854b-b993809dfbd5", "comment": "Malware payload", "value": "ad8b983fd2176e89e03ec80cabce7863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206001, "uuid": "88de560c-fd83-41af-a165-9d1b5a463d68", "comment": "Malware payload", "value": "acc302f79f49503f6e3398938407fbad90c0c2f0429e6d333137fabcb9f9bda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206001, "uuid": "f1ccf726-d899-4ff6-9fa9-abef2d02a859", "comment": "Malware payload", "value": "7acba577033622ac0a9946594a29ddfa00628df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770206001, "uuid": "584a7054-2417-4935-ade1-b8a4b4b8f541", "comment": "Malware payload", "value": "d205265bc431d9b83677b031954a817faefc08a6d0d8b6b1350299b6a2b3b8b2a00e846e6cbcbd5ee1aba7a3a1e857b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206001, "uuid": "7475171e-18e1-48ca-a9ae-1716c7903f7a", "value": "T105256B1B73A634F8E1778138C4A11651E772B87507609FAF07A04A6A2F332E59D3BF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206001, "uuid": "9aadc8c6-96fd-471a-878c-02d8af332db3", "value": "40ad1a323225ca0fff6b84d8e0053331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206001, "uuid": "4339cd28-4459-4081-9c9a-12cd85e73887", "value": "1536:Ngwyr78uznSsr229xXjn6hXHEe2YSZcJFhKlJbGvp1ptzpsWxd/9dllF4VR:qzqT2jT6JEeJgcJ+lJbeJtj/F4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770206001, "uuid": "3d072759-07f2-4cfd-bfa9-9f93693c5844", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770206001, "uuid": "70d3fc43-abb7-4fc2-a67b-7aabe725d253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770206001, "uuid": "68241718-dbd1-4121-9520-6e1e3732b481", "value": "acc302f79f49503f6e3398938407fbad90c0c2f0429e6d333137fabcb9f9bda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3fb68d-01dc-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770218115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218115, "uuid": "e2719262-7a45-405d-9cfd-c07b8fe83126", "comment": "Malware payload (LummaStealer)", "value": "cf069e58633d5031f930cc48f60e76c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218115, "uuid": "03c02be8-1533-47c9-a66d-8e7a13e421d6", "comment": "Malware payload (LummaStealer)", "value": "ad0afcb3aa3d8beb9e854d747d84a87bd16915b6ab46977719c24504e1c3cf9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218115, "uuid": "ccb08b60-ba98-4a9d-9c9e-3e3dd710abb3", "comment": "Malware payload (LummaStealer)", "value": "195ddd2095c24004b70ba289b8017cd1dc3071c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218115, "uuid": "8044aea3-9fe6-4045-83c7-57014df781b1", "comment": "Malware payload (LummaStealer)", "value": "8fb35c253b0073be00370ebb826ca6daa2b3a5e14376b63c91ef61143c67303dedc4f2e01d43027a7185ad251ae96f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218115, "uuid": "5fe9658f-e22c-47f4-9c0e-6afa892d5a43", "value": "T17BB6222516E11566E033633E19B64283DD36F9612F79A3BF23D8F0394F226D4AA34F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218115, "uuid": "a4a1c8ce-5d52-47f6-8e27-83a950cef250", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218115, "uuid": "3c6517c5-1c37-48be-bcf7-6a3e466439ed", "value": "24576:+wm2v5IeIMSqdblp+sPK1lK38i8tXDGAr9fVs+XokAn7sd06z:m2vWLMJRpXKe3v8ZxIco60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218115, "uuid": "1d7e2bac-0bc8-4d9b-9a6a-c045dda73f5b", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218115, "uuid": "9e570a75-6e3e-4815-98a8-321a1ec4944b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218115, "uuid": "2b0cf765-dbdb-4dad-9833-568cd16f8c97", "value": "Elusive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32780ccd-01ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770197451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197451, "uuid": "e75ca66b-505a-4c3a-89a3-a568e6c8a41c", "comment": "Malware payload (Vidar)", "value": "bf7a6ef3089aed9f99bb2b3a06ae4df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197451, "uuid": "4b5f30f8-e12d-4c69-ba69-1bd2f8f4e0b4", "comment": "Malware payload (Vidar)", "value": "adace366d47be9e6c3b4394ad9f4c4d4c7e5a1440a8350ceee32b0a02f00e835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197451, "uuid": "f325e7e1-191a-4248-8c0f-c83488098cb5", "comment": "Malware payload (Vidar)", "value": "0c47e32affa9ffedebb2b6b216c4437c9f06171a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770197451, "uuid": "a5c0cce4-0686-4528-a467-dbaed0ce5d5f", "comment": "Malware payload (Vidar)", "value": "9ad9920c4ceb0b2d9337525b5f037eacaf9c56ffb487b428a311b77177a30d0f562c09dbfaa8f6ca3272c9191f05ee3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197451, "uuid": "492ad294-a305-4df3-b2a6-937b990db00f", "value": "T122D59F5723E800E8E16E923489B7CA3AE6727C55037286EF16E84D4F3F33AD55939721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197451, "uuid": "6e9ed868-ff15-4519-a7ab-90b70cdd57b7", "value": "bdafb39cfee2e23fe0c8ae87ef4f1ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197451, "uuid": "7b1eabcb-d4d8-424e-acb3-a3f3288cd960", "value": "49152:6NvhM6qHJfTJb5lmzSzko22LGywmtGJlpjNjCw6IXkGKrEh/pZzntG9:JlmzSzko2HjCfG2ropdto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770197451, "uuid": "1a0bd5a6-69af-448b-bc05-a34beeaff2d7", "value": 2750904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770197451, "uuid": "eafe1f94-168c-4b67-bb26-556681d839c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770197451, "uuid": "bd2f4960-a5fc-46d6-a246-1d6d819bf38a", "value": "adace366d47be9e6c3b4394ad9f4c4d4c7e5a1440a8350ceee32b0a02f00e835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b7dbb2-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770193048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193048, "uuid": "b293d126-451a-4e86-b180-67d2b6e546e6", "comment": "Malware payload", "value": "16b06c6b5134460401eab261e46ba603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193048, "uuid": "d0775304-4159-46a0-83a0-594b978bd033", "comment": "Malware payload", "value": "af0085c27f97d54edd2240676d20bf9ef464c37a9df66a528e579bc65ece8048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193048, "uuid": "54a00978-6899-4f11-aff6-29e5f10b336a", "comment": "Malware payload", "value": "3bbb3355404d1d59ce5be9f8071c9496c8b67c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193048, "uuid": "e7179ea1-b44f-4153-b9ae-a5d7cbb43c94", "comment": "Malware payload", "value": "3dcd6a7805a1c2db40aee460e1f17c8fd3526663cad2ab0202127f488e7dfc5a111f383442f66cda21d7fffa674d84bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193048, "uuid": "71b879e6-7a28-417f-832a-90faf8df0275", "value": "T1426733AA5CD571A5C1F74710B1DF53A96260873588EDAC0A0BE639C21F10DEBB24AC7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193048, "uuid": "2692a23c-612e-4f03-a705-939c370874b3", "value": "8effc2381f3b90e64767c01827b4d163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193048, "uuid": "d5741990-b9ea-45d2-93db-9b0bbb50d2d8", "value": "393216:2kMwYNFHfLZEL32uCXnDFkguWQT4pWir/4QSZWEJ0J7fwffEQqZyEZ27WLuxebm:2DR1ELVinDFfuWQcALLeDwnEQaZEeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770193048, "uuid": "c5a63d8d-1da7-4910-94c6-f8b4dfe81ce3", "value": 30100992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770193048, "uuid": "f3143d78-234e-4fe2-b50d-e5a79d3ca8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193048, "uuid": "82863286-21f0-4ae7-af8f-7b91cd1c843c", "value": "Native.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faebd6e-0192-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770186387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186387, "uuid": "08ff6001-8a42-4687-97e3-fe61d8489921", "comment": "Malware payload (Mirai)", "value": "026bdf06f1bd182e04f812980b4df095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186387, "uuid": "dd58ae72-72bf-4d27-ad5c-074373419e36", "comment": "Malware payload (Mirai)", "value": "b10272ad6b129e7409a245a60e596b45194c848fb0985461bad94a65d3db4651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186387, "uuid": "f20ee9ed-7642-401a-8a4d-9be9ae25614b", "comment": "Malware payload (Mirai)", "value": "2b2e5865408ac158f20bc5e956b90a54ea37361d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186387, "uuid": "4ce0d55a-f40e-4eac-bc67-dd61f0d4e6c4", "comment": "Malware payload (Mirai)", "value": "eb753eb36f1cd426191fd061d645a03ec875a1b07c05198d464007d4ab6b51b2f24c4245001faf76c99ca279ae1860bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186387, "uuid": "2e3da10a-1848-4474-9efe-c46bd653e10d", "value": "T130934CD2B740CAB3C1430AB116EBAF110532F5BB1A5A9E16F3687DF49F150897226F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186387, "uuid": "88200d73-b331-4f82-9da2-b0a27aae0b95", "value": "1536:AD3YEU5eT9QRjlQhyUsU0z1eOYcLyhmX4wBgRdSQUuqwN6m1agvmgNLP2mJImVzQ:ADpU+9QRjlQhyUsUD2yhw4wB+dS8qrgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770186387, "uuid": "a2ac4453-6f57-4444-b92a-2bc423c4bab7", "value": 95834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770186387, "uuid": "dc674830-f5cf-4c90-87ca-958bfbea6469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186387, "uuid": "da6370b1-a6e2-468d-9953-81c5c6e78f4a", "value": "pXdN91.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ed39c-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198818, "uuid": "18b2e8b3-a5a9-4c8b-b603-c3ed087130f3", "comment": "Malware payload (MaskGramStealer)", "value": "0937ce8d59d53ca1f4ffd0020d57971e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198818, "uuid": "51d8f017-aebc-4968-9b34-9326ece67fbf", "comment": "Malware payload (MaskGramStealer)", "value": "b12c0bfff3496f0f6d855a03d0cfa8c85ee84310d14709824f5b5a1b27c49c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198818, "uuid": "1b57686b-ccbb-4275-8660-a3a0dae113d7", "comment": "Malware payload (MaskGramStealer)", "value": "1baa546bc892ba673e11b8c291f26173f09f1581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198818, "uuid": "9bb13684-6e3c-401d-888f-d29b67af68fe", "comment": "Malware payload (MaskGramStealer)", "value": "78af951ffbb9c6f559894e7a7628e7415b72d5a45e86f6f5a56d4569ea75d7505c4f5853dbbd794b1b4b09cb57b8a166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198818, "uuid": "e2997458-1598-4387-a252-c62e5449d2b1", "value": "T14617234655D992F4C4C34B34268B11DE30C17D5ACAFE891E2AC73C03A571E9B9A4FAB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198818, "uuid": "168a6411-412d-48a1-a080-2f9d7cdc69d2", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198818, "uuid": "bf012f82-e7e4-4919-96cd-e397e658d533", "value": "393216:gcPrBmWHKlm2OiHYi7wtJlvihzrGFw6CVh2XmldMX:gcwWHR2KOsitr3VhUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198818, "uuid": "96977901-4779-4302-8677-837c4a59ee31", "value": 19855360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198818, "uuid": "fe34aabd-fd0d-41bd-a07c-53e5db0d75d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198818, "uuid": "4e1aa54b-02bd-400b-bf1b-edc50ccd8fac", "value": "0937ce8d59d53ca1f4ffd0020d57971e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfbe7b6-01be-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770205522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205522, "uuid": "10c07a63-ba7a-46ab-a42e-f60726d969db", "comment": "Malware payload (Vidar)", "value": "dcbcbfd010180171153746ab08f29f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205522, "uuid": "da7e4443-1da6-4fae-9e08-a505b323e26b", "comment": "Malware payload (Vidar)", "value": "b197843249317cbc6d3dd65060c8aa442a6379a6b9b749da93ecc2180f67c801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205522, "uuid": "ba5ba206-06cd-486f-ace9-10eea14bef38", "comment": "Malware payload (Vidar)", "value": "eedbb990015da472fd53c7291900de8a4ce24d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205522, "uuid": "42ce3181-fddb-4e03-b518-ebe136ce0747", "comment": "Malware payload (Vidar)", "value": "1a2354f8eca6c816c9cd1f09e4ae0936740b6d9e06fbda56fc4be8f7e2c0a84d1ff59b4b2f64810f859ddc0e31429c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205522, "uuid": "4a9d2d49-527d-4180-8319-5b9a5174d262", "value": "T1BC264B93BA90C669C6DBE239E47161957230B808073036D3BF651EB69D2B7C4173BB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205522, "uuid": "f715f09e-ffa1-4668-8952-c17d1c140526", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205522, "uuid": "d09c59c6-3407-4dfa-b178-57f548ee0b77", "value": "98304:9N6lPdqwySzcLijNBRWs30wVYTaE3MQIBKE5R:98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205522, "uuid": "e536d500-16c1-45c3-831d-ac510a2e957f", "value": 4690048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205522, "uuid": "ae35fb85-ac82-4074-bac7-bc3c5cdb9472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205522, "uuid": "36765c4b-29cd-4944-bbc6-686955a2885c", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba3bb91-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770219452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219452, "uuid": "02904c88-71d9-4258-be17-08aeaadb97ef", "comment": "Malware payload (SheetRAT)", "value": "c8a1e71708c9b62363ab536ac6e86d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219452, "uuid": "555cc5a3-d509-4bb9-8eba-ae6616d352e2", "comment": "Malware payload (SheetRAT)", "value": "b20d5974675630ec67c45ea56eac427718a06821d655134a8f4b892d07276972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219452, "uuid": "98a607c8-a861-4ec7-81a7-81f42d91e572", "comment": "Malware payload (SheetRAT)", "value": "c0db212aba0780b330fda2b8090b6551e08cb88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219452, "uuid": "5999db28-2a93-4002-90ce-76e5ab666a9b", "comment": "Malware payload (SheetRAT)", "value": "c91e37e4afb74b09071de7054de3ba0423c41e4794eeb7d6e53fae9b493a150be69b7cb188841f029de1a316bed7e3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219452, "uuid": "12ef371f-4cf6-4905-842b-9946373e205a", "value": "T1A4A439253FA48E10D854287ECABE2A09CB16E0F125026347770AF7A55D05DEEDE2D3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219452, "uuid": "3e3d6c59-e388-4afb-99fc-efec38926109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219452, "uuid": "a0ffe9de-0c0f-47d4-ba4b-ed5a8d42fcce", "value": "6144:y7iPGGUpS6qh5XqZ/dluGOu32PB2OhhwymM67cJ4cDkPRRN49XyxDiE3PF8XB1CR:yIGFS6qh5XkbOwvOhhDkcvBZXBYmMvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219452, "uuid": "cbef06fd-7f8d-44da-bdcf-4c74b44d3506", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219452, "uuid": "4f451032-5e28-4cb0-84b4-3713efb3f978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219452, "uuid": "a6e8542d-130b-43e1-a394-95ff1c0ed092", "value": "b20d5974675630ec67c45ea56eac427718a06821d655134a8f4b892d07276972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2164ec-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770200825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200825, "uuid": "a56de6d9-0523-44f8-bd6f-e32ccad513dc", "comment": "Malware payload (PureLogsStealer)", "value": "ac53c5315ed85c8af3448d1c70d499a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200825, "uuid": "9025728d-9bab-4b0f-9252-7ec28a892842", "comment": "Malware payload (PureLogsStealer)", "value": "b2c0471f0b98d016db3f73ff001b097cbefe3b8e41eecd027fa40aa96a2cf3a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200825, "uuid": "dd4f27d3-2426-46e8-823d-48a229083eef", "comment": "Malware payload (PureLogsStealer)", "value": "2747d21675a0c3bf1060a898fc08dbffe5b92a93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200825, "uuid": "07dff9cf-a5c8-413e-8234-12e9b25eaf89", "comment": "Malware payload (PureLogsStealer)", "value": "d3919a580b9861204f07637c7289a61ba990774a9c8adeace0e02b06a076570c2fb0b2c5134a452d73d23998be81645b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200825, "uuid": "deb88e39-8744-45da-93d7-ad5601d639fb", "value": "T1A45611DA0476F0C4FB5A8AB2A912A31F9E9048A521C64AFDF469CDFD605077CC548FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200825, "uuid": "93b1ac3e-bc67-4770-bd81-659fb4d7aa0b", "value": "768:XPD6NI2i0j5jq+WqYAaPhHc+HENoypTV+aSupB9uzfC0VqozCwrVDEoTXaIUtxxP:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200825, "uuid": "ce940939-8575-4c31-8252-8b478b96ce50", "value": 5922965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200825, "uuid": "f7ad4c1c-6027-4cea-b98a-c7460b983181", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200825, "uuid": "734260dd-d3c6-4899-9fa2-43e69f78bdf5", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e918d3-01e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770221511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221511, "uuid": "69c12ec5-8dd7-4a73-956d-316c22764701", "comment": "Malware payload", "value": "8aa91a14645c19336aa85c44f29c4e0a", "object_relation": "md5", "Tag": [ { "name": "mrekuro-hopto-org", "colour": "#FEFC03", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refaccionesalma-com-mx", "colour": "#BBE79C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221511, "uuid": "59dea083-5b49-47f5-adfa-e91d3d72ec56", "comment": "Malware payload", "value": "b2cfad38ef220d952966dd26940824b1c33f5012cc65678eb5d5b59c5d646a46", "object_relation": "sha256", "Tag": [ { "name": "mrekuro-hopto-org", "colour": "#FEFC03", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refaccionesalma-com-mx", "colour": "#BBE79C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221511, "uuid": "99c72758-53b2-4d39-97b2-4c70daa811b2", "comment": "Malware payload", "value": "89467f4607f763a87cd72d7d02efb67df3037ec0", "object_relation": "sha1", "Tag": [ { "name": "mrekuro-hopto-org", "colour": "#FEFC03", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refaccionesalma-com-mx", "colour": "#BBE79C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221511, "uuid": "9b57b120-402a-4ef4-87f7-c0fd7fdf2e76", "comment": "Malware payload", "value": "d90ee4715785f6abafc0da1850ea1b17f3dec5cc46d28059e1aff5f2710e9640b1f49c1b98788a60c8aad68ee04b5af3", "object_relation": "sha3-384", "Tag": [ { "name": "mrekuro-hopto-org", "colour": "#FEFC03", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refaccionesalma-com-mx", "colour": "#BBE79C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221511, "uuid": "e755a6ed-ea00-41d0-9f40-9f6306a88f95", "value": "T179B51111C916CE45022C926520A24CD326914E674D9877A67F9F0F8E2F4F61FC9BA3FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221511, "uuid": "20961f1c-913c-45b5-8237-c12081b79360", "value": "24576:fyFZO6JDbTEH+JZaS1HCepfNrtqQQCIvrGgzNLX6tzGUkh618Box8bisexfu2H6t:KXZaS5N5NvJGLXgHk8MEfPZH4cpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770221511, "uuid": "23d12016-027d-4054-9f66-3a934678cbb4", "value": 2467613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770221511, "uuid": "8834c27d-8470-480f-984d-1658fd785e67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221511, "uuid": "6ff34bac-f990-45a9-b214-673f94c62562", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345a4c76-01ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770226231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226231, "uuid": "c421401b-50f9-4e77-af5c-a2798b26695c", "comment": "Malware payload", "value": "544112a1af3be5275e867df9af59d3f8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226231, "uuid": "4ff691cf-9ece-4873-818e-9d7660d7c6a3", "comment": "Malware payload", "value": "b2d7ddbd7d10fd4d87b97eacc2f332092f50e57a5fe4b0ad9378d3bb19a068cf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226231, "uuid": "a5eacdd7-9596-48ba-925b-6215447b25dc", "comment": "Malware payload", "value": "abd5b5f60af0e87d217386cada117b2b3fcd52df", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770226231, "uuid": "3d0bba01-2f7f-486f-b287-36ffd201b204", "comment": "Malware payload", "value": "786b4fd7868c857c87395d3bec02112b2e3cd6dec61406a09e88ca213f34efe4deb141bd9b5426f7eb0a94fde3d25334", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226231, "uuid": "daa01238-a8de-4c86-a65e-3a7fe9740ec5", "value": "T15157339AEC395B1BEC365239CA7F552C87A27E3969031C3B7554323259B3BE4B376002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226231, "uuid": "b5665bfe-f237-4042-9701-fec440dae29a", "value": "786432:5ar5nojM+6/nB8b52UnR9SPxA//cqjmxx:5adnoUo5pYyMqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770226231, "uuid": "6dd5e64e-646e-4555-b456-88a57c7a2091", "value": 29229056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770226231, "uuid": "f26671d4-ebf7-4f69-b929-73e456397c2b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770226231, "uuid": "e53b628b-dcc5-4fea-a1b2-54268c0ef3fa", "value": "Extreme Injector.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022fdffa-01e0-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770219704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219704, "uuid": "b95049f4-1d3e-4522-a31a-d2b39521745c", "comment": "Malware payload (GuLoader)", "value": "1aa04f395aaa12484b509fa3f1731bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219704, "uuid": "843a1385-ca59-4305-86da-979bb5ca4c2a", "comment": "Malware payload (GuLoader)", "value": "b303d73e3c93e65c66ce7d1dc9c97fd39fb71d490b91588e59b2a677e17c3cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219704, "uuid": "ba01f099-6751-4eb8-b763-24ec4ff4b5c0", "comment": "Malware payload (GuLoader)", "value": "ac519a1fe1d2b1fb8f7c8bd85b43505f569055d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219704, "uuid": "0af33b63-a657-4650-b45a-710f20eb1558", "comment": "Malware payload (GuLoader)", "value": "7eadf0217b537e01f4a3d36524a46a69eed6b2e6752039eefb6dd277e667e304911c8a7c2b0b0014f84a0c15de839b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219704, "uuid": "343e8cf1-287a-4e92-8deb-fa7766a1b02c", "value": "T134848C512266DC63E39492B4415AE77E8A71FA8A2D31C33726F1ED9FB618F323C18351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219704, "uuid": "87403da5-5edb-4d5d-be3c-439883b300d5", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219704, "uuid": "4b1b6be5-a8b3-4bbc-bac5-f08418721baf", "value": "6144:uB+pgU1Kl8Ga/j4jO3mvABRp0mP+YCgv/UihJrdsgbKdYgu/oTU0h8d9:ugn7hCuUiRs3E/oT/h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219704, "uuid": "dfa6e4fa-4cfb-4f0f-ae62-99d2f77f872c", "value": 373456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219704, "uuid": "b478fb61-bc1b-457f-b39c-423935fc2a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219704, "uuid": "68f78ba1-d095-45a8-bd1f-4b0e3acf48d8", "value": "b303d73e3c93e65c66ce7d1dc9c97fd39fb71d490b91588e59b2a677e17c3cdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d748d0a8-01c4-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770208036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208036, "uuid": "0d51002d-09e6-4d1b-80c9-d5582fbaeb12", "comment": "Malware payload (ValleyRAT)", "value": "b43cb01ef063e5cf1365fe577ea8e9a4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "WinosStager", "colour": "#4E456B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208036, "uuid": "23d0429c-a8d4-45fb-8e29-52fc3a3a8219", "comment": "Malware payload (ValleyRAT)", "value": "b363a303ff19c9371c0a23ebc45b642e05cd9985837b1bdda6d6c3e581d340c5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "WinosStager", "colour": "#4E456B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208036, "uuid": "3c1bac27-f1b4-4c6b-b19d-c6ffd5b2626d", "comment": "Malware payload (ValleyRAT)", "value": "2c04462953bd7f1661fee70e8abd4d3559957a9a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "WinosStager", "colour": "#4E456B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208036, "uuid": "660ff52d-a9b5-44da-8666-4579573bb453", "comment": "Malware payload (ValleyRAT)", "value": "8e75ffeb4f735eecf209e79b760d132c1b77d445d419c91a68a213ce2da46da313acce8d19d4d8b746c785294e8c876a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "WinosStager", "colour": "#4E456B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208036, "uuid": "c3e1b24f-f87e-49c8-81c4-0127a3d87a10", "value": "T191183333324D8B3FD58BB875A666AA4E0912FC4A833240C7C38EEC67D1759D354B99D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208036, "uuid": "15147952-e17f-44ab-8b0b-9afc5b48295b", "value": "1572864:laNpLLDdipDcDGAkn1H0MjcyEHNqSQUEd3gzu2assmZMjIODhPtp7D4VhA8oAR:Y3xi5cxy1H07yEtQjazu27TMjZd7EVhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770208036, "uuid": "bbd402d3-ffa7-4751-8b77-cfc3363784cb", "value": 92632064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770208036, "uuid": "b0cd070d-16a3-43cb-970b-972948cc5337", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208036, "uuid": "2744592f-cce2-4f02-878a-e10c70d3f8de", "value": "aliww_win7-11_v1770095297.20619.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0affdc5-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189959, "uuid": "458ef3fd-77a7-44cf-a253-f02ab7cd5416", "comment": "Malware payload (Mirai)", "value": "d9f6460ff9b79d2d6dc2098e6bade753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189959, "uuid": "8288d56c-5e0d-4107-a241-44cb4a6e8847", "comment": "Malware payload (Mirai)", "value": "b429c0359cc41e3f79142f797f6995d004887704b9cfcef4797dc01b0c0d1606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189959, "uuid": "a5d00bb8-cce4-475d-b5da-47260eb7b501", "comment": "Malware payload (Mirai)", "value": "c34a4548d64aa5012e0ea1eee4dfb19b86cfece2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189959, "uuid": "72b3c8ca-ad18-4212-a309-20de6044f486", "comment": "Malware payload (Mirai)", "value": "23d272c9591f4dadb24a778748b1f00dc75edbb548a8b910fe72bd6b4c44bba6c2554e51aa482f04c0ec480e05931bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189959, "uuid": "54ff9391-336e-486c-918c-79df125e43c3", "value": "T161739E77D06C5DB0C4544A7475A8D9B44B136904A2A33FF1CA828F699407EFCF22ABF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189959, "uuid": "86f6ac1c-21d4-4c85-be1d-891f1beb6ce9", "value": "1536:G/kmntaTh/xHGTtESB37Q0pU7edAfMCgGdk:GMmtG/5zSBrTWedAfMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189959, "uuid": "1727fb9f-34f1-4a26-bc0e-c6f9bb6236bc", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189959, "uuid": "6d42851a-160e-49e8-9d72-a49d64ca1d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189959, "uuid": "76fb0860-1896-41b7-95bd-d0bfd69c8030", "value": "nullnet_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170fd5f6-015d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163475, "uuid": "c464c7db-7087-40b9-89df-cd4c8c8517ce", "comment": "Malware payload (Mirai)", "value": "086fb30181d1efd4020809a183f6f372", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163475, "uuid": "7185c92f-74a5-4e30-be8e-ee0987048e8b", "comment": "Malware payload (Mirai)", "value": "b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163475, "uuid": "d75ad1c7-d857-4405-8ccd-a69766a4dfd0", "comment": "Malware payload (Mirai)", "value": "bf960f674e6fbdcfe9a36fb096df1e74b4c9ec2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163475, "uuid": "6f86f44e-1687-449e-9ddc-6a2d1943f371", "comment": "Malware payload (Mirai)", "value": "36fb7c03f5bc2f77d38cda25eb0f2c4a4cd4f80d0f30c0a55d8565def5d8db42ce27617061019e380b9d51146b7600a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163475, "uuid": "9a339521-0b5d-4e0f-ac36-2741c75ad588", "value": "T1BE5175F6A3C247305EA95637A3789904BC45E1F3B1862E649CFB29BEF84CE047405E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163475, "uuid": "ec34d7d3-3320-4465-bdc0-b6e30db57f5d", "value": "48:i+/RjQbx7+ukIVYhANnLDJbuUqOTJ364M:idbx7bBNnL9bnJ39M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163475, "uuid": "2436a217-179c-4fd8-b290-967c69486b49", "value": 3169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163475, "uuid": "d34939f1-72e8-435a-897e-90661495b5f0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163475, "uuid": "d4fa0372-a69e-4855-b539-cbeb7de8597b", "value": "newreaxe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6726a50-0206-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236381, "uuid": "9ac10469-b0f9-4b6b-9623-df91bec6d44b", "comment": "Malware payload (Mirai)", "value": "968d03c467429a65a3bb269f0ab9eda2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236381, "uuid": "b3df35e1-0c7b-4bd2-9e3b-d284e8b9166e", "comment": "Malware payload (Mirai)", "value": "b4c8d56dd8df6fd8484935c40dde393bfc1fc2f59bc4d9cee2439fcb1fda7b06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236381, "uuid": "f8581a9a-52f3-4a5b-930f-1a8be20ed4a9", "comment": "Malware payload (Mirai)", "value": "30723dc1a65a9e91afbedfb74d0724ee2976f931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236381, "uuid": "4845a8be-10d5-41f3-8387-6c7ab6d720e2", "comment": "Malware payload (Mirai)", "value": "d6988506d4ddf713ea6370af6b4296286a2bf2b308c04d6fddeca51581954bb99f7b48f9f410a77a13bcfdb30dc0ad8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236381, "uuid": "265b06ec-7f31-4422-acdd-be06747e1ceb", "value": "T1FC933A45F353E5F1D84705F002ABE73A5A31FD331220D96BDBA4FFE2AD215C2A096229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236381, "uuid": "0af88eb9-39af-4654-9019-685fc330fb77", "value": "1536:6slfLU0HVfxJa2sARiH3+gptUS3100x7V/ow0ew6czHcrI:D3pxo23RiHT6kC4wZb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236381, "uuid": "e3c81649-81cf-4bc7-bd03-b2410cee2f0a", "value": 94608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236381, "uuid": "5abcd391-73ae-4544-9d1f-6f6001b3b3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236381, "uuid": "8001985e-94ab-4483-9f4c-a43b6ecf7b4b", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309ad2e8-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163947, "uuid": "1ada2dae-46cb-41a3-9f38-b98e8c075672", "comment": "Malware payload (Mirai)", "value": "89055639043753647537bcbff9bfe04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163947, "uuid": "b16addc1-7550-4af7-bf00-a5ddaf08b743", "comment": "Malware payload (Mirai)", "value": "b4d98e7fd3aef0477c719e04b01b8dfc825b7841b258ba4f847bea0ba385fd07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163947, "uuid": "e32a7752-87e9-44e8-9bc9-da668a1dbc7d", "comment": "Malware payload (Mirai)", "value": "625edc24bc9748d3978d8b2f159359f5300f82fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163947, "uuid": "bfe9302f-8313-4a3d-94d0-1a132bed6d38", "comment": "Malware payload (Mirai)", "value": "02274ed66f661e275672ad762a81636802c59b914d87a56f7dabc10691c4f4aebf87ca9c32eaf09018a7c3136f843e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163947, "uuid": "8a167967-02ae-47bf-a894-ea92107af5c4", "value": "T124F33C41FA8B84F1C847493050A7F73FE731E5298039D7ADEF899F35CA67A01960A399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163947, "uuid": "a7cc8397-b7c4-4d10-bce1-d2d5ed6b2467", "value": "3072:8J8zW7wNuoccU3OVEkOPTv62rdBvlVyy13FY0YGwbZnO:dW7wsoccU3OVELv6gOpGwRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163947, "uuid": "b93f2f86-402c-43cb-ae84-f2fbbacf831c", "value": 164680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163947, "uuid": "7957a020-11fc-4556-9497-4d176b8153c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163947, "uuid": "b9cee2e7-b905-45a2-953d-60c8ea210861", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc02ebe1-016d-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770170677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170677, "uuid": "c3623918-4e83-4e7e-9776-90828bc36081", "comment": "Malware payload (RustyStealer)", "value": "aa3d369178a71fa4deedd64cfa5ceba1", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170677, "uuid": "16fe3a63-a945-44fe-b6e0-fb9dab8d2afe", "comment": "Malware payload (RustyStealer)", "value": "b655879cdaf44de932a104e3be39d2725e433d6106ccf5e39da1f87590a87e06", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170677, "uuid": "25e11638-eb10-48f0-b8f2-915e3f83458c", "comment": "Malware payload (RustyStealer)", "value": "346dc0617688f01650adeaddfe8554242c88eb23", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170677, "uuid": "acbc82b6-ad39-4481-8ad2-141f763fd370", "comment": "Malware payload (RustyStealer)", "value": "9821772041d3425891ed54bedb92b2f54d6748c62c10a55905a102a90998e6770a965d8c2744ee781c33ecd21f6abc05", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170677, "uuid": "ee097a7c-6fd1-4043-9ed4-01a3d41fe21a", "value": "T143042317FDAB46F16ED612BA105827C1F32CD021F74A536C00A7537A38A5D5CF2E94B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170677, "uuid": "29b17080-0b80-48cd-b68b-34cce4c9a3da", "value": "3072:bE3IJhDCFxke8yd6EESpB8GB3+ulF/QxZqhwN/sfdmwzeDxvOtDP+:by+Q98yLESf8GZTF/2oy/lwCtK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170677, "uuid": "6367ddd2-3f84-4280-823f-b8c694720b4a", "value": 185126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170677, "uuid": "e5b75046-f5de-4a98-9aab-45e7d4ab8650", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170677, "uuid": "8a748bdb-00a8-42e6-9921-c9520d40e3ef", "value": "autocad2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e917b3-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770202992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202992, "uuid": "34f5a085-468e-406a-94e6-8ef0d9c19094", "comment": "Malware payload", "value": "76abe32ad2d2265fb1590a94acc23148", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202992, "uuid": "3b915c54-286f-43ab-9a20-dc5df2468a18", "comment": "Malware payload", "value": "b76b3528888d1d83fe20f7cb6e155a8255752a128e68a47150b3ec13322a50a3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202992, "uuid": "d3692194-76c7-4edb-b426-f9d1999bda81", "comment": "Malware payload", "value": "1ae432c031902db1a354429e5e5f3c2051f94ec3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202992, "uuid": "7ac0a6a4-75ef-46e4-9d09-acee07a49382", "comment": "Malware payload", "value": "9afc95cf1b3b9e2417ee52c8c51577f4f6d298d28f70cdfcb6b143725c9ce241b5815bb7d5a9f60ef709edba39757cc1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202992, "uuid": "3825b2b9-c98b-4ffc-9f76-63289cde0c82", "value": "T1796302093F9D90D9C41380B4B703E8577A471BE6F179E457061AAEEAB4E900936D7DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202992, "uuid": "b2bd636c-7bd2-43af-987c-bfab4b9079fc", "value": "1536:hdtLMsYSHW1PcqSYKd0vdEDlW9TNtNToyHo+7qpX81CoLIFI:7t1W9cqSYKd0vEEbIXX8ooLIFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770202992, "uuid": "581db34a-54a7-4074-8acd-57a0c0e9388d", "value": 71705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770202992, "uuid": "df0a4808-674d-4c69-b0a5-66f3f6c7c568", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202992, "uuid": "9b6e3c65-95d6-4312-a731-c8588c2db7f2", "value": "Donut chest dupe method.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8396265f-0191-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770185991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185991, "uuid": "1389b74f-30cc-43da-802d-9ef9c40844fd", "comment": "Malware payload (Mirai)", "value": "11ea29b70c5cff0fa3df62e735a0f969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185991, "uuid": "09b3534a-b110-47d8-b8a0-e76a0b0d1d30", "comment": "Malware payload (Mirai)", "value": "ba3b42731495739734f66f4bfa4effa7669ae62e3c49b797738ddba6457f5c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185991, "uuid": "a4f854b4-3077-4bef-b4b0-c39280ff46cc", "comment": "Malware payload (Mirai)", "value": "5d132d0785e4a2a4cf25aaeef3d55fa4240304ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185991, "uuid": "d4d91125-74e1-4a13-b142-dd985d1b44a0", "comment": "Malware payload (Mirai)", "value": "d4c1cc815374786c0b69317f8a10cd205677fc68f9345d2c13103e069ce23d8b264e11cc2855ea33f52dc6dad05cb1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185991, "uuid": "8ca1bb02-fb63-46c1-9d80-5d4a837c0f33", "value": "T12B332807B58185FDC4A9C17443B7B13AD462397E123DB2AA6BC4FE1B2D46E601F298D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185991, "uuid": "176fcb4f-eed3-418f-b811-9290f133ad76", "value": "768:ENUYvkxwSf0+fVlACmQwoM+JTXilBV3P78TLpAgyUTq0LvifHOgr:iFMqwfVlDmQTM+JDiB9IGg/Tq0sHOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770185991, "uuid": "e56753a8-de7c-4dc7-af55-6a31a0e0ea56", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770185991, "uuid": "dcde0c61-9572-4ef2-a455-201fc43062e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185991, "uuid": "eecd226b-c451-4bcc-9fd3-4399d5490892", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798285a3-016e-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770170942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170942, "uuid": "1e744efe-5d54-4ff3-9a81-6084dc4141f7", "comment": "Malware payload (RustyStealer)", "value": "f1d2cbef3a4bf82fc3b8e87ff7807184", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170942, "uuid": "3a6f2847-a3dd-48c2-9492-09dffbda3533", "comment": "Malware payload (RustyStealer)", "value": "bb3ec44624b158a0ec7f6fdb44f50e56ee610e3a8e61b16aaa945ccbb373fd54", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170942, "uuid": "785e382c-03bb-415e-855d-ca54cc82a979", "comment": "Malware payload (RustyStealer)", "value": "b352f72cfe40c339b00ce2ddcd5f08517e2e3345", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170942, "uuid": "48429cbd-a180-4497-80ec-64512f33fd1d", "comment": "Malware payload (RustyStealer)", "value": "1b281c083585d2af39fd7e4a5b69aa8ec4de685d0691b6719a44d23a54727bb97f2ddcf3cc4b211781df6cd81811565d", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170942, "uuid": "788b0bad-08c4-40e2-bb02-bf3e9706faac", "value": "T1AF1423399D7444CC9907D23F9D283B982C78FE9DCD049B6C819956E9A13C3821D589FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170942, "uuid": "0801f455-12a1-4db4-86e9-4eb1802906c9", "value": "3072:ZRDpQV4k397X43riT8Ydg5batLlKKTjtQcyhMDejGZYJfeGoXYYpppY9z/vOH9ne:O3974S8YO5bol9uDGejCnoGLYtvMPYTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170942, "uuid": "9ed4259b-e70a-43ab-a3f6-c36d1f394a56", "value": 190470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170942, "uuid": "455e74a4-aa23-43bb-ae6b-9a0d472f8d2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170942, "uuid": "dbfb1f34-f67b-4cd1-97c0-f55c434715e5", "value": "autocad2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bb214a-01bd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770204681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204681, "uuid": "6ac5a1d0-fb19-4c48-9e7c-72e7a41a30ac", "comment": "Malware payload", "value": "70c76be9ba22b5f7d6a1366c650f5f14", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204681, "uuid": "c1a89cf0-e331-4a8d-a035-427b86d1cf67", "comment": "Malware payload", "value": "bbfd93dbf43236b7f64017ad20f72dd611de1acb4b15e02569e42887467b34d4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204681, "uuid": "d23827d3-056f-4a44-ad21-18ea0f8b0254", "comment": "Malware payload", "value": "f324d9c7438d6facfc97eb62dfd6b9eedf34e35e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204681, "uuid": "43a3aac4-cb86-4cf2-9d18-50cef3c277fe", "comment": "Malware payload", "value": "cc0d88be2e657d4fa01b502ddbe4c21dd2c3324e789e24075537e9bb5f19407e3dc4cfe9ff2c52f3f21a06c95d1ac898", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204681, "uuid": "8d05466d-40c8-4963-9377-cf636ff00e5f", "value": "T14BC361B800941696D35391936F0AFC892D3BF8167CE580B03EEFD3B9E1BADADD612445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204681, "uuid": "6f67299e-a085-43ca-a580-0e9a84c3b9dd", "value": "768:8X3opn65xUdCzjn8lBERJ0fq3u7QBxYX1ICs4kTFwvl5ibP2HcGQo9:8opn6nlbkZfqbBxYXxkT6lsbP2HcGD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770204681, "uuid": "ae4da093-5be8-4d53-86d1-9de1d5d6ef87", "value": 122013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770204681, "uuid": "6cf0de46-91bf-483a-b828-e40176c31d16", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204681, "uuid": "fb6a1c57-7981-4d5b-beb3-98d9473adca0", "value": "96.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62b79a4-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189968, "uuid": "a126ff98-b12a-45cc-b4a7-d0a7bf6051e5", "comment": "Malware payload (Mirai)", "value": "72bac92191f77e5bec7cacbf8d0d302c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189968, "uuid": "445eb39a-7f16-407c-8894-31a06801b92a", "comment": "Malware payload (Mirai)", "value": "bc660f9d823df175e12e1ce78418be1ea0d92585e2cd5432fe2590ae41884876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189968, "uuid": "f283c9e7-20af-4c22-84e5-50da660993dc", "comment": "Malware payload (Mirai)", "value": "d9f3f629d6666395065aff4557538bbab627aea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189968, "uuid": "7deb77a1-3f41-4fac-9ee4-2394bc4c9a74", "comment": "Malware payload (Mirai)", "value": "7260a93abee35ea5b2c3f0386dcc0b35116ecbfb0441d4784ae100df6cd321ff71896ca5f01a7fb9a4742828298cf842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189968, "uuid": "4251409a-073a-4f07-b581-745cadee5a41", "value": "T153932A86BC409A11C6C50777FA2F108E3312679DE2EE7252CD141F747BCA91B0E7B696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189968, "uuid": "f7cd73d1-ac7d-4ab1-904d-546391d9ec92", "value": "1536:+pnZNBtXSTB+lrX1/pxMr5SRH9rgvtiCJ70qpdVprPgGzoAIdiLlaRm8Ye:6NfiTByz1/pxiUl6YqpXpJlaRm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189968, "uuid": "a1bff17b-bc2a-451e-b60a-1d0438d040d1", "value": 92736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189968, "uuid": "8d730450-5a49-4d98-b632-1af50f967ca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189968, "uuid": "abe925ea-d771-47ab-87b4-b514d8fd639d", "value": "nullnet_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e325c6-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198883, "uuid": "9c139366-321b-4b56-ade5-e7d1615781a6", "comment": "Malware payload (MaskGramStealer)", "value": "08091d8441d09f4acb1f4fda8195d95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198883, "uuid": "964c6f6e-3ba1-4e00-a6f1-9bc8a89dcec1", "comment": "Malware payload (MaskGramStealer)", "value": "bc9ecf32cc8a4ee3d2096990780ac95fcce7623396541407c9d7b4e3dee762eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198883, "uuid": "b5188b33-bb8d-4469-bf4c-ed608d1202bd", "comment": "Malware payload (MaskGramStealer)", "value": "7a2c046454d20b586f54f1b3ac4d92fd4f8e415d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198883, "uuid": "869a6610-b3f1-4be6-95ef-18f25552e971", "comment": "Malware payload (MaskGramStealer)", "value": "52fbfa7c3b6a79913bb06e49d41f5914ad9ce6d9c412c2ecde8462f322d27bcb6e7be63f1a65ff4743d5d4d813064e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198883, "uuid": "77c65cc4-10a1-4d93-a70e-b1d264d52ccb", "value": "T12FC623E799C463E8C0C34B74618712D9B1E1655F46EEDC2C3BCB2C032931E5A9A4AE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198883, "uuid": "411fcd39-76a6-478f-917c-92376e567ab2", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198883, "uuid": "0caa2d62-ec0e-467e-89f8-cdc9ee6120c1", "value": "196608:KjuAFbwEZeeGISLxPAmcOwkMEsxudLHFahmxmpElqFVcV0f5pC716wxeFTT7d8iH:KjjbwEZRGnaUcEsxcLHAQmUqFVRXG8wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198883, "uuid": "895a4c7c-c6c8-4d52-91a7-05ec1a3cefdb", "value": 12251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198883, "uuid": "1d296696-ca4d-4f97-9c18-5f0cba5c8024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198883, "uuid": "43cf23e3-0dfd-4a44-bbb5-532943af0ff5", "value": "08091d8441d09f4acb1f4fda8195d95e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf571e8-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770203348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203348, "uuid": "7ebc7bb8-db2b-4512-82aa-54fde0fef890", "comment": "Malware payload (Vidar)", "value": "9101c0ac40d11618184f9c73daf6c739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203348, "uuid": "73c2300e-c738-4753-8771-160cf096e936", "comment": "Malware payload (Vidar)", "value": "bd4431ea31f7822024ea3ee511ce6062ac1059683b681bac3affb8cf1db8eca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203348, "uuid": "3130a6a4-0429-4849-9263-2a07c9d1d4b2", "comment": "Malware payload (Vidar)", "value": "8ac8a6875bb3d6a3bf53b2cd073af51c01a70d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203348, "uuid": "bc83f77b-61ae-4982-8898-cc41317b57b3", "comment": "Malware payload (Vidar)", "value": "26fdc5cc17e2b22d007db1d7f11d8ce7e20c8d258e48f1161caebe6ad09542a38e71ff3d934b65fb5c6bdfa39eda8d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203348, "uuid": "112aa232-687a-4ce1-ba2b-a13961fa1089", "value": "T157E412FA40708BD2E9917BFB4C4805D91BE3B874A2F8E35C40AC15478D589DD8E9AE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203348, "uuid": "e8d845db-4f9f-4bbf-ae32-461aabdb758e", "value": "177c7246fdb0bda08f242d1c9daf70a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203348, "uuid": "f0497a70-66b9-44f0-a70d-14946859a824", "value": "12288:YjxbG9s9T5/dQ034NTCDX3AgduNG2Us9/rWPoMDHEptgf:YIs9T5H34NOzpuNG2UsyPhLEpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203348, "uuid": "ef3148d5-e70b-4406-aa82-2f2910fc2f98", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203348, "uuid": "e42c08ba-4a6c-45b2-a7c4-4ffc521abd7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203348, "uuid": "a8bf1f6b-228e-4342-9116-2a93f7645560", "value": "\u0412\u043e\u043etst\u0430\u0440\u0440\u0435\u0433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485803e8-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168282, "uuid": "e217cc9b-1b04-460e-bac9-817a4df65a11", "comment": "Malware payload (Mirai)", "value": "d0c697ffb7adbc3dfc589ced3ddc7c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168282, "uuid": "d454c785-fea4-482c-81b3-42d3649ec5f4", "comment": "Malware payload (Mirai)", "value": "bf11aeacf1715eaceeb88b2500a2eb3b26a9f6750b34a706c5e046e852ea17d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168282, "uuid": "5a5f8087-881f-469b-be13-37abc003e0d3", "comment": "Malware payload (Mirai)", "value": "72d7b1a382e6692942af61b5e65f9858cb31167f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168282, "uuid": "70dba3c1-a37d-432d-a001-21c77752bb1d", "comment": "Malware payload (Mirai)", "value": "52140a62d0db1ec95cdd68ceadbfbc19c16df90b49b2d239db779b57b7bc9cccb15320f3ea36e80d51df9c98ca9b0c49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168282, "uuid": "d10e0836-c068-4a50-bbba-42296689ee72", "value": "T155D2D0B91F0747DADE9AC8B5C3E423A01A351E12A902FD4BB4D8D7435B674C4A147ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168282, "uuid": "16289695-36ed-491a-a6d9-c882ff69c7b9", "value": "768:yxMWBhAHuLegF1aF4NscfOl8liVG2bSgJgGlzDpbuR1Jq:yxdBGuLea19acfjliQ2GgVJuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168282, "uuid": "96bcfc55-c327-4390-bd3f-5cf854e8f76f", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168282, "uuid": "c4c1981e-52d2-4229-81b8-a4447785adad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168282, "uuid": "9baff873-a4fd-45cb-a424-94080c5906d5", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e7370d-01d6-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770215734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215734, "uuid": "364c2746-5dad-418f-b64f-50d50c9be36a", "comment": "Malware payload (PureLogsStealer)", "value": "f70b4b972004ca8022fee4a3d5db187e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215734, "uuid": "b220d02d-c6ed-4704-92a3-edb2e93a3691", "comment": "Malware payload (PureLogsStealer)", "value": "c07cc41e7acf586cc74eb81b717be75d7881264e755815da2eee07d9294bcdbb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215734, "uuid": "31b5fc9f-2b57-42de-8c52-df308a16b42a", "comment": "Malware payload (PureLogsStealer)", "value": "1ce1a5851760cc44a85fd41fc6f385123875d08e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770215734, "uuid": "267d6dcb-1b02-4ac6-ad49-6ad6fb26aec5", "comment": "Malware payload (PureLogsStealer)", "value": "9f86a7926943cc6bd91d8a5af3d1edf67db245bf497698000a6fbb3bb00ba0584269511d4485d62db0f394e5b68380aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215734, "uuid": "4861dbc2-2762-4db0-8294-2e41e8045167", "value": "T18AD6022D11AF15C4001E08989679974E5C3CA8AEADE3EB3EF5A3F7DD9440F4C3196B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215734, "uuid": "82376fe2-5ec0-421e-88e1-7395b68f7938", "value": "24576:YssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssZ:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770215734, "uuid": "525cfa1a-f6e8-46a0-8ffa-88ffe982fed6", "value": 12743380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770215734, "uuid": "5ebbe9c2-a24d-470e-a60c-4b4e68311006", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770215734, "uuid": "b574cde4-2fc6-4b73-a138-58243b9038be", "value": "Pending-invoicependingformapayment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb050f9-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168046, "uuid": "ebb27084-695b-4d78-a25b-4fb602d0180f", "comment": "Malware payload (Mirai)", "value": "f3cf07f5e9c000a3cd533bdbc5ed0411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168046, "uuid": "48c355ac-738b-4ec9-862e-435cf8157c7e", "comment": "Malware payload (Mirai)", "value": "c09dc48fdf7f5ba306a282cd32efa868bf4a2db8ba01d67a4a3731771a42cc78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168046, "uuid": "45fd52c5-dbeb-46fb-a2e5-578e8e035e74", "comment": "Malware payload (Mirai)", "value": "e37a60eafc69a22bdbd2b81550c23f111e6648e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168046, "uuid": "8c56f8f0-315a-4025-ad35-23de017de239", "comment": "Malware payload (Mirai)", "value": "41ceb68134bc3c24b7115d32f89a7aa88b1a1b160261b3f7db0a97a7b66cbc4c169b8fa37a69865b0e024b6791e980fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168046, "uuid": "e3112230-93f1-4949-90db-0529b44b0ced", "value": "T17CC2E0F63E77399BDA25003D3899CE3386B5E052D76EA613A240524920071BDB7729DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168046, "uuid": "87041499-87c0-4a76-bab6-185d1f010625", "value": "768:HMwoDZLFbBy6HQHRYfeAxdd8gY0OVOD0Ng:HolcYfe6KXLO46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168046, "uuid": "009be9aa-e464-410d-b454-b2830a033ec9", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168046, "uuid": "2fb33432-5a25-41fe-92d2-5a3ee172cfdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168046, "uuid": "9732fa22-6f86-4386-9ae4-2856a0f56b89", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1ca5d8-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770201093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201093, "uuid": "5775588b-44b7-4a61-909d-6501e30a20fe", "comment": "Malware payload (PhantomStealer)", "value": "e3db684c7e87dd0ea46c7207bbcd84d9", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201093, "uuid": "3068e5a8-1490-4da2-a8ff-8337f4b3e0de", "comment": "Malware payload (PhantomStealer)", "value": "c0b1fa407b6f1c7a2c0636febc35adf5494f887dd5001be9bd5fab0870ad2ecd", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201093, "uuid": "80a15de4-80d8-49c5-9c5a-4de7f16f1e16", "comment": "Malware payload (PhantomStealer)", "value": "b1c9a334b89d1c48e92d0dfb553e81ab4305f9c0", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770201093, "uuid": "9128ee57-8891-4520-8b30-9eac0dc36aa5", "comment": "Malware payload (PhantomStealer)", "value": "24916593822d1bab63b0a20419cc1e2c8f0f1e87941012da0acac9c740b6882fdf8e7ca31a1b4385356501959235097d", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201093, "uuid": "c324a5b2-5e7c-424c-80b3-f4a9e00a8f21", "value": "T11A061100D962DEA4065C912424AA1E8A25510EBB0C583B793F9F5F9E1F9F20FD0797FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201093, "uuid": "c1ef03d9-f91a-41c5-84bc-ada2b5952085", "value": "49152:Hi+wnr/Z9fvKP07wqth2hGCN9o2Fby4eZ1zAA/QMOPL:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770201093, "uuid": "c16e2a58-6f55-4fba-bd47-0784d876cc8b", "value": 3730033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770201093, "uuid": "bbaa70ee-3944-4fa6-be81-6069fee56944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770201093, "uuid": "1dc307cf-303c-4174-86ed-1c95b439dd56", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a40633-015d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163471, "uuid": "5cebfc1c-9940-4810-b93f-2301ce9c9b99", "comment": "Malware payload (Mirai)", "value": "b5e4e5541acb161736db23c59c9ebc8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163471, "uuid": "e654197b-c4ca-4057-b5cd-bfe5fe2bd3b9", "comment": "Malware payload (Mirai)", "value": "c0e25664dc758e549539967aca50a0d9e1d6d5c738f9a1aba6b9ab14b010eb64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163471, "uuid": "b18477cc-1fd8-4d72-b7e4-822bd57c0942", "comment": "Malware payload (Mirai)", "value": "9c65a50b3b9cc1e236a846d3d6070bbbbbf1f40d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163471, "uuid": "89de24bd-e836-42df-b110-28b169326df7", "comment": "Malware payload (Mirai)", "value": "285259ca4b5c93eb52b0e56398276ea3a29af75c815e23f4cfc6c53b72ea6c91793b0e764d6f0367f6a265d75fc1a9ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163471, "uuid": "56e35e91-22ee-4c72-9f04-933f0e9feac7", "value": "T1D38302B0188A74A2B4015638D5F9D2C2ABDD97ADD2BFB02B8F143318EDD054737BE652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163471, "uuid": "78ed40d8-4f8e-405d-8461-6ff315a4e731", "value": "1536:2WpZ5x53RTisw3AJfFeMZNluE87ToaM6y2XIN6A9HNh0nJ0n3:ZtRTisCAJfgMlN87m65I3BN4O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163471, "uuid": "ec20ce31-ad19-4fd4-a1cd-450657f48b94", "value": 81756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163471, "uuid": "a705ca84-9051-43ca-b1d4-4f30df47233c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163471, "uuid": "3b261825-3ddd-499a-a7b1-184a79806212", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbfc93a-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236608, "uuid": "869b439f-9e20-46a3-86e1-951371b162ef", "comment": "Malware payload (Mirai)", "value": "d795f3c83342377083837dbfd0484045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236608, "uuid": "a52e70e2-d462-4c80-880c-629f32f18567", "comment": "Malware payload (Mirai)", "value": "c261ad575f1c2eb0ef43c4c03b2e0837738626519bdedd405863d55838961131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236608, "uuid": "520bdef9-ba70-44f2-b42f-c7281733d254", "comment": "Malware payload (Mirai)", "value": "89383ffb94926f6d7989166ad52f51f7f32cc358", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236608, "uuid": "fbcfcb9f-30c6-4501-afdd-707a5aedb4a7", "comment": "Malware payload (Mirai)", "value": "6afd5ffa4fe533937c9814c346d608aa23e0f9187f3efe2072209128c23036617fab32a21266b8452c9a6c22cf0ec880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236608, "uuid": "a33e27ee-e939-4613-8cb2-8eb17cc188ce", "value": "T138C3E706BF114FF7D8ABCD7346FA070529CCB82A15BA2B357534EC68B24B1DA16D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236608, "uuid": "7f3dc9f4-ec79-4aae-8ad2-e33bc0c6948a", "value": "1536:Vp6/zq40RhVOXTzaX6dt+WRGStRsM3C/DE2ctcZusVYRZ2x7XzjpAqVE:f6bq40RhVOX6w+C38DtctctHDVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236608, "uuid": "00390619-d221-4b45-9f5f-d34ec628b071", "value": 122440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236608, "uuid": "3258af12-4f42-44da-be60-56b0f3620fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236608, "uuid": "b71d3062-a12a-4cf5-8ae6-27629affad44", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b73dd3-01c3-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770207339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207339, "uuid": "bc0193fb-d2a6-47b2-adf3-4f5cb1a9038a", "comment": "Malware payload (AsyncRAT)", "value": "81164b9cafbfd7a58091069c57a7dd7b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207339, "uuid": "e3c83d2b-7e04-4395-a3a3-90b0bfe6e3a8", "comment": "Malware payload (AsyncRAT)", "value": "c3c124bda96e655479b230254d4e6c827f0297c35e9c8023395e3b9240e59966", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207339, "uuid": "0581f40e-5ce2-4537-8ce6-6cb5325ee823", "comment": "Malware payload (AsyncRAT)", "value": "2a36f612a07e71afbce10d8a96a4e7ff23f85ef2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770207339, "uuid": "05914404-1bcf-4e21-a6bf-114b8d767d1a", "comment": "Malware payload (AsyncRAT)", "value": "a40c093b66d2194b68070c4d6f5af150b5d2756c3ce5e2e59ef84ec362190d115d153bc485536e61ec012534c0c2f853", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207339, "uuid": "1ab50520-070f-4601-b8e3-8400a39d2de1", "value": "T1D1E3E51777998017E0AB5A704BB3A162C3EDEDD25801B4FB2CCF2A7A153F97089406BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207339, "uuid": "04a7bfea-7af1-4942-8f6a-b8c27f1cba03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207339, "uuid": "9d10ebfe-6b3c-47f1-9349-403cbc0fa9a0", "value": "1536:IhajjazM6qutEZdhvxVBDdbnYx0Z26PjzOLINsVdZchN1dHBsv03tneJxH:IAazeuGRvTbnM0BjzOs+VdZWNdE090H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770207339, "uuid": "02921b27-d58f-40ab-be18-f988d7b8f806", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770207339, "uuid": "0640a50f-e5aa-4717-b70b-4be5b6d4887e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770207339, "uuid": "956fb2db-4efb-4927-9d72-fd93ee4a879f", "value": "SpecMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b140d72-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770200821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200821, "uuid": "2657f23e-5bf7-4f73-a302-05e836667864", "comment": "Malware payload (AsyncRAT)", "value": "7a7312f1677bf2747cdd3be62d92fead", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200821, "uuid": "b1f42c25-d568-4590-9e96-14631fae1ed0", "comment": "Malware payload (AsyncRAT)", "value": "c3c465c8670333252fe74404324a72ddf5f151b13c1fcb219beb4e88da4926b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200821, "uuid": "bf672cd1-6fe3-4de1-83f9-a11bd7d43979", "comment": "Malware payload (AsyncRAT)", "value": "9829b856b1e8c821656e001b70e8ac2791debbd1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200821, "uuid": "87fbd36a-353e-4e78-a387-14a056093d30", "comment": "Malware payload (AsyncRAT)", "value": "c5525183e303faee06384a0c06d577d4fd1a563699c795e16172e2caceca9ffd3a4f2678d80aee959c4a73c6f9db9708", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200821, "uuid": "810fcb3e-9d23-4829-82f0-6ad3536ce592", "value": "T1FCD623E9488562F4D4EB4A107087539F78C126AE45FC6C0A39D1BE521F42EFE254EFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200821, "uuid": "97a871f6-1f55-4dbc-8e42-8d2b53f3653b", "value": "3237d9e15219482b63b98258b9769406", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200821, "uuid": "e893ce6b-109e-45ab-9ba4-b47b4079e1a7", "value": "196608:EPqjE661jnlYk2ptDP0U2QXk3kxoYNb2AHf9cOV9ud4NqGuoU:I3nYkw5P0NC0kJqA/BjMqru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200821, "uuid": "3c413baa-e401-413e-902d-41f7aef090fd", "value": 12835840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200821, "uuid": "4f7a7564-9dea-4fcd-8fa5-1125d0fdf51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200821, "uuid": "b25bd760-c945-4d04-8398-470e4a4f2bbf", "value": "free.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ee649c-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770176512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176512, "uuid": "289d2185-f294-45cd-9542-8ce56bdff8f8", "comment": "Malware payload (Mirai)", "value": "18247098b19e60d8dad67662ba49cd27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176512, "uuid": "665d59e1-00a1-4282-be26-f5b6db5f7ec8", "comment": "Malware payload (Mirai)", "value": "c3ea0f9377f4a0e987491449ab83820c316cdd268f64af8bbde4f8dd6ec8317d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176512, "uuid": "51b9ea1b-b499-4b5b-9455-b7dbca78d1ab", "comment": "Malware payload (Mirai)", "value": "22526c889f8f448bbe4afdf53fa5d6d10c91c408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176512, "uuid": "90985b8a-4a4d-4777-a559-2d97f1647b55", "comment": "Malware payload (Mirai)", "value": "bd1d631c44166e6243312e6bfea8e48f4eefd240d4c5494254e459adca3117a920fc9572400035b6edf27046bac8fda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176512, "uuid": "75b0141c-a0e7-4cff-86a0-024284f77579", "value": "T175D3E078F4D0DF72DAD12A3AF65D1119331307B8D2EA33169F245E2837A729B4E26E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176512, "uuid": "2401a8e1-e288-4afe-8787-7dee396ffc2c", "value": "3072:foTTImvmBw6D+Vqtax+oYhbXXF0uUFnTi6bzcCHhPL5kS:fgIwWwRxXyXajhWqNBPFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176512, "uuid": "d854b1d0-d1c2-4114-ad52-7aebc995931a", "value": 142184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176512, "uuid": "c0a5811e-2b3e-499d-9ef9-67f11583b191", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176512, "uuid": "8510b9e1-ef46-4b49-9dbb-409a2d2590c0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94241f46-01ee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770225962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225962, "uuid": "120f8baf-fbe3-49ce-844e-1c4f2034047c", "comment": "Malware payload", "value": "d95309d3a7eca431577dac5dfa9ea4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225962, "uuid": "b2ef9db2-1345-4082-82ac-08ff6083c24a", "comment": "Malware payload", "value": "c607c57c6bcb7a991671e9d51c132d1f0e343d9104bfef8ee29b555e3e555e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225962, "uuid": "0c853811-fc78-4c03-8e17-39c0dcd53cae", "comment": "Malware payload", "value": "8588e95aa4c1fc1a59ea51578a0066b67559e244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770225962, "uuid": "4f679820-1f26-4543-b8f5-896389188b5a", "comment": "Malware payload", "value": "a9015efa3049bde3fc45db433fef5060093d7804620ae10463ba4a45ec9dffba26e6e9a7000dc8fc840f40c4e0e612bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225962, "uuid": "caf88cce-310f-42db-9edc-7222e59973d5", "value": "T137A408257FA58E00D585243ECABE3A09CB52E0F125026343374AF7A15D459DEEE2D3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225962, "uuid": "711c2767-02f8-4c7b-b974-8f3f9004eb48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225962, "uuid": "294a8924-d567-44f7-9a4c-4eb403c6f06b", "value": "6144:6cTB0KmEBDUvrDbw0Ypd066Dc6SMljQY62+zCaf94M0185cr4IdJbjY04dNAYY:jl0KB6vbNUd06Yc6SqQy86Rudy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770225962, "uuid": "1154bc0e-0b8a-4d1d-a0b3-caeacb876113", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770225962, "uuid": "60688a74-9781-42c2-bddc-0f2b121edf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770225962, "uuid": "60207c0a-2601-4728-8218-5d93352cd9e7", "value": "c607c57c6bcb7a991671e9d51c132d1f0e343d9104bfef8ee29b555e3e555e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02f579d-01bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770205930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205930, "uuid": "f286a306-363d-4bca-8a0c-4096fdae0615", "comment": "Malware payload (Vidar)", "value": "7c50064119896f2d964966c678daba99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205930, "uuid": "3a85d260-b901-496b-bc1c-4695bbc57823", "comment": "Malware payload (Vidar)", "value": "c663e87ef92f750a40e4c02c64b4c82556f23bca87db21dbdbac78ea6077c16d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205930, "uuid": "53ec372f-2b1f-4bca-bb15-1a034411763c", "comment": "Malware payload (Vidar)", "value": "f43c1f5cc14e703677fbe10e3b3dd8f62098202d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205930, "uuid": "3aedbabd-b01a-4800-ae15-5e2abf0260b1", "comment": "Malware payload (Vidar)", "value": "c283918f030752c8e5076b1b2fee98dd46bc5d08f480e24363bedcdbc0399fcafec98f018881d9ef7d82afc510b3d050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205930, "uuid": "b3c384ba-2f8a-49c1-a6d9-0656b1438557", "value": "T18FD59F5723E800D8E16E923489B7CA3AE6B27C55037286EF16E84D4F3F33AD55939721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205930, "uuid": "b0690416-e3ff-4580-bc5d-8b8ab7b03094", "value": "bdafb39cfee2e23fe0c8ae87ef4f1ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205930, "uuid": "6e32c904-68d6-4e1d-9a1f-ce6ebf0f6359", "value": "49152:0NvhM6qHJfTJb5lmzSzko22LGywmtGotlpeNjCw6IGUGK0smxFrQvbt64v:flmzSzko2LjCffGYxFrc44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205930, "uuid": "9d58d6c1-94c0-42bd-9937-7c44a2eca647", "value": 2750904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205930, "uuid": "c200e11e-16aa-411c-a57e-90d4cff23f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205930, "uuid": "e43e318d-a989-4a5d-8b79-afdafb0a55a7", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab5a0a7-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770168528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168528, "uuid": "b553022b-2eba-450d-b734-4c9b1c3ec88a", "comment": "Malware payload (Gafgyt)", "value": "fa3db4f3e4ad5e855fcbbf19f462ae68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168528, "uuid": "4faed142-e80a-46f9-854a-a98608974575", "comment": "Malware payload (Gafgyt)", "value": "c66fc17fc6a64e81863d839311d4d530860e501d70a1582aa4ba284ae1e107fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168528, "uuid": "12e1c5f2-70b1-4e79-bf44-a45e043e4431", "comment": "Malware payload (Gafgyt)", "value": "d0ad1621bcfc7da4dbfca9b4ecbe76b507006b04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168528, "uuid": "c38dfefb-d9aa-4781-9aec-4c5e4f90bb4b", "comment": "Malware payload (Gafgyt)", "value": "00dc42ccbf28af413fe03b0ddaab01296c4c70396bd78e8249b3752aa94d9c5d11e4a27c072221487cb5d4abe84a0aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168528, "uuid": "1db56fc7-5505-4006-bcf2-e51664d52faf", "value": "T1CFC32801F9014767C2E327B6F79E479C3B351694A7D733116A38BEB42BC57892E3A620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168528, "uuid": "ab252892-351d-46c6-893f-fe2dbb084ec8", "value": "3072:/64ERp5VvwM8xSSJPb6WVecExaxmdzjQPbkWpequO:iRp5VvmsSJPb6KE8mdzjQPb/pequO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168528, "uuid": "fc55a791-4d86-4dd3-a03c-1cfb7b1b2225", "value": 122049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168528, "uuid": "b353f0fc-5644-4006-b02b-fb051e1aa4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168528, "uuid": "3d1d8d9a-05c1-4422-ba58-f7be346159a3", "value": "pXdN91.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca17a38d-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770192981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192981, "uuid": "5ca6c2cf-23d3-4598-b190-b68da9e9acc8", "comment": "Malware payload (PhantomStealer)", "value": "75a5a6a67f8b999d378e01f2279a6a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192981, "uuid": "76de0bf8-9ed9-4029-b269-3ea7c320100d", "comment": "Malware payload (PhantomStealer)", "value": "c6ae803a939ceb15eb048bbc3460c176bc41a7f4a6c951429a0263ee78254763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192981, "uuid": "c09d9469-a274-46a9-8e5b-f052f8e2887d", "comment": "Malware payload (PhantomStealer)", "value": "097960346b0a84c665773c52dd24071e1a474cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192981, "uuid": "74e7ce19-9d01-4259-9bd6-00bdf77de1bb", "comment": "Malware payload (PhantomStealer)", "value": "ca0fe3eb544162935563c3371a98c210dfc6edfc78ef29c9017bec51bd2f2a1e6a5a0d4b8d66653285f7e804ab9738c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192981, "uuid": "cfdf6c26-4afd-48aa-8e02-c04f63392a9f", "value": "T16943F8027B874351E419207B80EF056403F2B7A36777EB773E5C62BD4A523926E85F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192981, "uuid": "2c1ffa67-b6db-41de-9840-f4c00647bcd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192981, "uuid": "cf505492-0a3d-43d2-8059-86101b96a2df", "value": "768:iMr3DxZqxy4GnvYdWkFTNk3VGIe0M8giSSnoDNgR+JgyqZAD+22GK2GMF:LRZqxWQWkFQc0giSSO8CgyqW2GhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192981, "uuid": "ca7d3edb-6bc7-4c0c-8540-0d0fcc226ff3", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192981, "uuid": "5d69b6cc-730a-492e-869d-f23916242d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192981, "uuid": "1e9447af-dc60-45dc-9d3f-e1949fc18550", "value": "Nuevo orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5aca0e-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164316, "uuid": "55a63093-2db2-49ac-a47e-590e2ecf2e58", "comment": "Malware payload (Mirai)", "value": "52e93d6ec16d49012741ac57166010e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164316, "uuid": "6cf016eb-a1a7-4d1e-8bae-4c521e114800", "comment": "Malware payload (Mirai)", "value": "c6d5c52ed5ffe7a60d22f1f61e5c71a7726392372ce197b1dca5e857f61161fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164316, "uuid": "2641a8bf-4fe3-4f61-bc0d-1ba84677737c", "comment": "Malware payload (Mirai)", "value": "c9d775fdddc5e7ba16ad03fc4f946e6da5bf4fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164316, "uuid": "5d2af216-ddaf-42f7-aa3b-0c0333b6dc15", "comment": "Malware payload (Mirai)", "value": "75b341ca16138eb8cbf9a9d0f960d6bbd949b8b2cebe6a21925cc0aaa6eff9a6a405c846a21d355f27ef65f6942d4ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164316, "uuid": "0ad004b9-2b56-4c20-84ae-0ea0db5cf93d", "value": "T1B5E3A51ABB619EB7DC1FCE7309AA4611108DE19612E97B6FB2B0C65CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164316, "uuid": "5349da42-9ad2-494a-910b-fa0389dc0195", "value": "1536:UWXeTf1KkCv/pEjywW+5MAdZZsQPdR8a7YTVIYDhNUkkmksmcpiB6RGHBZO:UWOKkCu5VdFz7s9Xkmk3cpiBAGHBZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164316, "uuid": "9c58e230-894d-4df7-9829-dca15b995174", "value": 143954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164316, "uuid": "c3dbe63d-3586-4d2b-8d53-d9babc80d2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164316, "uuid": "456f9f99-e067-45a1-86f1-438a9bc67320", "value": "pXdN91.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52fecac-01b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770202851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202851, "uuid": "a653c795-5714-4b00-9db3-f04d217eefd5", "comment": "Malware payload", "value": "d21c52863b83406f61bd45c38a45cad7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202851, "uuid": "fe22c221-7402-4788-b0e3-3bb85140c6d2", "comment": "Malware payload", "value": "c7147c5335f7c0c7221243d3d7e566eded3aa8b275331f3042df1155433b7bc9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202851, "uuid": "d0c99ca8-2a02-4c6c-b769-debb36bb9898", "comment": "Malware payload", "value": "52f53308693ce114ad3ea50b82288d72f8498d84", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770202851, "uuid": "87a665f7-6c27-45e9-bb2f-a8c7af92783c", "comment": "Malware payload", "value": "be081620e557cc530c8ec62b11af6bd66b5b2c3aefe248583a1069f5dea0f5aaa3b3d6b334339b0c8ac1b9a80f234512", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202851, "uuid": "05e5fd82-db76-42fa-8257-e24818cf67f7", "value": "T1ECE4B687F1208AC7F84FDABF145042106EF0E4704A07F2561B6E895A2FEB9CC9E557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202851, "uuid": "6bf8834b-2c26-40dc-a1d7-c20c4790e620", "value": "6144:S1eMX5Uh/W94gpr2TMPjhMoQO7ZOet8BPejKQ6EbfBE74vUsPvAE/1up3x1Zgr:StOnQ1LT3/1AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770202851, "uuid": "491d0a86-ae5f-4a14-9c1e-0b17184824c3", "value": 689113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770202851, "uuid": "23a2b10c-e92e-462a-9655-f92f2922302f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770202851, "uuid": "559d8435-02ad-410a-92fc-5d620bcea69c", "value": "2026.Donutsmp.dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaba87c-01c6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770208746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208746, "uuid": "fa6cfd1d-4bfa-4f52-90f9-4847a824c3da", "comment": "Malware payload", "value": "eff7ead880c6efb52425b77a9601babe", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208746, "uuid": "084b3c2f-ddb7-4bbc-99f1-4a9abd7a42c6", "comment": "Malware payload", "value": "c759e9d24a0ab4ddd73317ffa466d93ced1f6a8699e75dc1dd59f72c0a957aa2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208746, "uuid": "aee48306-5c41-4483-b30b-3d2805a8ac16", "comment": "Malware payload", "value": "ce1ce1ebe6311b25869e83f9702d6265aa49ea79", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208746, "uuid": "3cb84c74-4e59-4b60-9797-187419a1473d", "comment": "Malware payload", "value": "03500df7dc91ce16bd610c54abcb9a9b21fb7fadfd994d150f8b3965f09fd8a16166b6981c7f175bfe652a14b7d559b6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208746, "uuid": "434c4b3e-292c-4172-92ba-d27b5b88406c", "value": "T16253CF73065CD9980618D83D70A4A51B3591B7ECD8DE330449C3EEB2BBE96C392D99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208746, "uuid": "be563d37-13cd-4d93-b70c-c6d7fffbf9ff", "value": "1536:vJfmWG67ZAO72NEsu6bh/rmAwVHS3nz1/b1/U5:B+WGmuO72SGh/iA/b1/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770208746, "uuid": "13e33dd9-b393-4f2b-84b5-ebac711b7e2b", "value": 61380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770208746, "uuid": "d9af7d93-c601-4093-931b-0ed01dd5ad0d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208746, "uuid": "2aa5e05f-1008-4677-95f6-3941de17ed80", "value": "5_18_9_1328_03.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16182411-01cb-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770210718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210718, "uuid": "b3da9bb6-ffc0-428c-9526-f06a30682b4a", "comment": "Malware payload (Socks5Systemz)", "value": "1c07d3d3fd5a38248eeb813a123eaa73", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210718, "uuid": "9d476932-3517-4f2c-82a9-22bd9efdb475", "comment": "Malware payload (Socks5Systemz)", "value": "c84f422d800d72f9efeb30e50e72383ec2a7f2bf090c34d4614983e2287b101f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210718, "uuid": "3ad8e2ab-342d-4d9f-9197-5f5b8fa312a8", "comment": "Malware payload (Socks5Systemz)", "value": "ff541a80e32f030a0b9721958bef49d1ce2a0524", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210718, "uuid": "4b358940-8150-46e6-ac59-3652aec6a8bc", "comment": "Malware payload (Socks5Systemz)", "value": "fa9ce8646f14588e960d5ead49085c2e06db93cd9185c90ef6fbb638e229cab431d64c3ad43b927e9fcc6b2a7f6fff1d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210718, "uuid": "3c51b9b1-b696-4324-8113-ac5dc0c225a8", "value": "T1E7B52247A9D961A0C5F29E3181FAC7128773FCF02FCA065B51887E650853AC8ED3676E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210718, "uuid": "ef490eb7-68f0-4760-a0f8-5c66dec6e7ce", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210718, "uuid": "52da1ed5-d5fd-42eb-830c-5a9fbbd18d5d", "value": "49152:aQkIvOFACzqaMvFz0I72AXHNARFQiZyZeaVMyiKaNF82XXajrz:VcFJeb9b2/Qrel/KaD82a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210718, "uuid": "e148a769-9d54-4b99-8d82-aa9825361a46", "value": 2296320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210718, "uuid": "295c27db-e73d-4f22-a868-823b4bd848fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210718, "uuid": "aa1232cc-e12d-47c5-9751-3c72577da1f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1aa9c9-01d1-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770213686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770213686, "uuid": "3abebe17-3ffe-48a5-b048-d132d1d3600a", "comment": "Malware payload (VIPKeylogger)", "value": "56f1132a6610fad86371ed0574f5d6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770213686, "uuid": "0a578813-578d-400d-80a9-9baa0ef65a86", "comment": "Malware payload (VIPKeylogger)", "value": "c890ac9696d1c6e2469d18e24bbb8b32b0cfe63e14ad0d23ecd2a2bb2a10d071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770213686, "uuid": "de2d15e0-2072-4888-990e-7ffda2152cac", "comment": "Malware payload (VIPKeylogger)", "value": "a4437f5661ec50e649f558f72a0d2569b138e75e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770213686, "uuid": "0aa7bd7a-90b1-4afd-9281-e94c677f28fd", "comment": "Malware payload (VIPKeylogger)", "value": "79073d37d1935151acc80d157dce4373440644c915d93c317c63e303b5247ebc8c006de6294f758bf1348ae9cbb529aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770213686, "uuid": "94a4ccf0-b669-4fce-8e90-5e025d8e62e1", "value": "T1696422A0EB4F1BA7F948293913F3A730CDE305B34D4298C983D4A05B6D14AD5467BCC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770213686, "uuid": "db471325-9bc2-486a-af20-e069642de9e9", "value": "b3268c6695493109f8e62e5bec097245", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770213686, "uuid": "b7538b6d-ce5c-4d36-8092-b9cb9f1805fe", "value": "6144:rhqmX4zebJfWFoyFtj3/pDocvdauZH6eMG+xgWUTgQkp9+OSPg5yPmFXkvU7Dwsu:rQmIi9fWNTxPaKH6eMG+rUkQksoggD8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770213686, "uuid": "c9f6e0be-15c6-4f25-b066-1154f55fb9df", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770213686, "uuid": "24f5c905-573f-423b-ac50-6eb89ac86338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770213686, "uuid": "6439182e-b2d3-4eb1-a7a0-04ce5396194b", "value": "PUCHASR ORDER - 4551194455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d467db9-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770176505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176505, "uuid": "f4c9e4ad-b4a8-46b0-855f-81048c63b1ba", "comment": "Malware payload (Mirai)", "value": "6f7170095c0dfb3466a7a1c7491ab8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176505, "uuid": "5d32352a-a47a-4143-a2d4-977e0cb2cdc1", "comment": "Malware payload (Mirai)", "value": "c8c5416250d1679d209a3b17101e0dcb0c9a25dff0340af3e1326b60a35f4e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176505, "uuid": "6c43fb06-9446-464e-b86c-6ed3ac756602", "comment": "Malware payload (Mirai)", "value": "acc3b09552d2a4cdd3edf24272df322f81e2e73f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176505, "uuid": "2d2d1933-8696-42d6-a3e1-dbd36772350f", "comment": "Malware payload (Mirai)", "value": "96ba99bf5f0a1d25da0bed0a4e651b8ebc9277bb4aa557a163c99a56d4d734842f865adcb03db6808ba8cbba10601ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176505, "uuid": "073b4b8a-3dc2-4aa8-8770-a86e2cc9e0d8", "value": "T187040250FF0C5023E4979EB9267F1BB5A7A409A61CBBD22C2B04B7A216F32374547BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176505, "uuid": "4fb89fe4-53c5-4f5c-afda-ea325bf0f08a", "value": "3072:ozdurayQy5HEcMf3oNtpp00TP4+BWR8BXGsGv4b7SM3Vee2n+HUx0Wvu:ozdurafekcMw1p00TGRMGsSI7SM3Vk+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176505, "uuid": "f8ab3cc9-c54a-4a32-8551-76ed5e7f883e", "value": 186166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176505, "uuid": "42fd4ea7-a85a-4b21-8169-5c3d305a9bff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176505, "uuid": "d17c95f2-9d8f-4c56-ba20-c4f869ea512d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6297b8b4-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168326, "uuid": "9be9e13e-34eb-4321-b640-26a036fb4e72", "comment": "Malware payload (Mirai)", "value": "2dfa8790613c12c18b1360783b5d7588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168326, "uuid": "55ced7ce-dfec-4c80-8587-9b804692c3fc", "comment": "Malware payload (Mirai)", "value": "c99e9349857c479450ef715d3453276858dab3cafb2dd1e88ba74e3919458c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168326, "uuid": "8d1369de-a547-47df-a353-170f46149d42", "comment": "Malware payload (Mirai)", "value": "e53814c4df634e55b810d956b719e70b84cf6c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168326, "uuid": "9d8d78a7-1ff7-438d-a1ae-991c6852c9df", "comment": "Malware payload (Mirai)", "value": "7d0b31eeb9f9de7c172cfbd4e1f510a543279f99b4fb2d3733fdf4643c92d4bba8ae4eae5b72bd0a7c89846c89325b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168326, "uuid": "8bc8d70c-0066-499b-8d42-53683cdb3380", "value": "T1D283D60ABB604EF7ECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168326, "uuid": "4013c454-227f-4f86-a7ff-fad8b8dedea1", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168326, "uuid": "d95a2431-9365-4f67-ba3e-9fdd9dd9d3cb", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168326, "uuid": "967e4ac4-9bec-42f8-b4e7-d15cd0b1b7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168326, "uuid": "6ad8d0f4-7267-418d-86d0-83763cd46308", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8cf398-0163-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770166357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166357, "uuid": "fe2892f0-bdb8-4beb-96b9-22b1cef77a1d", "comment": "Malware payload (Mirai)", "value": "1096a5b78a73f0bd7bfe7d752c6a2799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166357, "uuid": "2d4ef5e7-20fe-4fd4-a068-546bc6c73456", "comment": "Malware payload (Mirai)", "value": "ca420d0cf1235b5cecc53eb095aa2dfcfcf5eb861b33c264d0cd1e0a3ff8c538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166357, "uuid": "fc8f752c-733b-4ef8-a494-31d0017b2375", "comment": "Malware payload (Mirai)", "value": "ac948ad21f271d34cea86ef747281e1d5ae2a8de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166357, "uuid": "2a4f26fd-fc59-49f8-82e4-edd947cc90d4", "comment": "Malware payload (Mirai)", "value": "31243eff03868396f2667978a7fecfdfd6b3b7ae9c0e3d41755e2e6a4c427846e9fa8d290d01ae321cbd4982cb4188be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166357, "uuid": "56bfb795-0b8d-4f21-a1af-830e86b4cff2", "value": "T1236307DA7CC5C602C5F061B2BB1F61CE375643A8E3E6B157CD19AB29634F8970A37212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166357, "uuid": "8a0a6f5d-fc83-4f36-84df-7b5288771550", "value": "768:qR8TFRwTVrK1xgs12toyWAIffZm4G1h/2RmpT5eOilg+6cy+WTUGAMdovfhDaxZV:FRreincJMiNie4P1gP4oACkT5f13x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770166357, "uuid": "67177b32-2cee-4155-b90c-90c7f27acfc8", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770166357, "uuid": "883d4177-87e8-4c37-a4d9-33c044332085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166357, "uuid": "bb693dbf-6ef5-46dc-9c6f-8b9b351433a0", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eb9281-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189971, "uuid": "b916c901-1ab4-451c-a1fa-2f36c155b77a", "comment": "Malware payload (Mirai)", "value": "1eea7cc07cc70c099b41a8e9747b81c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189971, "uuid": "d74d4caf-a877-4e7b-ba9d-c01152ea6665", "comment": "Malware payload (Mirai)", "value": "ca990677f4d806eab84ace0ae3a1e4c0c10173dd7722314b9074effb64236925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189971, "uuid": "2e0a4171-74a1-4973-9469-a1e49588694a", "comment": "Malware payload (Mirai)", "value": "d29a82974ab24ff0d1a2fa63bf2513b77ca22871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189971, "uuid": "8c89ba16-a79d-4f92-8129-f3d96f8e609f", "comment": "Malware payload (Mirai)", "value": "e403d3c201bbf523c8ec4d93e0be1406304d798119bfe7d219d3d93a7973eb159950a798836f00927f210e2430d2ade4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189971, "uuid": "e13f0346-ea6f-4124-8fcf-d20e9177157a", "value": "T16DE35D86EA408A13C4C61776FAAF414D33229759E3EB73068D185FF43FC6A5E0E27646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189971, "uuid": "da404c76-9e4b-4124-89ff-e2d92982d768", "value": "3072:J5tQmxVagaEWnPmOYqpwVJJjoSWQcfhcwUfOJquM/9Lvr8l:TvxVwEWPT6JjoSWQuhUfOIuM/9Lvr8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189971, "uuid": "3d3d778f-21fa-43e0-bb06-874a8321cdd4", "value": 157015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189971, "uuid": "549de8e0-d8a1-4bab-8f93-ca67799fbdea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189971, "uuid": "9bf2bd3e-a595-4029-ba59-e11f29ea7766", "value": "nullnet_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd1cc3d-01a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770193175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193175, "uuid": "862b13f2-2b1b-4e34-840b-8eb0ea7341dd", "comment": "Malware payload", "value": "ca61edd1cae3c9d0fb644aaa97a2d79c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193175, "uuid": "ae71cd66-a899-4648-a4d2-c5c24bb5995c", "comment": "Malware payload", "value": "cbb7f106983ada5701c04030611df1e59ef7cb5431613d4d9c852a19af3d3bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193175, "uuid": "8f9d1cca-3329-49b7-be82-46ec18ae06f9", "comment": "Malware payload", "value": "b8be3cc8091e3eeedcee97f0a9284696bdeeea3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770193175, "uuid": "36cac63f-de9a-4cb1-af35-0b7a266f4801", "comment": "Malware payload", "value": "aabe9dcfc9e63974065242cc0473191ca1936dfc25b062092704becc785d3b929d4fd5a6f936e591bfd5f17670f669c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193175, "uuid": "35bd1754-9ee9-4574-84de-d59f92cc2d82", "value": "T1B596332F6C785BEFFA0E62339150762E57D263235BFB3368DB32258B15F90150BA2245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193175, "uuid": "76dc66ed-8349-4bcd-a765-eb2a5d88f735", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193175, "uuid": "0665c22c-8141-45f9-8b1e-754041b61c37", "value": "196608:Xotj58MeDADXlIu2WqCpNiIN7ZMLWbSz/+46x2AVDsnED+U0cN:YtN8MlxRqClaWbk/p6JJs1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770193175, "uuid": "3baa1a4e-6f0e-4858-bb74-3b73dbc4dd35", "value": 8834968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770193175, "uuid": "c93f996f-bd7d-46de-8447-707df73eb607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770193175, "uuid": "95539fb8-685b-4d7f-a862-6fb62afea670", "value": "SecuriteInfo.com.Trojan.BankBot.2579.19114.21773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5886495c-01e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770221567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221567, "uuid": "a99a3484-80e1-4e07-bb18-b62979647a06", "comment": "Malware payload", "value": "658e4c868df70c7d65114b3c065de2d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221567, "uuid": "f9d3b008-aab4-4a36-870a-793fc768cb67", "comment": "Malware payload", "value": "cda9a6718da4c9cfdcc73340594d62b24e9439b51c2fa4a7f147802fd184b569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221567, "uuid": "90afc11e-e8a5-4ea1-b383-a436479bf05c", "comment": "Malware payload", "value": "a04c3a05ae104ae7d30cff245f842361cea43dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770221567, "uuid": "c72aaff4-7566-428c-85ed-820d338bdb5b", "comment": "Malware payload", "value": "a13ff19e4e5ea3c7f2cab92854aec80aa5c207de0acd95fd63bb7e00f0507cc4f7af8a391d8a14b4f2e6c4592b364f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221567, "uuid": "4dcb8079-4e92-4152-80f9-e19e7a22c2df", "value": "T1B1269E29E9B9D1C7FCD300B17B699211A823AE7BDD2C156750B8970CD249DEE033A17B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221567, "uuid": "1b8d25e3-b3f9-4e20-acb5-600de243a742", "value": "bbe72e2bf13858c5503f70bc0fd94b15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221567, "uuid": "89d8373f-8475-4e3d-b79a-00a034462a11", "value": "49152:SwYD1IOgIA/IQR99dQ2Vi0KD23ZmXFzNdBm9ZK3E65UKPJ:ShIRZ/Iodn40KDggz5SK081P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770221567, "uuid": "c4d2430f-052b-4031-97ec-d7504703e3a5", "value": 4552704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770221567, "uuid": "48066271-3137-4f48-87eb-3d5f224ea505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770221567, "uuid": "a51b8f50-13e7-4c94-bc30-e9ecee1afa62", "value": "Moon_Over.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1339fd-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189980, "uuid": "5a546fcb-cceb-49cb-a78e-21ad04015801", "comment": "Malware payload (Mirai)", "value": "af0002e7266ad0ca9e5a42c777358e1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189980, "uuid": "4227c1ea-d9dd-4505-b7ab-f37ea2c7ab57", "comment": "Malware payload (Mirai)", "value": "ce1a04e8dabfc5335d299101ac41ee2b5c31131cf2458419fd650da81d2ef75f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189980, "uuid": "c1c5da61-c71b-44e1-b435-980fb7037973", "comment": "Malware payload (Mirai)", "value": "82f93bff85cfd2acab7172332a52d9a2981b32d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189980, "uuid": "3c1bc7be-cefd-4c47-8e29-388065bcdfc8", "comment": "Malware payload (Mirai)", "value": "3d028482674f9952394555d32c290bfcc97ed27bbefe38f215fd540c97f62345ff737f7853b9728c7f8aa6c3e0e97f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189980, "uuid": "78dba479-cb27-4253-b240-371707fe3b13", "value": "T1F5833925A87A2E17C0D4A13E12F78715F1E6330E14B4CA6D7D7A0F8EFB54680A55B3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189980, "uuid": "90f1a63d-faa4-417b-8f49-c33dfcaf6a76", "value": "1536:xUhFY0ZhMjMOsvlWQVyCzc5kJz0Qq8V+n17mWY18rjE:qlIoOKDykJzvV+n1O8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189980, "uuid": "da8f9868-8b0c-492f-823e-04f4a4804fda", "value": 86664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189980, "uuid": "2ae0f9cc-c33a-4cf5-b109-f0308509ac6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189980, "uuid": "e3de4796-7d2d-424c-9ecb-bb81093e915e", "value": "nullnet_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843ddadd-01ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770198018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198018, "uuid": "ecb74155-d861-4eed-8af1-71cd46f93598", "comment": "Malware payload (Mirai)", "value": "ec9410048131c55c8ec245709b5c7b73", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198018, "uuid": "61d4f868-98e9-402c-8aec-5852cb91ac51", "comment": "Malware payload (Mirai)", "value": "ce7b00159203a5815e590552edb7dee65d2d7b26359c757ff2528deb4eec1bca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198018, "uuid": "b036df95-e0d1-4c1d-bbf1-efc76dab6531", "comment": "Malware payload (Mirai)", "value": "461e7269186317ddd596a377ea005a821d5dcf1b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198018, "uuid": "746a00d1-1b81-44b8-89b7-068123ca1fa7", "comment": "Malware payload (Mirai)", "value": "99b7c0f999409483de1839929969b5198eda65c0451ab9fdf5164999ce2628f6c104e01d10d5a63c0c198e93c255c485", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198018, "uuid": "33bbc167-8bd7-4c8e-b956-0a3b128726f3", "value": "T15121064A0335F904268A8E2C64592EC19BC583E3F26ACEC5B4651F37D58961C6C4DFE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198018, "uuid": "bc646291-904f-4537-89c3-8d91fdd05cfe", "value": "24:MHH3AHd0HBW3BjHBJHmNIx3aHAHC3cK7HFHL3EHOHG3zH5Hwk3EHOHA3ZHTHE3t4:MHH3AH6HBW3BjHBJHd3aHAHC3cmHFHLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198018, "uuid": "19e0ec72-12c0-4452-900f-b54ea76c45cb", "value": 1282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198018, "uuid": "9808ef64-fb8a-47e0-8744-e5973ff61dbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198018, "uuid": "ed3c5eef-50b6-4141-9845-91e9d51cf10d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946094f6-01e7-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770222956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222956, "uuid": "b24c5598-78ea-4560-82c7-3cb22d4bfaeb", "comment": "Malware payload (PureLogsStealer)", "value": "91d6b432202ed8747765630215d3655b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222956, "uuid": "c6d81428-f740-4bac-8b0c-b80b706de6cc", "comment": "Malware payload (PureLogsStealer)", "value": "cf682acee9bde875f8895d47c14aed3cc5c9b4d75c0c014ae4c91b4c41e3d741", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222956, "uuid": "fdbacc8d-12ad-4576-adb0-cde4ec6dfaa6", "comment": "Malware payload (PureLogsStealer)", "value": "a17105b85d22c9da9ad78d0943a50f13a8c15a74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222956, "uuid": "380d109f-17cd-4760-8ad6-c9878611d473", "comment": "Malware payload (PureLogsStealer)", "value": "fcba95790824bce7f818a0d623a3514a8fbd4d550341c709a1994b31a136978aafe13ceb54b5296269a50c846f65db33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222956, "uuid": "a1d942d4-9efb-40ae-bb19-08edf84d1b40", "value": "T1571711A02D5EB46DBA113FCCA702D3E18B3942C72A83616F058AE5FAE85567CD7411B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222956, "uuid": "35d6e7b4-360a-4309-9bdb-8ef88ba46717", "value": "192:FPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQQ:J0S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770222956, "uuid": "6d164e2f-4482-4cf9-9e83-dfb070f0f8ca", "value": 20290553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770222956, "uuid": "e739f756-b5ae-4802-954d-e4ec9bce2498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222956, "uuid": "515957ba-4bab-4f43-b6c7-1d6635b51d8d", "value": "PaymentDueInvoice#ZS8GQZ2B.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806bb68c-01a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770195864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195864, "uuid": "d4ef98d5-b7c0-43b7-9f12-cd0fc0f2873e", "comment": "Malware payload", "value": "77be3242bd88f149ee091d95e65d523b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195864, "uuid": "d098f722-cb54-4364-9082-2be2a5c91daa", "comment": "Malware payload", "value": "cff3a8ff02cf76ad207867ce3c517253f911d3d8fe68fd44d9ff57e19b6ab9fc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195864, "uuid": "9141d23f-b1bb-44db-a17d-b174a09d4568", "comment": "Malware payload", "value": "8d7c6a84db706a9d78ecf483d5ececb5b9fd10df", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195864, "uuid": "313fa037-abeb-450c-b86c-e8ef136b40ea", "comment": "Malware payload", "value": "31166aa2611a52b2f22d07f7cc9d3bf5d89c92954f651dd8eb431f422868870cbd365fe5c153116a9761e9edfe959aea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195864, "uuid": "f7815ba2-b6b6-4f87-a67b-0a01fb0bdd86", "value": "T1A06109215ACBFCBE54D976F8781FA88E091843EB0450B5009B86F91CB8E075533EDAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195864, "uuid": "3be6368a-2d5d-4e58-ab3f-6353aa473c3c", "value": "96:bDOVBuIR3thKafPumSaSnIyG0/Mb5UGwzw56pwctQ:fOz3thKy7SaSna2KotQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195864, "uuid": "1db60c98-ec11-46c2-a1ff-2322cf3aad4d", "value": 3257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195864, "uuid": "27a27e89-7a17-431a-8852-ee2603c1b2bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195864, "uuid": "39261eda-0a54-4a43-9c8b-64f15c5e4cf5", "value": "67867679.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f007a35-015e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163945, "uuid": "eba9acb2-ac7c-4ba6-a64f-05dd65faf50b", "comment": "Malware payload (Mirai)", "value": "03f34c45ffff7ac3736cc7e4ccc85318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163945, "uuid": "9cde7e10-69fc-49d0-b365-9ca1964c57ce", "comment": "Malware payload (Mirai)", "value": "d3cad0469d6d703b83dc72309334d42d9b5e3892393237a9a1c6ca1f418827ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163945, "uuid": "3da71390-b0dc-47cc-ab10-ad625f12dadb", "comment": "Malware payload (Mirai)", "value": "2972a4c8afcd16cda17c1afb2846461f82b0f602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163945, "uuid": "7ccc5eed-6bd4-4ab6-9865-a6391ac41eac", "comment": "Malware payload (Mirai)", "value": "1aa9dbd8ad9f50287484a189a3b197f104a280065db511ef1eaa5c7a42919e6bf5c6d1ae550e3966de4e7841e82116ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163945, "uuid": "2c44a4ad-d864-479d-93d9-c84a3ba25df3", "value": "T18E442A46EA418E13C4D527BAFA9F02453333A768D3EBB2069918AFB4378775E4E77101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163945, "uuid": "2409453c-437a-4cc0-a97f-49992deaf8f2", "value": "6144:skqs7j5fFcKwav1gWda4LIQYK6FOJ5MTwRi3C5/4M/RUyBNaDN:skqItL1gWda4LIQYK60jUu/t/5NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163945, "uuid": "3ab9a3aa-a609-4c79-9804-47bd11f91939", "value": 271457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163945, "uuid": "a57a6953-da35-497d-9f96-d1b4fd295d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163945, "uuid": "1bb78013-0650-492c-8ccc-1bb10da37b27", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6eb90a-018d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770184259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184259, "uuid": "ad691e4b-1eae-4bb6-ae18-1f04402d0adf", "comment": "Malware payload (Mirai)", "value": "67ccaf9addca43fba6d976ed24a00f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184259, "uuid": "75114ed1-5bda-48eb-bbfe-0aa5f87cf171", "comment": "Malware payload (Mirai)", "value": "d45bf8debdc0d316ac715d6982bf2833cb7123c11ef43967fc9e39a32ccfe037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184259, "uuid": "747f06fc-08ac-49ed-a453-36968f64420e", "comment": "Malware payload (Mirai)", "value": "a1d1118f81f4a8dc6af0561f013111021aaa6d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770184259, "uuid": "f8d970e6-4711-40f2-a8b3-54099f0902e6", "comment": "Malware payload (Mirai)", "value": "234265e5e99e8cc38356dbec5d99e5c6949c2877a0ca65717d1de4c793d7a67598933d122e3acefa7633c8d793375b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184259, "uuid": "0c2f91da-27c5-43a7-8ef6-dc8e01ed2101", "value": "T1D763734D7E618FBCFBAD863447B78B20A24933A527E1C584E15DEA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184259, "uuid": "15e50cc6-2a83-481c-bb9e-908b4a8c714c", "value": "1536:kMggj2Quytgwld5+gZNoEXrlXruEXrt1cQ5Hei5w9zJmHNNoDRnjyo:3pj2Quytgwz5xAhiwRJmHXoDRjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770184259, "uuid": "6c768615-80d2-4c88-a89d-aee5f0e3d1e8", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770184259, "uuid": "2a64a206-2a47-40cc-a0a9-c0d2856179c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770184259, "uuid": "a60a3791-2379-40e9-bf5e-3db7d99bdb45", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1e697b-0207-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770236605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236605, "uuid": "a4a59a94-21e7-4bf5-b186-2599874e9e81", "comment": "Malware payload (Mirai)", "value": "b884031557292ac44a147750da1ba77c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236605, "uuid": "61260916-1c30-4aea-8a92-e49ae96c4cbb", "comment": "Malware payload (Mirai)", "value": "d4d9495bd24d1a050e4d94a7a0ddd92e43cc6a92fc8db6c8df2d1504a03ec5d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236605, "uuid": "deb0423b-8537-457e-abeb-7dbfd26c420a", "comment": "Malware payload (Mirai)", "value": "8012809cd0c57e0a4e9969545c8420c4041f86f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770236605, "uuid": "6bf8fb8f-77f7-4642-8394-461f14b1b65d", "comment": "Malware payload (Mirai)", "value": "97b93941dab224994b00d86523d516334abbc4a872ab884544e634135a61d47b2749c988fe791de0f2e4082a1cf9f0c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236605, "uuid": "a0864443-1e08-4150-8430-ef094f17de0e", "value": "T193A329237E7A0F27C4C274F662F30720B1B2AA5B28B8855A7C715DC9AF646C031577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236605, "uuid": "858da263-4bc4-46d0-8f29-a2e4f6154266", "value": "1536:5HgSizFa8s1F422TJmPEuIzy+rNDzYVi6Atv7NWq5JAoV+hdbi46CEzeG1tiT:/wW3ay+vN7Nl+hdbinCEeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770236605, "uuid": "3423358b-7f7d-4bdf-8793-c0869cd13f79", "value": 98752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770236605, "uuid": "6c285bc9-5c9c-45cf-96ef-db3e834019c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770236605, "uuid": "36468359-d8d7-4f7b-8a1e-e189fd8c79d7", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467483a9-0168-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168279, "uuid": "07f9dee0-7c8b-492d-9036-c1f11e6acfca", "comment": "Malware payload (Mirai)", "value": "138fad266ba27c645200f00c209c5027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168279, "uuid": "f054c99e-9484-458b-9c8e-ac40a9aa82dc", "comment": "Malware payload (Mirai)", "value": "d69ef6105f26b45ece9eacfcc99f647f6e43518cf80a59ffa60cd7e2701eae9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168279, "uuid": "780fd2a8-cce4-4fd7-a00c-46693bd7b4b7", "comment": "Malware payload (Mirai)", "value": "2a023215ab8be5b341c97e0532ce0244c4e7100a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168279, "uuid": "a08db35a-fa84-44a5-b717-51a87ff5120c", "comment": "Malware payload (Mirai)", "value": "9b87b4486f8e536ff0ad4ddde89ce44c065926a0491807ae4ca200841988ddddc281ee34cab0c5731d2072b4bc0bc940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168279, "uuid": "a79423db-4b7e-4297-abe3-573c17d5d8e0", "value": "T187D2E0F7E2B7A6F8D4F2B8712866DC80F59630A78724435641BFBE85DBAB34C5130912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168279, "uuid": "070c555f-5235-4df3-8828-fc1708aad24d", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2Xx8+Sx0sx:NYJdJZuCj+CiE7L1APbax8Btx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168279, "uuid": "6a80f5cd-2219-4f2a-ab39-4c12e1117968", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168279, "uuid": "5a7fc1e8-e2da-438c-9449-56da9e9c3275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168279, "uuid": "9a9ab57b-0d83-410c-b402-c704e1c93cb6", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d49a405-01d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770216716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216716, "uuid": "9d1bd487-bd24-4a19-b3e2-1e9522bc08ed", "comment": "Malware payload (Socks5Systemz)", "value": "2f68c33b3e1f066a416cb1c4bf8c1781", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216716, "uuid": "65edf598-b315-41dc-8486-b540b9c533b5", "comment": "Malware payload (Socks5Systemz)", "value": "d6eef99487466f917ba08d31ff0641a139179ef1abded3ed2e6afa793c1cd171", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216716, "uuid": "53a17eee-1898-4e87-af09-26a136c4c010", "comment": "Malware payload (Socks5Systemz)", "value": "025a544588652f710546affdbb61dc360d45929b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770216716, "uuid": "ae28caa6-8f5a-4770-9a9c-3ff4db179f8d", "comment": "Malware payload (Socks5Systemz)", "value": "5b4d959f0a110de59b7cb4537ef2d6623fec7c68697fca7b1a615694e3547acb15b00579986056b7059fafd567f5b512", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216716, "uuid": "6151e904-5072-4e8a-92ec-4457943ac611", "value": "T177063363EEF6C872F5A08D356E38971D25AF7950583D840C33AD278D8F660A698E131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216716, "uuid": "5b15558d-5374-47b1-a703-ed12c1c746c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216716, "uuid": "c7472351-4230-4da1-a272-2a0b4d14523f", "value": "98304:Mcgs27PRJUaL6dJnZxwABHhe6R/3ZfKbHGwSpwU:ClAs65hwUJSZSOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770216716, "uuid": "bed7fa12-1b72-4275-a0a6-0bba4da26e40", "value": 3693047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770216716, "uuid": "10a6b0b6-4688-4a60-8457-92b591fb33d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770216716, "uuid": "73b961d7-b149-481f-92ad-8d819ec5bc0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4afd776-0215-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770242794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242794, "uuid": "73bf12ea-1481-4dc8-8034-384dbacb5452", "comment": "Malware payload (Mirai)", "value": "beee2d924f01f359938557846d564f82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242794, "uuid": "fdb99151-2c5a-41e5-bb6d-4c5edcf6052e", "comment": "Malware payload (Mirai)", "value": "d770443c789ec969c045db3a6d5a1115881278841c4c0f0d421fa7c49fa1bd1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242794, "uuid": "56cb0deb-2edd-43ee-93b8-3377391d073c", "comment": "Malware payload (Mirai)", "value": "6c7030639db6db36f447e40c9afaf9fb88b7c7fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242794, "uuid": "e6c3cb2a-b4db-419a-af83-3741312e263e", "comment": "Malware payload (Mirai)", "value": "48c310a300f5676f24bdba1acbc09e7a13fccf6170babee44a0da28d6c92b287bd436ca068a06d56261db1463474334b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242794, "uuid": "3e626f27-5e14-4d0b-855b-f68dd4b7f917", "value": "T1B47318C6AA43DEF3E91711F502B7A7365A32FD3A0836D5C7E364FCA2A9115C0A11636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242794, "uuid": "c1279720-ef5d-4177-9c2f-e841a1ee87bd", "value": "1536:FowF2OejfwG8CT2pUkOpS3TlpuqXfjZm53JaK9J/yCD4G6i9LVd:FowwTrwG8CTTkNTlRflm53EK9JKe4m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770242794, "uuid": "01d04e68-4604-4cf5-aef9-47380d9c72bc", "value": 79244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770242794, "uuid": "eb80d094-e657-453a-aa89-2673ff7d96f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242794, "uuid": "36d28856-fa71-4954-a89e-8db7251137a1", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc359e1-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198893, "uuid": "ad0bbfcc-51ca-42f2-824c-82dee8f43b79", "comment": "Malware payload (MaskGramStealer)", "value": "1ead21a71d0ebb823c767406ea8f45b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198893, "uuid": "19f9ffe4-78f5-406c-bfc3-d0ffa77273eb", "comment": "Malware payload (MaskGramStealer)", "value": "d806dad781c0d33238d91ce81d5c238d3c27e4bda889d78653612caa69f5f2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198893, "uuid": "efab8476-b54c-4d83-8ca7-9c3b5ef0c5f0", "comment": "Malware payload (MaskGramStealer)", "value": "bc466bfa1715b925cd5e32da80e17d49deddc579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198893, "uuid": "d6575196-6836-4ff5-bc77-47a22f9fafbb", "comment": "Malware payload (MaskGramStealer)", "value": "0b7dde6d34f4002840372e9e898c7765c3ce02cd7975d141f30a2d680a96091e827ad098e240bd12e3ed47789551dd6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198893, "uuid": "c1b1087e-e805-4629-8464-c4e6d9df802b", "value": "T1D107234796D583F8C4C34B70768B129EB0D1715A82BD8D2E3DC62C027931D6B978EAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198893, "uuid": "e832aca7-5a39-44c5-8329-72b826369edf", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198893, "uuid": "e8584f26-af8f-4050-9200-bcfb291ebe6c", "value": "393216:23zT9oWbDvF7+FakIEIiGrVE+ffQs1DFZXQNAqP:ozF7+JIinIRhZXQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198893, "uuid": "5631f5c3-773e-4e8d-bf31-4359e77bb8f4", "value": 17401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198893, "uuid": "9906fd8e-e6eb-4d2d-82c1-f738814abff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198893, "uuid": "a7a875c4-748d-4abf-9a8f-777180ed380c", "value": "1ead21a71d0ebb823c767406ea8f45b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f94340e-01af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770198896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198896, "uuid": "67d831c4-901d-4d6b-bf33-d7d160567ebd", "comment": "Malware payload", "value": "25f21ea8f658c91fa3c1708124729248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198896, "uuid": "d1810d52-23ba-4202-a89a-0bb333761714", "comment": "Malware payload", "value": "da549f0a2e5a7b8c58c6238cace683513cffd19622c252a99ee8b86a80b885ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198896, "uuid": "60d1d230-3699-4109-bd9e-e8beb89ead6d", "comment": "Malware payload", "value": "520a79232349f2506dec34b87361d1978a6c389c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198896, "uuid": "5b39b994-8e75-4050-a8fb-7e5abb3bca44", "comment": "Malware payload", "value": "db8ebcadf4571cab0d7ac2e0f20298fe2a605cdd9a8e224a19ce7decfe434495d0d15bbbb424d4d355b418d4cef25658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198896, "uuid": "d74eb3c1-8eac-41b9-9172-9c9c1e80205d", "value": "T16A07235699C953F8C0C38B70618712DF70D175AB86EE9D1E3ACA1C037531DAA428EEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198896, "uuid": "72a10469-0cf5-4682-8d4a-d0f878a9bc65", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198896, "uuid": "ddb22dbe-1014-4f00-93e3-8695637a2a2c", "value": "393216:GxFOq6peXB1jMe8jdbuNwetf7DxkOVESXcdc1N3t3M9pGrHArVF5d:GrIRe+6wWqOVDX9vt3qVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198896, "uuid": "3101e166-69b2-43de-bbb2-fca0a4f92a03", "value": 17816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198896, "uuid": "c0dae067-bb31-4573-af7f-62cc4a4494bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198896, "uuid": "1e5485ec-8c6b-4431-a33e-f701bd930d6e", "value": "25f21ea8f658c91fa3c1708124729248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078dba70-01bb-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770203822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203822, "uuid": "559a752c-3f6e-462a-8238-b1e2d40e14b5", "comment": "Malware payload (SantaStealer)", "value": "5272edd7bc41c04a151a62e5fc9de055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203822, "uuid": "58390ae7-da83-4cec-b31c-0dfd43e67689", "comment": "Malware payload (SantaStealer)", "value": "db2e0a69bc58c30039fffa25ae521ae3ad0defcb2d488d0d7b3e66ba61cfd984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203822, "uuid": "f20be49c-1c15-4704-bbc5-dad4d86f36e2", "comment": "Malware payload (SantaStealer)", "value": "6951975a21f3acd29e99962140e3385951fc6b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203822, "uuid": "bf640c15-934a-4ece-a949-6fff9fa5ad7c", "comment": "Malware payload (SantaStealer)", "value": "32f4769ef6e100af47871b09302692e004594424f8819f02443e5f94fa1e9822d172e1965e26202197077aaef16ef64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203822, "uuid": "2ba4d281-2b59-4383-b085-40b72e9855b3", "value": "T1EBC59E0AE15349D5CC5BC0BC838F7131EB357D79CA283D9B17D28B613A95B806729F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203822, "uuid": "7dab4e29-4d33-4707-91a8-460fa2fec010", "value": "d6d4019539ab1757eb53b82c6691b682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203822, "uuid": "bceddd00-3cf8-47f1-8a59-fccc26852086", "value": "49152:5wLgW0B2MXHZeGLzCnx7Rt80JjIGr2yXEJmgS/scEIuBZ:5pW0jZeGLzkx9KAjcyTxP+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203822, "uuid": "1aa2cd06-53a1-48a3-b5c2-d68d17d78a8c", "value": 2628608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203822, "uuid": "4c8e5fa6-8b41-4894-bf21-99d2b3c673b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203822, "uuid": "98db28f4-e0c2-432e-8988-c9e468be055b", "value": "executavel_temporario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54ee3b3-0179-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770175874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175874, "uuid": "a15a4ff1-ce82-4225-886c-a81e6796b938", "comment": "Malware payload (Gh0stRAT)", "value": "abc325615f9d53cf79bf8039bcc69295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175874, "uuid": "27da95cb-bd51-4037-bbb2-fcc7ea803dea", "comment": "Malware payload (Gh0stRAT)", "value": "dc0adb03fd833ab70b582fc092d5e5e511669abb125c41660e3d4ee3b95163b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175874, "uuid": "5bc62c07-7e78-4592-a4c2-f1a244fd9afa", "comment": "Malware payload (Gh0stRAT)", "value": "7318a8a9223d00c25af3b316547f4bbcc0b4c2f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770175874, "uuid": "46732735-d252-4fca-b138-ff38eb5a934e", "comment": "Malware payload (Gh0stRAT)", "value": "d99dd15601527beaa71bc39636a506da594c4653b0c443758fc968e2832756bc310ae23f344ab4a49b76c71419cb04b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175874, "uuid": "5e388a3b-9d26-4f56-a032-ad3087011aee", "value": "T16CE5F117F2CBA13FF06A4A3649B2D212593BBE6069128C6797EC385CCE261D11D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175874, "uuid": "7ab5d508-980e-4883-b915-ca737e7b4d7d", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175874, "uuid": "ba00d6a5-4d82-4031-a878-74aee0f19128", "value": "49152:axXXm66O7wjR3RtnEIzEUvewiYIXXQwCE7tqeMA4eWUYRa2CtEY1UZGpZP/:axHX7OEIz/efECtNbF1/pR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770175874, "uuid": "bdede684-7d36-4cae-9c0c-f5a006158d4c", "value": 3292625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770175874, "uuid": "4f72b1c2-d48e-42e4-b301-0028cf8ab43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770175874, "uuid": "98d6928b-52a8-4261-a8ed-6406c10fa813", "value": "MoveWrite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4a3988-0188-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770182170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182170, "uuid": "4d57fb88-d8fa-4bad-9a55-9c481d28c228", "comment": "Malware payload", "value": "4a4d2a4fcfe40268e47b1a686bce13af", "object_relation": "md5", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182170, "uuid": "72f34a81-cd96-4823-976b-a84336d22c91", "comment": "Malware payload", "value": "dc5041ab5507e06d08cfc02516eab7286b98e669596f20003494a1fd13d5b1fd", "object_relation": "sha256", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182170, "uuid": "d0085692-5e69-440f-93d7-bb53d6789f87", "comment": "Malware payload", "value": "2cf757957c9557b088138a415ed0de000125ff9c", "object_relation": "sha1", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770182170, "uuid": "5d4f52a2-69e5-4544-82d7-ce233aea581e", "comment": "Malware payload", "value": "3589ee1fb2e39168a807c17e56da117682baba00bafe9ec18466a88254dc7546c5552522879b9abd74be034e277ba93f", "object_relation": "sha3-384", "Tag": [ { "name": "107-174-33-21", "colour": "#A40D38", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182170, "uuid": "da72b021-e697-434d-8fa0-bbf132ae4309", "value": "T1B965221ADF91EB6FC016AAF44AC3C1E1413D7D96B24B0A0F2B01376668371F6D99272D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182170, "uuid": "4a3e5730-bc08-4145-95ef-f370a98cbac8", "value": "24576:u1k3+nYgpl0TuveaRuPWN3bKtu08GKxebj9xvS0XFlHhj/8LiEfMpb88lTqqX:uSqT/0qveaRuIrKs52jCMlHhKM18L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770182170, "uuid": "e025b7d7-2323-4641-b07d-4e7e3fd4a915", "value": 1458688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770182170, "uuid": "112dca48-075f-4473-a300-a645a5d8e2c0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770182170, "uuid": "c3b64751-2dde-40a3-ae1b-5459c468f383", "value": "dc5041ab5507e06d08cfc02516eab7286b98e669596f20003494a1fd13d5b1fd.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d237821e-019a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770189988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189988, "uuid": "fbc3a8ad-5ab8-4141-a543-409288411530", "comment": "Malware payload (Mirai)", "value": "2fb3cd64aa7e37ad2d1edf8b69339664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189988, "uuid": "c13abe21-24b4-4442-af7a-516649169bbd", "comment": "Malware payload (Mirai)", "value": "dc953cbcebd379f4d7de1aace5c7802abeb48b0f828d678645fbe92541198781", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189988, "uuid": "29cf7114-526f-4fac-b1b9-5168896d270e", "comment": "Malware payload (Mirai)", "value": "60fddd8f53c8aa7a91ebc0088319b99bf1ff8047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770189988, "uuid": "65966cfe-6412-42f9-8115-ab67019d8ff8", "comment": "Malware payload (Mirai)", "value": "f2f0545a2239bbe8f8624e093d8afdb470135d99c7e41ea45de5d105b1b2999e1f787c7032a1328d1a4d9e40be305c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189988, "uuid": "00468ce7-1c56-4ba1-b8c2-3e5f95e34d1e", "value": "T14D734DA974018EBCF98BD5F981160F0EF42163059B930F27A66BFEA37C630A59D07D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189988, "uuid": "6330f36f-ba26-4663-bf84-02d2ba59fb77", "value": "1536:BweLSd7Sjy/elVNdmXpvxhpOn8YgjWzkjtNppe8xXQfr:Ljy2lVNd8pv7pxtiyNzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770189988, "uuid": "3a2f0237-289f-4ee4-9875-e9517fbdc03d", "value": 78224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770189988, "uuid": "219c5ed5-ceb7-47e9-a29a-2be8e9ba2f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770189988, "uuid": "8053fcaa-7a47-47f4-b5cd-eba8b161622e", "value": "nullnet_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e960d5d-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164508, "uuid": "e1f7f76f-d71e-4ee5-bc7a-98475a1fa85f", "comment": "Malware payload (Mirai)", "value": "8a4a2ab59a21087ef580892da63bd412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164508, "uuid": "d8d552de-8ff7-4bda-9150-a87d0f26fbcc", "comment": "Malware payload (Mirai)", "value": "dd46458163a1c22844a2dc8b8fefc3a220a2ff9f793758fcc2956a5b9e7a2cb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164508, "uuid": "bc35c764-9a77-4466-b7c2-d2eb6e3667fe", "comment": "Malware payload (Mirai)", "value": "06ef99367d2e0f743ad70d47d14f17a038885710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164508, "uuid": "b56f50f1-695e-442a-8100-910788b5da5e", "comment": "Malware payload (Mirai)", "value": "2e4497e7c86993d6ed788bbbf61f1e5d87343ad1f5487cd014ae68e6ebd26d9abb4c0addda0ee8bf6d2b8ee1e0f0b365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164508, "uuid": "ab5f581b-e73c-4dce-bdfd-a3990c430e63", "value": "T1E68302CD45B8BC9BC54F5C3B48BA4376AEE2A1C191985F4FC1220D90F31C54BD99E43A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164508, "uuid": "988c9155-3758-49b4-817c-af4d2880870a", "value": "1536:wx9SVOrihmw2ibw0gb0Cu1rKQKVeH7SNJgFzfZyrf57hQkf:SSIihmPipH31+J4ygi17b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164508, "uuid": "fea6e3b3-f3b9-4d73-a30e-ff8306f7ee79", "value": 84456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164508, "uuid": "3245ba28-5e70-44d7-af2d-aea8e392112a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164508, "uuid": "3395469a-9bfa-4782-8827-d25194b7428d", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1394ef7e-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770210284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210284, "uuid": "6ae6facc-795e-41f7-9366-909f2e18ea92", "comment": "Malware payload", "value": "472e7020a47515d55576a47874060b7a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210284, "uuid": "74e95936-bf2c-4f1f-8a38-fc0e8fae48c3", "comment": "Malware payload", "value": "dda3433c02851eb2a9c864ae8a4e58fc7a22ad3982dbfc92938a1d1b651feac5", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210284, "uuid": "ceca4dd0-485b-4a06-bc7d-576985700787", "comment": "Malware payload", "value": "bce54d001687c0e94f1ddbb6436a5dd5c9dd9fe3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210284, "uuid": "8bd1f1be-baa5-4b32-b0b6-2e195179a966", "comment": "Malware payload", "value": "6e15127ebff2797cd5b03100ddb1fee42c3924a07152de93863098b9756fe344e5b2b37275aa2580583905dd458ff47b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210284, "uuid": "2c1b0dbd-98aa-4817-96e1-cc1a41123971", "value": "T15562D636C819FCC9277F3EA191243B551C9D282B97AC9E98FEC004A63591329DF358BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210284, "uuid": "5874713e-fbff-4bea-8ab6-7ed8ad0c6751", "value": "384:DSwEA+ThVc1u7KXxhloPhqh6huYnv7uZncIQLRLRLRLuX:KAmIegtQuYnenoLRLRLRLuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210284, "uuid": "790a8475-f30f-4d9c-9e18-8a4d54acf821", "value": 15951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210284, "uuid": "b40edf67-3fd7-4052-ac54-796b1d7df2c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210284, "uuid": "0daef9c4-ab16-4a4f-8914-ff4a36d6f5ac", "value": "ps_Q4huLTcs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af60962-016d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770170541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170541, "uuid": "e55033a0-a2f9-4a26-83cd-ac349a58102f", "comment": "Malware payload", "value": "0fcf9756fc01f69f6a6ef3449d4d8188", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170541, "uuid": "ce3828d1-801b-445b-b0f2-1f14ee8a4963", "comment": "Malware payload", "value": "de69c626d7665cda7006b42fdb0a9eb9f7c250a90c0f339a37f74bfe572b3232", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170541, "uuid": "d710a98b-ef01-4839-abf1-f7f418ab8c0f", "comment": "Malware payload", "value": "ec8cb7184e03ce70d10f27fa64b632285ef96418", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170541, "uuid": "e92ce518-15a6-4701-9bd9-5111ab366377", "comment": "Malware payload", "value": "8ea340e5c56d0674d9ad6498ec30c1762b450d047bdf14a0f1c5393565becbc9e7a0761a944c894200d014f571281b08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170541, "uuid": "6b70b001-4b7c-456d-a2e9-5833ee0efcfd", "value": "T1A1C4239E998842F50819BA3DD9CE43670BF2E8B3A96607540EF32F46BC1B98C5153C27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170541, "uuid": "e04f7d79-6f1b-45fc-b616-da35fbb1af09", "value": "12288:YDZHIS7UqPpcjJaFh3GgqL/sVpNGgUj6Obj3uFmNHQ:YFt/PCsFbysvNGRbTuFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170541, "uuid": "3bea8961-bae3-4281-aecb-9101aa04eed8", "value": 564053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170541, "uuid": "965de83f-f9d5-4941-abf7-caf6e56338ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170541, "uuid": "5807b39d-1639-4a81-85ad-80ad5e1a6fdd", "value": "explorer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aa6efd-01df-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770219514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219514, "uuid": "ce08649f-c851-4d64-ae72-12fa5daba73d", "comment": "Malware payload (SheetRAT)", "value": "e577fd1c566f32cd83ce02d08c1e5f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219514, "uuid": "1fac6c11-c3ff-4ee9-a7f3-c348a3434c35", "comment": "Malware payload (SheetRAT)", "value": "df018a3644a8cc46b4acf58b6f9efefe64ae2a1eb3754eb842a171e2aff86ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219514, "uuid": "cbfb0257-75c8-4414-b37b-8c79d283910c", "comment": "Malware payload (SheetRAT)", "value": "96988391dd0da3d1cdf770a92d08d967d1241732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770219514, "uuid": "3b932b09-74b9-4b85-b9bf-aefa58aaaf64", "comment": "Malware payload (SheetRAT)", "value": "52a00b3df37ec5bd8eedd3aa37e180cbfa391ba6dbd4c68cbb0542464340a89191bd798cd24ce3bf73227d917f70dd36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219514, "uuid": "d4c27c5a-515e-4c09-905a-40034c568158", "value": "T15205528C7E50E80EDF0BFC7F8AA5D1348B3169925E92410560E4AAFE87273757496B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219514, "uuid": "e59c6efd-b444-434c-9d44-c5c300d45d8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219514, "uuid": "c239d72c-39c3-4cf3-b758-7432efb0e300", "value": "12288:G3KMOSPVle8cpRAWS91+2mzkhVOr2WKl+fokU7DTSFi14A:G6MArA1f+2mzk+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770219514, "uuid": "f658ab9a-2efb-4087-b49b-608337ec74c3", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770219514, "uuid": "5431f8b3-1b4b-4b10-af10-d3c3a9f31546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770219514, "uuid": "da63ff86-4cf1-44bb-84cc-5ef1fc38e2ed", "value": "df018a3644a8cc46b4acf58b6f9efefe64ae2a1eb3754eb842a171e2aff86ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06af6cba-01b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770199096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770199096, "uuid": "03315955-e298-49b5-8990-c9c167086522", "comment": "Malware payload (Vidar)", "value": "2b20cafeaac2aa309c96a408c5a1f608", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770199096, "uuid": "81270f9e-982d-4fce-8e5b-c0083faf0eff", "comment": "Malware payload (Vidar)", "value": "df092688b0b4b0f58e74df9c7d6267d2b5dc42e3feeb54719a4221173f72c88b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770199096, "uuid": "35fb13ae-ef9f-4464-a443-2e7a6318cc5a", "comment": "Malware payload (Vidar)", "value": "73046927cba99b8b7130524de11e351381f61352", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770199096, "uuid": "7d0f9cc2-003f-4a51-b535-2878f4fa230b", "comment": "Malware payload (Vidar)", "value": "41693fcac80004884fb1f6b0255176b4bad5b2e5b00eb17175381fb292e883a5fa9ba69ad17d6928f5ea5c265610d6c6", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770199096, "uuid": "fe50504d-4928-45a2-aaca-4af421e26e93", "value": "T1A5166B63BA84C625C9ABE139E56162A17330B808573036D73B552FB64D3B7C41B3BB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770199096, "uuid": "fe9471e9-4099-48d6-91ce-5295374f490b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770199096, "uuid": "8c44d50d-1172-4b4b-8446-d660e258cb8f", "value": "98304:0K1PLz89opXhHDNq3bvZOIKHjm9KhH4p3:fzXf41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770199096, "uuid": "454bbbdf-f1be-4ce5-a226-f9f7aa356338", "value": 4407936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770199096, "uuid": "6f018d77-301e-4ed2-9e6a-5e90c14e6dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770199096, "uuid": "107fbcf8-ad00-4a69-9bcb-d0e0c07be51d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66311d45-017b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770176493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176493, "uuid": "17062504-2b55-4d46-ab6f-fad91c75db7c", "comment": "Malware payload", "value": "7c648790ee988b15608b49728de312c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176493, "uuid": "62df096a-f159-433c-9304-43272c8f9ddf", "comment": "Malware payload", "value": "df5f59c3128a5b658ac7d3a395b3d3d2ed63b8d9e1ac1b2c756c96011bbec283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176493, "uuid": "9a532a0c-79e3-4665-8381-648e9677c5d6", "comment": "Malware payload", "value": "f220de62233950a226b379a127858542dc173a71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176493, "uuid": "3f97352b-adf8-4b59-ad32-a8d2872fc126", "comment": "Malware payload", "value": "82b504cac456306e38a9d24fb96ddc191eaab20bac86178a6526e86d5857d71c84f1626eb95a154664448b535dedb455", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176493, "uuid": "5c3565ad-98af-4924-ae77-48ebfbfea0e5", "value": "T1CE04F046FE914FEFC81FDE74491F0627065D85DA13F0A32A85BCCC89B5A864A8AD3D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176493, "uuid": "84f61279-1d6a-44c7-9239-a857cc741bda", "value": "3072:oDTIzc663gmpzIFj3vV6/AmUTRG0/f3xlb8NPkf89NW1wMryiQTvVrKFoa5svfMe:rzR63rp0C/bcf3xl2y1wMrrQwNsXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176493, "uuid": "784932d5-68cd-46e4-907d-cfe96e48eb82", "value": 180237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176493, "uuid": "f87b34ec-097f-4bce-8d2e-b6fa93f7e871", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176493, "uuid": "c0168088-a7dc-4ccb-a3db-50177b419b9e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf3d3a2-01bd-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770204955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204955, "uuid": "ffc5df4a-2715-4f97-8d8d-3365cd5a6278", "comment": "Malware payload (XWorm)", "value": "f4f59297e0af010789eb4cb152e2bafd", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204955, "uuid": "e29998f6-b2d6-4d04-91f8-e4d069fd4c71", "comment": "Malware payload (XWorm)", "value": "e23e0ba2a1ae66ff85a3a2b28f489ec73fb5e6748b2acf33458e78eda5c3feb3", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204955, "uuid": "1c340f9a-f393-4b34-ae44-e1f209c77e78", "comment": "Malware payload (XWorm)", "value": "d0d081d0165b4dbf990818a1df3b12b70024e666", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770204955, "uuid": "c2cea860-4c2f-4396-bbe0-48261bdf3827", "comment": "Malware payload (XWorm)", "value": "6f92285968ec74073e17093ede775665b2829ed9f469a473dc4a5a444f7acd64a770289618950014e62c267a3a3067f8", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204955, "uuid": "ddaba829-65cd-4d61-a86d-a953aab8f8e0", "value": "T1C2063366E5E74B0361CDDBE3522EFAD1612509F8074BD868E38D29970DA081DF9CBF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204955, "uuid": "61047d75-40b6-445b-9ef0-b926163a1288", "value": "49152:QQXwEgLvO6qrDwKB5TCVtNqEAuoFzGdIMdLdK6mOV2RVHUAq2xGYnmJae8G8flZI:QQUvurDbUlK6mi2RVHmAl5uiI6OavG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770204955, "uuid": "783d6a20-e46c-4b12-9951-ade05c06c729", "value": 3817397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770204955, "uuid": "0af91067-f97d-4ce3-9f06-ab617a77698c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770204955, "uuid": "26c4c774-8f75-419e-85d5-b02002fe9af9", "value": "Paul Sehnert Tax Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04177e57-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192649, "uuid": "71385487-af2c-4c39-94f9-113c2c296870", "comment": "Malware payload (Mirai)", "value": "83592441be77799721a9c1d8896fc03c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192649, "uuid": "d8c0c283-1dd1-461d-bbd8-d3fe07fd6448", "comment": "Malware payload (Mirai)", "value": "e43183dbb41cf7c66de3f33898dedda25430535c183a4f096d1eaa32c7fbcba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192649, "uuid": "e60a704b-0680-48ef-a3ca-d6e5929424ae", "comment": "Malware payload (Mirai)", "value": "1776668d00e1195ee8c04e1568e616f38417fe01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192649, "uuid": "df40d6c5-775b-4c3a-a5d4-73b12a765065", "comment": "Malware payload (Mirai)", "value": "ba3a9407e00a5f2f2aa137eeaf7655f1bd965cf82c257b91083d6293fc698b9d7a0bf94a028f16deb5fa4fb757c5b17a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192649, "uuid": "1e6b3a7f-2831-4e79-bc20-fa486118a26c", "value": "T1E6D308C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192649, "uuid": "f62a0e8d-49f7-4ee3-96fc-7bc3d27b4cb3", "value": "3072:aXbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIGx:3rybytG/Oyi42VOgLNhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192649, "uuid": "a117f476-c4be-4f7e-9aea-9657a2ac4993", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192649, "uuid": "26e32b8e-da43-4596-bd84-10d201c36e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192649, "uuid": "5857fe70-c335-4116-88f3-c359df78f3c4", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7280914f-01da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770217316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217316, "uuid": "36c0de6f-35ae-4b72-b9aa-73c96c2c126b", "comment": "Malware payload", "value": "374874fbdf3c93b386c888362b2833f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217316, "uuid": "caf45856-59b8-430f-a0ca-512f075d4b55", "comment": "Malware payload", "value": "e4a25ad70ac8cca7073a6922338d5539c69fdc6ad73a005c85a4361b60a43dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217316, "uuid": "b5361163-3538-4aab-b984-ad1c23b31d03", "comment": "Malware payload", "value": "3f4a3209bdc581d67460031e8862acbcbdde1dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770217316, "uuid": "72cb9841-f539-44f2-ab5b-579c80f1f115", "comment": "Malware payload", "value": "d3dbf61f7a918c212524fd5a705f8a044dc59772d009439e0e0cdb3b7e3f1827701e07cef03d668510ec8f40a57267a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217316, "uuid": "ee10ba7a-cbb5-4a49-a0c1-03706912716a", "value": "T13545CEC9D16E44D6DC053FF598282BC79B2447324A7800283A6FBD895F775FE801EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217316, "uuid": "da8d73a9-8d5c-49f5-b657-a0cb98225b33", "value": "f15b13acd378c9c8267ff46897daae25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217316, "uuid": "3d383220-8d58-48f5-b424-f41db31266c9", "value": "12288:L73FRxei9g3GlwDrPiy+FtjavR88ILHNVzHq0vlWLAuaUcqVrB+:fTZ3y+D2vRMnzpqXXB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770217316, "uuid": "4b030fbe-89b6-4b3d-9267-ee58a2adab22", "value": 1183813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770217316, "uuid": "1ca24e6c-ca7f-4cf6-b5c0-6e95f2e2d782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770217316, "uuid": "9cc04473-9a78-4ffb-8d2f-0c4aeb9f1565", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac0535e-017b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770176635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176635, "uuid": "08330bc8-9913-4a3a-8dab-621b9767591c", "comment": "Malware payload", "value": "c2c5dc0ee09b5eaa34928d2001a0255c", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176635, "uuid": "231553a2-8542-4cbc-8711-24842b3a4baa", "comment": "Malware payload", "value": "e531032feb43bb2129c6eba9fa3267e3150ccc238480d3669c07feecae441603", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176635, "uuid": "7ccba1bc-5711-4c99-a0c0-6ce2c47b411c", "comment": "Malware payload", "value": "4eee4d2c0faebd7d6246a3848a7feae4647bc4ad", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176635, "uuid": "fd21866a-dbc8-4d30-a803-f55b3ad1179c", "comment": "Malware payload", "value": "4c2dca63b56071d3e0f095761e36a2e4a4d8bde9a0a398b8547c4b2d2a603b98f05e96ceaab1e621d9659f46be12e8b8", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176635, "uuid": "4e7cd667-2f44-4c03-ad19-ab1f77631e1f", "value": "T1EEB523843ECA33A7C439E7F082D772FC34172D4A9DD59A29F6566A98087CEC5CC6E019", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176635, "uuid": "7fcd86f0-6de6-4b61-84a0-e74389e08cad", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176635, "uuid": "5b24298f-5f94-493d-8849-2a4214fec276", "value": "49152:qm4v27VlRPJcVaadPgkrwUJH8HchN0XafAY+v/q+Ls2D6k76We:d4eSU2PgW83Xafd4s2pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176635, "uuid": "97b389f4-f853-4f31-8822-231b4e5f340b", "value": 2343648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176635, "uuid": "fd302cd9-815e-43d6-a5d1-49c0b4465527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176635, "uuid": "a67b931c-0e17-455f-9f41-9dbb780dce99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2136c276-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770190980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190980, "uuid": "0bfe8b4f-8ed5-44b8-a976-5e5f7f7e5372", "comment": "Malware payload (Mirai)", "value": "c260f127d0074951ea0a1cb011ab7bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190980, "uuid": "8dee09c4-82dc-4f03-9e01-b7b776dc5944", "comment": "Malware payload (Mirai)", "value": "e5ce6d08babac52299d283e88d42b7860ceac8deb46d6afba87dd9f2fa524c1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190980, "uuid": "7e16d83e-a36c-4d8f-831e-2fe3fb9750df", "comment": "Malware payload (Mirai)", "value": "d7e720306e9ca61347f6bd9c8a2f04ca261bd5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770190980, "uuid": "ad4b3b82-eb14-4062-a553-0cf2156e6aeb", "comment": "Malware payload (Mirai)", "value": "de401ab37a6f40827c8f6e6021c88784fceef37a3ee7eff5c43c86710c6fcbafcb6bf82faa0b2b70a70907d895bb316e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190980, "uuid": "c39a4fe3-18c0-42fc-a24b-7277f0734093", "value": "T188E3952E7E22ABBFE169863107F35F70879521E227A19381E26CD75C1EB124D1C5FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190980, "uuid": "7452c422-9a5c-4779-815b-b1e7e9de200c", "value": "3072:lc9sAghas4PZZUD9mvdCG6MVE5N6VzJ+r4EEEzXjDO2/lkmk+WFiBdNCZO:PU88eXjK29kmk+WFiBdNCZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770190980, "uuid": "0b2fbcb2-4d11-4b62-94ed-8304c85c33aa", "value": 143294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770190980, "uuid": "40199e89-1228-4602-afd8-168f5ae120c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770190980, "uuid": "bf9c29fd-8e24-4001-af7f-d103bc674cdd", "value": "pXdN91.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e19907-0188-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770181967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181967, "uuid": "04a1809d-1b2b-4d46-95bf-2310dd2fdd8c", "comment": "Malware payload (RemcosRAT)", "value": "2f9ea08bda2902fd783534037b48ca13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181967, "uuid": "62125a14-710a-4563-ae3d-2cb43f5403c1", "comment": "Malware payload (RemcosRAT)", "value": "e72e093533370de2008cb7d8dba4852b66bd390836585e265db7d9842581a457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181967, "uuid": "3004b05e-c3b6-4144-aea8-b72fe0366937", "comment": "Malware payload (RemcosRAT)", "value": "a0ee2aa3a2037c8952de03c9f85fa5b7fdbd430d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181967, "uuid": "8d095857-c16b-40da-b5e4-a721726e56cc", "comment": "Malware payload (RemcosRAT)", "value": "6aa2a9597fdba47a0a5d68a2d8b59de50b5955ab45cf6729487ed6f5783c20e0a6b5583f319cb1a9549203b03b60d50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mismilahioluwadoam-duckdns-org", "colour": "#189150", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181967, "uuid": "17dc6198-286c-4105-aba1-61ab6c36c762", "value": "T16DB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181967, "uuid": "5050e21d-9e52-4ee4-917a-6592ca17f955", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181967, "uuid": "73e40804-80ca-43b2-b938-3ea2c898296e", "value": "12288:C6pxxGI8gvGOHJpAbDYGxLhZ+sPZtLmPFN:C6pxxx8U+bDYGxLhZtZ0PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181967, "uuid": "a49b6a86-5c1b-43eb-b438-953ba74f908a", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181967, "uuid": "74a9b8cf-6743-4d6b-8e8d-d748f0c4f1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181967, "uuid": "03462a7f-02c3-4e70-847f-51312e3e4de5", "value": "e72e093533370de2008cb7d8dba4852b66bd390836585e265db7d9842581a457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa07d1d-01a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770194172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194172, "uuid": "44ec2830-dd10-4cf5-90a1-3a1153537dae", "comment": "Malware payload (Socks5Systemz)", "value": "94fd15632f3f33c3a2482709c35babff", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194172, "uuid": "8086bcb0-b28d-4129-ad6a-11969db9bed5", "comment": "Malware payload (Socks5Systemz)", "value": "e7a0a83cc3bf6a4f4a7938d62d68fb5a15e821bd5c2cbf86339ddce5d209fae3", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194172, "uuid": "dcd710b8-db0d-42e1-b8c5-161b562118e2", "comment": "Malware payload (Socks5Systemz)", "value": "b576b2fb628a1f0f09b6546c0dff779c0a5dcb92", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194172, "uuid": "18e7df35-9df5-4132-9478-8cb93a917751", "comment": "Malware payload (Socks5Systemz)", "value": "638cfa1b471cf5b83f45fdd1744e544f2ec00796a3d33804019bd5deb3bfb0433f1dc5454192e6c6b15ed8908fb33c97", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194172, "uuid": "8e45f435-872a-4d0d-acd1-2e6ac14d0c28", "value": "T11C06334AC9D04B31E076E9318FECE1A5C9EB792B49F5036165986BAC4F6B055CCCB383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194172, "uuid": "8736003a-0c5c-4868-ace6-b274d3d4d02d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194172, "uuid": "b1c78bd3-2766-4ab1-88ea-331eb27c6952", "value": "98304:M3bRauT9aQeISg2GpBQ3hQBNRPnmQwA18Ld4H1Ih:aqQKg2G3Q3knmdA18pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770194172, "uuid": "74356302-8ddb-48a3-bb96-3c658c7f078a", "value": 3699640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770194172, "uuid": "133453fb-4cf0-4cd1-b43f-c3e87fd6e929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194172, "uuid": "20e64d12-f719-425e-8853-0a61495fafca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08316f8-015d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163706, "uuid": "2e7602fc-499f-4752-85c7-93189b7d7ae7", "comment": "Malware payload (Mirai)", "value": "4c325fbfb6d2191593bd319f282a5727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163706, "uuid": "1a6b2532-26eb-491b-805c-bc1f0af7072e", "comment": "Malware payload (Mirai)", "value": "e7b3c9c00f79eca8e50a27c0462ff5f0cd3ac4148200508aa77b3eef21fd1cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163706, "uuid": "14159847-d3ed-4e2c-8cd6-60f4770c1850", "comment": "Malware payload (Mirai)", "value": "1a2d102b7b332d568e8954bfab2357411e3f9683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163706, "uuid": "f928d70b-fa9f-4725-9c0f-c8b1bb6bd850", "comment": "Malware payload (Mirai)", "value": "71b64825eb4b2772ccd4904c7aeb3f9451e39a2962b01ee59bafe801304557b691e738dac1a2f32c6d1358abb5e647f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163706, "uuid": "5d425e3d-65d8-48ac-b7ca-cc6d6cd1e516", "value": "T174532A99F401AF7CF81FDAFA4012490EF521A24496430F3AAF77FD936CB10A58E17989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163706, "uuid": "b029607f-b346-4291-bd4b-f01d89432ce3", "value": "768:yoTaP/6dXlyLewEudk9vn5XTk1fb9e8YZPKst9jYO882YxN+5xidImJRPY6X5Z:yXXsXlsEuSwD8PKI8O88RW5xiamJ55Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163706, "uuid": "92866bce-338f-4354-8766-4e908f0f0b68", "value": 63620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163706, "uuid": "52ad0c6d-eadd-41d1-a1c2-ab3a2be92f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163706, "uuid": "762d79a9-a020-44d5-ab8d-45a85b6f4e43", "value": "mao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f147205-0191-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770185983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185983, "uuid": "6f218416-3b47-4edb-9d99-0c2604e7d07d", "comment": "Malware payload (Mirai)", "value": "8a0082d6ea25bdd658d70fc9738beb3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185983, "uuid": "d1bae843-638a-4954-a968-1af5dc92def7", "comment": "Malware payload (Mirai)", "value": "eb2baef135fd73539465c072f8e19b28587beea3a7e07b5f12f1b5fca2229074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185983, "uuid": "6c8810b7-fbda-4a43-9126-9eca77ec2e1a", "comment": "Malware payload (Mirai)", "value": "5796bbfe70e4ba80dccbcb05dc92ab320a39d56f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770185983, "uuid": "d3fedd88-7319-4f0a-b05f-2a1eb5be3ce7", "comment": "Malware payload (Mirai)", "value": "661a3e9323bed02c25afd72c5019c121cb150a92bebcd2a128a15b13db1a78db307300139a9014e7a3b2e5d42e4be06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185983, "uuid": "6c059d04-deac-4a0a-8c85-62b6a08bfaf6", "value": "T1CF33F8C4FA8B85F5D907493040A7F23FCA32D97D4071DA9DEF8A9F35DA37942921224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185983, "uuid": "c7d6b151-51d2-475e-b551-dcc1cfc9ee20", "value": "1536:Rh24UVHA1JqOMnjoMGhlV9QvSaR0VMs4+a:Rh2VHA1JqOYchTyvVR0VMs4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770185983, "uuid": "41ae4437-4a5e-4001-88b5-c96cb922377f", "value": 54064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770185983, "uuid": "573de186-4680-41c1-8423-5749378f48dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770185983, "uuid": "3abc4f56-92a5-4b7b-8645-01dab94f4bb1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d2d3ef-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198833, "uuid": "a6d2dff2-4d68-433f-8eb8-59f41d1bef59", "comment": "Malware payload (MaskGramStealer)", "value": "1722ee18ae707c5b4bee097ffb3e83c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198833, "uuid": "be699157-42ee-42c9-8f1f-626032916a07", "comment": "Malware payload (MaskGramStealer)", "value": "eb4b5d82ab6dd7715058c00fe48a04aabc39f394b8b14464a1080f640ec9724a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198833, "uuid": "e944b9b2-e857-4720-9eff-1bffcb790b58", "comment": "Malware payload (MaskGramStealer)", "value": "222bf701c36af2ea748337d311704dfc3a8a321c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198833, "uuid": "b7eb1522-c263-4a22-8535-b2b59f4cd61e", "comment": "Malware payload (MaskGramStealer)", "value": "5b62ae426559f0863a3dbbd71529aef6c7858bd84ad63484b78fdbf40f67d021f127898f7c67f1d6bb2b3f7e5913db65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198833, "uuid": "c8c36ae4-21ed-47e0-9f6c-e3f76370b71c", "value": "T1AC17239BD9C952F8D0C34B74A68B12DE70D1715986FE4C1D29CF5C02BA21D9A928FB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198833, "uuid": "24d7033b-5811-4019-b633-ea84e6b7abf7", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198833, "uuid": "fca53b91-caec-4834-a992-b5fac915fb85", "value": "393216:f0YbjTtBHbsMn0f9EVjyXQOPDxBB95zoaSNAd6V:f0MtBHpn0WyPDxD95MaSCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198833, "uuid": "7788fb05-7654-401a-8bfd-58b9479167e2", "value": 18917888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198833, "uuid": "51a6d5ea-c103-4bd8-b039-999eddf98bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198833, "uuid": "b764b45a-526d-453a-a6c0-aaa4b19bc6d8", "value": "1722ee18ae707c5b4bee097ffb3e83c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542dab30-0215-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770242605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242605, "uuid": "7e335d39-b81c-4985-8fa7-94cbca2a3861", "comment": "Malware payload", "value": "c59018845439dad4d30557ce61315e75", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242605, "uuid": "9e1719c9-7543-4bf5-ba2e-56e13b7bd2e0", "comment": "Malware payload", "value": "ec7c5533adfb5a919951a4973983064b2103918bcf9f93a8c351a152a1f63567", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242605, "uuid": "fa9a2e7e-cab3-4225-9dda-63d182685eb5", "comment": "Malware payload", "value": "51836feb6dc7d2f4f47968bf0f5b3d75f1c19011", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770242605, "uuid": "31732c26-3ff9-4269-a476-e1e3d8d3cf5c", "comment": "Malware payload", "value": "cbff6b89c6c79afd13eb0408d69d1cfef3c94e79350241c5d622ee245103ced46c3ee49c9b602fefac9f15ada90af2af", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242605, "uuid": "934b111f-a80f-4baa-946b-260109d4bf2d", "value": "T1C1747C56BAA418F9E57B853CC9530A06D7F2BC660760DBDF03A046961F277E08E3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242605, "uuid": "633be52f-74c5-4a1b-9da7-437250ac8dbe", "value": "c546646952cb160243a67da7651da44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242605, "uuid": "1c42b9b9-68d9-405c-8914-cd1c59cb5105", "value": "6144:5nsuD9WKIz8HZ/zVcTVQgvVHytj23vf/tRW00NnT5VxZ:5nsuhIz8HpDuVHytj2/tRWdNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770242605, "uuid": "187281e1-c71a-431d-ae17-e15667be0780", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770242605, "uuid": "96ddc373-e10b-4de1-81dc-786f89287761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770242605, "uuid": "012be6b6-1a97-4b7d-9c97-b40349ea0d16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1109ec24-0219-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770244210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244210, "uuid": "70044be6-4e59-4a88-a691-e0963864026a", "comment": "Malware payload", "value": "160c9aefa21c1653bee79a6722ba23e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244210, "uuid": "1c09dd93-2e73-4e07-83bf-4b9bc038b4f8", "comment": "Malware payload", "value": "ec890897b98ab1becd75a33a0fcb434b25498110a60ee6d628832ec0d25430b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244210, "uuid": "85e91ad8-ef77-4953-99da-49e2531ea3f4", "comment": "Malware payload", "value": "d63280517c0e9aa4f6582228f73d8ff1c27a7aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244210, "uuid": "d57abc83-9f0c-4e2b-b794-0335db83f655", "comment": "Malware payload", "value": "b37cee9395c97887ca0cac79d43cdcdf51a8c94b47957ba3be31518fa5ebab48324a83dee2cdca294d5fe76c011ac7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244210, "uuid": "7696e03f-c8d8-45e0-873a-5b83527bb3ff", "value": "T168151282750CEEE6E86A8E3135BA5D7E43327FBF5694160AF18CB72D29F31409216643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244210, "uuid": "c049845e-6e79-47ea-b43b-4561074473a9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244210, "uuid": "5fab6525-dc2b-43f2-800b-0372ef74bfc0", "value": "24576:C1xv2D/yfY8Eo3ClaRAoIn624ZwXbjWbfQEnL:4N2rEYT/Hn62v244", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770244210, "uuid": "e9f2fd75-f5c1-44c3-8de0-e7388e85eec1", "value": 910616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770244210, "uuid": "73d37deb-fcee-4ce2-915f-25176a6f7ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244210, "uuid": "5eb61559-217c-4b6a-9c34-eaeeaff5fb86", "value": "rTT20_374USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf4978-01be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770205171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205171, "uuid": "8baa1338-089e-4665-904c-344f5c6a36c8", "comment": "Malware payload", "value": "20e283386181afdf0ca2b7dd3e4d2edd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205171, "uuid": "3a15a22c-9f12-41c2-9274-37d598cd2082", "comment": "Malware payload", "value": "ecb47aceb80a05178d89bc01ba1923c52d4b6e67d37f2a13fc7be299cd05aa2a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205171, "uuid": "7ae0f0da-448a-49e5-a8b0-7702bd203430", "comment": "Malware payload", "value": "be6bacacb8efcc0fc34192a73c0ab6ade90aebe6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205171, "uuid": "6bb71e3d-8330-4e5f-bce7-37a07292e200", "comment": "Malware payload", "value": "c590996ceab6254e1516a9cc63b74e129be4df047dcea319d4e54d22c602e3565a2ee4916f7a1ce9c4cd093cab5c4818", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205171, "uuid": "35e6a110-d27e-4c3d-bf7a-2e1d21dc3296", "value": "T1F3E36D33B615C171E59D03B868A56BBBC37BAD68CF7042C7A3849E7A1A305D32F31916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205171, "uuid": "71a0268a-5108-44e1-9c89-389f4723a179", "value": "5526b43f221834dbe17a1672e3091184", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205171, "uuid": "99dc5efb-53ea-4614-b681-7e9f5b106814", "value": "3072:RhvV8BSyshdIYAdfMtbzaSlqGDe9tRuF9sw8eXClxz:RhrxhVAAzJRDOE9swZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205171, "uuid": "807254fd-a4f6-4109-9acd-81f7ded7ec8a", "value": 145256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205171, "uuid": "55305bfb-8dee-40cd-9f19-3fc978a7fa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205171, "uuid": "7ca86dd8-97de-4bb3-b45c-baa8395645dc", "value": "tier0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14347697-01f7-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770229613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229613, "uuid": "5ac9d336-b976-4462-bf1a-eb0e62dbd89d", "comment": "Malware payload (UmbralStealer)", "value": "0acee274b9800d572919a59e22e7e953", "object_relation": "md5", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rahidstealer", "colour": "#218BDC", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229613, "uuid": "304066ed-75d4-46ad-8ab9-04e20b4d5dbb", "comment": "Malware payload (UmbralStealer)", "value": "ee1ed16a95f403719260eaaa0de75e1b5d9210e6dcc8f66af8fb03253cd1ba21", "object_relation": "sha256", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rahidstealer", "colour": "#218BDC", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229613, "uuid": "9def50d1-5713-4186-bad6-c55e78ffa7a8", "comment": "Malware payload (UmbralStealer)", "value": "67c979ab0320b1d1e156410d4ad670d41678d7c4", "object_relation": "sha1", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rahidstealer", "colour": "#218BDC", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770229613, "uuid": "e0db2cfc-92fe-4414-a029-0f1d1608af61", "comment": "Malware payload (UmbralStealer)", "value": "9812cf3b989f0b78e0b9dc91bad0a5e2eda6004ea733e4ab61817b13fddfe28d51c260a663ba4a8316c873bf89ba1b45", "object_relation": "sha3-384", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rahidstealer", "colour": "#218BDC", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229613, "uuid": "09f50454-01f0-48b5-94a5-1ccb0230d080", "value": "T1E5A43A8453F88E15F2BF8FB994B1195E87B2F403E979F74E048891D9156BB81EC60B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229613, "uuid": "7a6c2c80-2def-45dd-ad2a-4c8fb21a20d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229613, "uuid": "058f6283-a083-4056-bd0a-0444fb73242d", "value": "6144:Nj9NvKE4BYZ0o0WRSOiqvnCVz98beB/0eoAhiTn:zN4YZV0WLaVv/ToV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770229613, "uuid": "923c9e60-1cbf-487c-914c-666c8d9e602c", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770229613, "uuid": "8dbf33a3-38f7-4d18-a33b-acd892310c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770229613, "uuid": "1e260719-1854-4dbd-8bf8-5ca71b817256", "value": "ee1ed16a95f403719260eaaa0de75e1b5d9210e6dcc8f66af8fb03253cd1ba21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ce2628-01bd-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770205049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205049, "uuid": "da1391d3-e690-4dbd-b19f-01b12d0b4628", "comment": "Malware payload (Vidar)", "value": "fac6fb0ffb098f0612c37f8cb5a6755d", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205049, "uuid": "8df2e81b-5bc9-48bb-9113-58e36e4f641d", "comment": "Malware payload (Vidar)", "value": "ef3099ae05e0ebce1cdd735253e56791e55e69348dc90f980a7a926f2e9bcf26", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205049, "uuid": "5fe8fb52-88f1-40ad-b960-3b81cf24bbe4", "comment": "Malware payload (Vidar)", "value": "ef1dda8d2d9d6f352490de4eeb25296655923932", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770205049, "uuid": "d7a1ed28-1477-46c4-a222-e6450a923d8c", "comment": "Malware payload (Vidar)", "value": "ec9a69c5ff8dc30ab9f777e70e901815d092ec4183fb2f51d48d4090a8230f0aad019f973f2eeab16ab9a785780e14d8", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205049, "uuid": "f906b811-fbde-4924-8dea-145a2a7dfcf8", "value": "T17C86333FDD572A98A13917C4EF7EF0CF0A948C39CAC24A52CD1BD449CA44C5B36C9A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205049, "uuid": "725935ed-d5f2-438a-8287-335ad61168ca", "value": "196608:xlZoXOykFvDWNXZqoLdRSfat0J4IzR937QZeb1tQbBtDa:1oX+vDUX/afacrLQkbEba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770205049, "uuid": "5061e043-eda6-48f1-ba90-e153d7508426", "value": 8152608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770205049, "uuid": "528756fb-64e3-48f3-a4aa-092d888842e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770205049, "uuid": "ccfad984-558f-46c6-a9ef-c91d35b81555", "value": "f8g8gqwb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ee819a-021a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770244908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244908, "uuid": "f8941406-c166-4312-b0a3-0d3371e9f551", "comment": "Malware payload", "value": "afeccf2539c98a19282fc93404629244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244908, "uuid": "b6860df3-169b-4b7f-98ef-61a2bb10e519", "comment": "Malware payload", "value": "f0ae32914e5bf695aa8acdf5a238d5ed2a6f6b7d2b65dddc40b41f5bdfb52281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244908, "uuid": "83d08f59-c867-4740-b64c-4b0a25eda66d", "comment": "Malware payload", "value": "0bdb99ea766d97375a3f805274853032fc38efba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770244908, "uuid": "046a79f1-fa8e-413b-baa0-98b0165a4e37", "comment": "Malware payload", "value": "accaa3fa2edc939c7fa5fab7a3451cb749c9a9325622b753dbd4b4bff68102f421e4c62404f1f4a7846a80532d5f03b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244908, "uuid": "db884b98-9629-45b9-b940-f0b0ff7acb70", "value": "T13FF5F123F24DA73EE46A5A3509B29A50543FAE60651A8CA3D6FC3D4CCE390601D7EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244908, "uuid": "0bc6319e-d5e4-480f-b16c-85697c393d2c", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244908, "uuid": "ca6f4f90-e96c-4a21-97ec-86adda5fd55d", "value": "98304:NnfhrIkWR3uMooQbnoa2r2ku60fzZnXQE1pV:Nnfhr7wKo2D26kuFlnAE/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770244908, "uuid": "2abfbe3d-9ee5-4a3c-abf1-c92edb50ffe5", "value": 3383856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770244908, "uuid": "ac0c844f-24a1-43be-a545-396c1f18ae22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770244908, "uuid": "5e2e7767-e32b-4f5e-ad1a-82156781004a", "value": "ultrakill_yB-3iS1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fb72db-017b-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770176497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176497, "uuid": "13432185-2fc9-43b6-a1bc-72c1a4c3f87c", "comment": "Malware payload (Gafgyt)", "value": "9e0d940fe5016d6bed2b8a4cbf2704d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176497, "uuid": "393a0301-7c0d-415f-bd15-89087c2da5a0", "comment": "Malware payload (Gafgyt)", "value": "f1737980412a77ed477d8b1a44cb49c4da7a2aa6987a80a1883b74d217891082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176497, "uuid": "1f362b88-7288-462f-bb2a-d94bc48bf951", "comment": "Malware payload (Gafgyt)", "value": "a9f3426a38b604b31cb8c1b698f0f549800fab9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176497, "uuid": "aa510c5f-a198-4a70-b86a-52c440a6e076", "comment": "Malware payload (Gafgyt)", "value": "994450a153e4c3398ad2b8dea4e66284760ad9a72e1bbb43f6aa0ef13b2c4b3fefebb6acf1e059f0a594235c60a87e9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176497, "uuid": "dab67304-6dc0-49d9-9b21-ce3171d44d95", "value": "T11AC3F106D9C1D1B4F583523310875B4FB77AAEAE0414EB5AE34C3BB8ADB47854A4B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176497, "uuid": "6603206f-0fee-4d97-a039-25150f62e2b5", "value": "3072:qa3z5a9yc6D6X9SaJPfyP7KHVkrxZ3TrKrfJqa+dk+9n:qqm10w9rNarxZ3T0Jedkkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176497, "uuid": "c751e019-62a7-4f16-83ed-07ca7487676a", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176497, "uuid": "17f33976-933f-4533-8e5b-606c835c5423", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176497, "uuid": "5e12b664-df26-4066-a12b-2aa5c783a7eb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0158eb9e-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192644, "uuid": "26b26d26-ab82-4a3f-be1c-92afc0920d5a", "comment": "Malware payload (Mirai)", "value": "8282bf9926204683bfe48ef03888b601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192644, "uuid": "b88322f6-453c-468a-8e45-57fb28c51770", "comment": "Malware payload (Mirai)", "value": "f1cdaece1890026be4adc17b0d11a0a4eea9d11d953047edf8078bfa5688d587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192644, "uuid": "9b053f23-70b5-4bdd-bb45-f50a6b442862", "comment": "Malware payload (Mirai)", "value": "ba4bb5cb9bf0bcd09d79db2318e23549b95455b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192644, "uuid": "a977e186-f9aa-410e-8300-c1eac50d3959", "comment": "Malware payload (Mirai)", "value": "ea62a6c4c8d8bbff2d977d137a658fa329d684b2e7e81b557adaf72289d2228f27a96fc4d50b550a80ab57be486e7345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192644, "uuid": "a4b7690d-c5ad-440d-a5d9-3c1e0fdb61fa", "value": "T106333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192644, "uuid": "3969b0f1-2eb8-424e-9f6c-48aaf6c4a62b", "value": "768:Zw5A3X1eCZWUJ2SNpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98dN+s:Zwkt3NpOzwLMU431ANA0BLBCxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192644, "uuid": "0be8df17-6bb4-4cb0-ad23-826c76fb4ea9", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192644, "uuid": "e20d61c4-75c9-412c-97f8-dc2d875c400c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192644, "uuid": "ffb41b45-4cc3-4221-94c4-4a75db0d1926", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd8c614-016d-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1770170707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170707, "uuid": "1376c4f0-cb30-48bc-82c3-5db8cc0494cd", "comment": "Malware payload (RedLineStealer)", "value": "6ecfd7c88c153935cadbea2841d113f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170707, "uuid": "4651fc5f-8395-4ae2-b791-08ff327a2da4", "comment": "Malware payload (RedLineStealer)", "value": "f1faa923f5875168554785449c8af12cd96c402753c5bd0db5eac4ea37f7cace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170707, "uuid": "5c95ac9f-9331-44fe-8522-a356607d5448", "comment": "Malware payload (RedLineStealer)", "value": "f2448ab7b4b355881a1cb48c5914bbff90c97de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770170707, "uuid": "2dbaa9a8-4b5f-4f81-86ee-89854b54b38b", "comment": "Malware payload (RedLineStealer)", "value": "2aec23b5598278b3b34b6a58745d646b16004030253c842a899f4d664bc99930501696c899dd1419a6b4efe0ba3f3a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170707, "uuid": "eb44ef7c-5230-42e1-990e-607856f7bf80", "value": "T143D35C153388EB49EB7D463D54B0132646F0D0972A23EBDA4EC478CD3F26F9296126F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170707, "uuid": "d58cb99a-f48e-499d-ab64-d06e089effed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170707, "uuid": "8309d745-cf52-44b7-b7e6-36fd953b57f8", "value": "1536:xqz8rx/RmUJAD246dQ7mAfM6tdHn6Amf1ev2Bb0Gp8kfbvbGSYIgD1za5LEoW+du:x6xH77fM6kf1OKTxjZJ5LEYdVej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770170707, "uuid": "f4556382-8067-4d29-9aaf-06b839f950e7", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770170707, "uuid": "3ae5cda5-505d-4010-8998-50ac66d054de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770170707, "uuid": "9bf2a6b0-9c3d-4320-a1b2-24e9851002b4", "value": "6ECFD7C88C153935CADBEA2841D113F1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dc6518-01af-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770198826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198826, "uuid": "2984d9e9-d450-4386-adff-ef591e0cd50d", "comment": "Malware payload (MaskGramStealer)", "value": "10a1ad597114849b84fe647e3d1b575d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198826, "uuid": "9b9cf8f3-4363-4389-81e2-42c87220b6d4", "comment": "Malware payload (MaskGramStealer)", "value": "f2232ecfb77aa95085954504506190190cac0379430073acdee208fabcf2158b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198826, "uuid": "33421d81-65db-442a-a303-7fe0a36cda4d", "comment": "Malware payload (MaskGramStealer)", "value": "5cca318f287e1bc5289dfe17e679b55785b33638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770198826, "uuid": "96bc724f-0f2a-4ff6-8f95-f43bd4bd4eb3", "comment": "Malware payload (MaskGramStealer)", "value": "11f98475641fecd7617edc25fcbee73f4dc8eabdfda50d18855dc285a8ee524c6373e66e8f788364156b6b4e106d054b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198826, "uuid": "be9c90a6-ccd2-4fc0-ba6f-dbfe83b4acf1", "value": "T16507239699C553F8C0C38B3066C713DEB0D0715A86FD9D1E3ACA2C027A31E9B865B977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198826, "uuid": "de23f8ac-b996-43dd-bb5e-934f89c9fde2", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198826, "uuid": "91e334c9-0365-455f-b8c5-07f363c4e1ea", "value": "393216:PMZewfdDisrz80sicj4gVbDkEPqBr+opr+iX0SQ0Tn8r5S6TRbA:PMZnfdD7f8Wcj46bDqr+miikSQ0Tn8ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770198826, "uuid": "4fd54d09-ac92-4c99-b346-657be0ef5ec3", "value": 17449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770198826, "uuid": "9e84f51b-38db-4e60-a214-f31f198aecb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770198826, "uuid": "4ac55656-2756-4d11-9603-9407eb226b23", "value": "10a1ad597114849b84fe647e3d1b575d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7cdff8-01b9-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770203023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203023, "uuid": "ec5bf7cb-e0df-48d8-98ef-be1b0b0273d2", "comment": "Malware payload (SheetRAT)", "value": "c8cb63e00ad306d756e260630710b9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203023, "uuid": "01d4c8ce-3950-4fc8-a9a3-39596e19af45", "comment": "Malware payload (SheetRAT)", "value": "f2d6c54e4f79f143603d12eb00e6b4cbe9631ffa9f7c9de50fcecbc3a6b133d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203023, "uuid": "c573a125-546b-4e81-b8f2-e3bf6274078e", "comment": "Malware payload (SheetRAT)", "value": "348949843761cefb1304ae756963a2913e1a884e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770203023, "uuid": "0a7c973f-2b5f-4652-a980-e197c904a4a8", "comment": "Malware payload (SheetRAT)", "value": "4bd097d1b872a4e8ed8bbd2e390ebad1d9126892cdb76921c6e3ad83b42e24d4ff3df370f4947f244e89c35ca0d0ee5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203023, "uuid": "1c7d98d0-ece8-467b-9588-2ad6f641b0cd", "value": "T11CF46B152B988D01D140363D89BD3B09C725AEF12452A7533B0AFE91ED26DDEED3CAC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203023, "uuid": "6aa786ab-9941-42ac-b5fa-7a819eaaa402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203023, "uuid": "5b2e515c-8428-47aa-b9cd-167034e20d82", "value": "12288:w1GopAIH2JpA8QLn4G2yOrCQ4Js0Cc3Au4YucSi2EgB:01v0GuaJCQAH7cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770203023, "uuid": "ee341244-453f-4ad9-ba70-0719d033bfde", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770203023, "uuid": "62243015-b219-49d3-89a4-15568dba91ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770203023, "uuid": "7e9e6a50-dc98-455c-845b-576e23feae65", "value": "ElysiumCracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7a1065-019d-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770191130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191130, "uuid": "b0677d7d-06f2-4d66-ba9c-f2dd74b35d3e", "comment": "Malware payload (QuasarRAT)", "value": "621f9335adc99dd26b6f9114443ebe75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191130, "uuid": "39c6f542-32b0-4cc0-8d6b-ae83873545fe", "comment": "Malware payload (QuasarRAT)", "value": "f334860b2313bd3f5f8c6940ae51f68711c8ce4f3af185e24610064018c36026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191130, "uuid": "c6182e50-0d1c-410b-891d-15e69a28c87c", "comment": "Malware payload (QuasarRAT)", "value": "119c537ee2d4e48b572e364582ee4cbe48cf361a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770191130, "uuid": "785a6692-4bdf-476a-aec8-9cce43eefb53", "comment": "Malware payload (QuasarRAT)", "value": "8fbced171b84c3bf2ae9aa53e4180e620b710e4d593b639ee93de076aa50812a9f1f49d80d11095571bc438015f0bc36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191130, "uuid": "15d1f3f2-2953-44d2-9922-022d796bd664", "value": "T148A63359E7E414FCF4B3A2B09A618A12EBB67C9A4772C74F13B4115A1F233909F39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191130, "uuid": "81a0c11b-7b86-497f-b728-a571e9dd683f", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191130, "uuid": "baa77982-4e0c-474d-a976-8effc16c89a7", "value": "196608:9TcHwY17E/YyNgPZbnwWFa7PKnceE2EzqHsJiterJ058OT8M:AQBePtwWY7KtEzqMJGerK58O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770191130, "uuid": "2326d5a1-2d8d-4893-b886-52fd191de163", "value": 9902956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770191130, "uuid": "104f03f7-e417-4e2f-ad3c-bd6dce8f8dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770191130, "uuid": "6aa12e17-d96f-4b81-9764-8828fe50e53f", "value": "xf334860b2313bd3f5f8c6940ae51f68711c8ce4f3af185e24610064018c36026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6799bd7e-0193-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770186803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186803, "uuid": "a05f6517-b82b-4a70-946d-9d7779071c1e", "comment": "Malware payload (Mirai)", "value": "251d8533f3c0e0797165f927e31afde8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186803, "uuid": "1e7d749b-db49-40ef-85cc-1433e5962d2c", "comment": "Malware payload (Mirai)", "value": "f429f2987bad04075b042146bcdae14ab002c637be93b31fe39b0964217e2332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186803, "uuid": "b62dba0d-e37b-410a-9f99-1ef2a57c90a5", "comment": "Malware payload (Mirai)", "value": "57e136feeae003198b9bfa1a8c579aa419264ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770186803, "uuid": "bf247a14-783e-4d17-abd1-6aa049264b91", "comment": "Malware payload (Mirai)", "value": "5dc36899810de02f31d45eeffc0b6faf2eea6307a16449051351a602e129a676c3a5b9c692059d307a5d155277acc21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186803, "uuid": "87190e0c-eb1c-4568-b7cb-a1514595c0d9", "value": "T1FCC32A377B270F23C0CA107111E31732AAB5D79934B95397B9E16EAC6F1AAC43512BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186803, "uuid": "2a06c72e-fe97-462c-9c86-f4403f350099", "value": "3072:b3+PSYcfSo8Yo7Cgkj2rgsMCmO7FTF39ux4O:NpKXYhCmO7FTF39ux4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770186803, "uuid": "4523118d-1c97-4090-b2fd-dc86e568d9bc", "value": 122309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770186803, "uuid": "391b816e-6c3d-45e0-8013-59f723944e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770186803, "uuid": "09ab0ef7-9880-44f5-9e70-8171947173fc", "value": "pXdN91.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3fc9ee-017b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770176500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176500, "uuid": "b12e4143-57c4-4039-b8b6-32c0c3aeb76b", "comment": "Malware payload", "value": "299b32b645eae7e29a553ce938826378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176500, "uuid": "422ee574-e55c-4a23-bd7d-74eacde88a56", "comment": "Malware payload", "value": "f4d0b26085da09e8804d0ad119982f763673f941f9ce8c5454922ade3849a46d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176500, "uuid": "67a822a9-b956-436c-aa70-8f960f2c772e", "comment": "Malware payload", "value": "21773e99dccf0c8b4bf5e21828e1170666cd3f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770176500, "uuid": "214d2699-132b-4454-ab4f-a78e8cef3c79", "comment": "Malware payload", "value": "57aa84204bc11b236e9cd281b4ee184951a6b2cbf53279a7407c077a8ec5ad6be8297c274d140a19da749b56f4a3d787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176500, "uuid": "61919d73-f55d-4162-b520-c8c78f4f45dd", "value": "T14D04E182BB400F71CA62D17140F3D702EBFA27D616D29747A73CD9146B99788781FEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176500, "uuid": "49255576-fa10-42a0-8622-ff9d0076dc93", "value": "3072:kgfKVeEOH4lcgjBNDhzBVh+Rc3T1CnKpkXyLzk+2FufHf6XflRAn5upATh9MBgL1:kbNR1FzBVhEOvkkzkY3upAThmB4ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770176500, "uuid": "8c87c6ad-17a2-4e86-8ae7-b41a59979c8e", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770176500, "uuid": "2c979ee4-d123-4691-b709-6c4cc3e36fb7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770176500, "uuid": "c7e9cb65-958f-44f4-8898-6557fab5cbf2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e566a5-01a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770192659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192659, "uuid": "53d6e5ec-f153-49dd-a6d5-f8807ab65e93", "comment": "Malware payload (Mirai)", "value": "6a92458a7642455a50a44533b518753a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192659, "uuid": "153a1795-3b74-430e-9ac1-0ef8132a8b36", "comment": "Malware payload (Mirai)", "value": "f5d72fc2d4815915fe0a4b83cb0235b36602f679c63a32575c97d97baa796bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192659, "uuid": "ef2f15d9-6cc4-4c0c-92c1-ce576025073f", "comment": "Malware payload (Mirai)", "value": "ca5600adc5a24a57a6528963410d06883fd3e3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770192659, "uuid": "51c3f7d5-2f66-4a80-817a-519128e3f436", "comment": "Malware payload (Mirai)", "value": "79517daa8d2e17dbdc416d05bbc4970b66091cc326ca2db1ad5b8f1a510e5302d9a6460b9b3aa4cb10b30e755d8c89b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192659, "uuid": "f3b99587-7d55-43fa-8c37-1fadef16f883", "value": "T146E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192659, "uuid": "de6947f1-5864-4824-81fd-4559be61a2f2", "value": "3072:KxjJw1Cc/0s6YAPwenUr48pzfR+JonBy:Kxlw1xAop0YfRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770192659, "uuid": "17d270ea-e395-447c-a367-a0899e0a1dda", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770192659, "uuid": "408a78b8-05cc-4b4e-87fa-47b1d9e67f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770192659, "uuid": "c4a08577-a642-4321-a801-76fea576be34", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e769e748-01ce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770212358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770212358, "uuid": "142ebc51-fc01-44e6-b524-812bf43c5fad", "comment": "Malware payload (Mirai)", "value": "1a356e52fd5086a3a4938274f07a5033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770212358, "uuid": "87f64fdf-4c7d-4423-8e33-14045808d29f", "comment": "Malware payload (Mirai)", "value": "f7665c5e895a5bfb622f5a5e4e604d55cdb899e723746f93285acd8d4fbd22e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770212358, "uuid": "acaaa9b5-8737-4f4d-a08f-4dc387439fac", "comment": "Malware payload (Mirai)", "value": "dfaaef555e956b7f3d3c79339820e29f435b6a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770212358, "uuid": "cf165f23-dc82-43b1-8ca3-a96de0907d9b", "comment": "Malware payload (Mirai)", "value": "2b07a0a54869fb086b81893313f46330213b9e96e2003608cda5ce76b29b60a4635740680c1d480889ee521138f0bd30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770212358, "uuid": "1084734f-ea14-41fe-a233-849f921fbf43", "value": "T1C7330985BC929A02C9C41376F62E11CD372663E8E1DF32079E226F1177CAD2F0E67646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770212358, "uuid": "62a848d9-3790-491f-9336-fc4c0741986d", "value": "768:jA46Ihj9eRNKqSASQ83EzTMzSpeT3QoODOHL9BNOJ8504zm60N/:J6Ihxy4qSASQgpzSYT3d+Yx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770212358, "uuid": "ddb84c52-de5a-4cd7-aa6f-b94a3f16de21", "value": 54832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770212358, "uuid": "1d29b431-2709-44e2-80e7-dffb932004c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770212358, "uuid": "0b9fa8c4-2266-48fe-ae5f-663704dea028", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7ec4ab-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770210296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210296, "uuid": "0a5b9896-6e45-4f0e-aee9-0577172ef9e3", "comment": "Malware payload", "value": "de1dae54446dc90b592d17d380af541f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210296, "uuid": "30d4a481-ee3a-414d-b597-e113a2e7920e", "comment": "Malware payload", "value": "f78d04abe87da3fcbfe7e85b9de37effac02310afabfb6272f0d17d1dcadb65c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210296, "uuid": "570a1b61-7be7-4bf0-baa2-e776e41467ae", "comment": "Malware payload", "value": "ae79887e3eff89c54cf018eb0cc8074b7e3b682c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210296, "uuid": "65315a94-9e4f-4fac-b0f7-97f2e41bd420", "comment": "Malware payload", "value": "10fbbc75887e999af3126a6873d033dc3b97408a7c6d2cf604447e073a53e6735edfc2ea09e427a0e482919eff518ac6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210296, "uuid": "03dd2af3-18af-4434-a572-90da4adae395", "value": "T108E512BB98B2A9536A514663EB4F2C1A339B18D53B14D342E941945C7F3B0D38FA2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210296, "uuid": "d7e42dd3-35bd-4490-b46d-43f82ef624f1", "value": "49152:fOc2yD4lTPtI5kP/8k2+bXtvpNnyOESKDXIftlKaqco8PyCuduAFlId3OMU1vHv5:foyEFPtI5kPkc7tvXny3SKDclQco8PyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210296, "uuid": "668c5d91-ebc3-4532-bc90-d438f0d645f3", "value": 3080730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210296, "uuid": "1d820eb0-244a-4a09-9e50-3fa9b79d0a4f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210296, "uuid": "391b594c-bd12-44d2-b612-2b321c4227e7", "value": "DRAFT BL-113.200MT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a50738b-01dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770218080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218080, "uuid": "2551f79d-ee28-42f1-9b22-26af3644b392", "comment": "Malware payload (Mirai)", "value": "6495b0759cc58a2a3cd9657733d6f1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218080, "uuid": "8398cd5e-067a-4d4b-8fcd-7e1e4b18161f", "comment": "Malware payload (Mirai)", "value": "f7f35a281d6449ba8a75f3cd4ad61196d0e99c5b7e1d1e39d045a65aaae3fdb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218080, "uuid": "518b85e9-e8d2-4d72-afd3-3a08c8f717e2", "comment": "Malware payload (Mirai)", "value": "3dd5b2e7360ce471b5d4896350897e4691df4973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218080, "uuid": "f538f329-203e-49ab-9e84-38506542c8d3", "comment": "Malware payload (Mirai)", "value": "4fb71316d10da2ee8d71795039f846c89d68877353fe4695d74f6a8293f1c8c24748bdd208af90d3f8d77b95a19205ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218080, "uuid": "7974ea94-b58e-48fa-9595-5af275d86e89", "value": "T12A935BC1A693D4F5E81610701537A73B8A35D47A2275FF83FBA4EE76AC92B40C5063AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218080, "uuid": "88e99fa3-5c62-4e1d-ac19-6809e5bf607f", "value": "1536:Cl7XIANcoKinFObL5q8/YlKy2yOw7CRasK6C31A+nQAZxOFWDpeBDZH/ECEJ:CXNcoKink5PwlKO78aOCFAnAsWF0DsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218080, "uuid": "ffd1b49d-1f8d-4adf-8e7a-77378ac9bf9a", "value": 96244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218080, "uuid": "1aeb0be2-bf69-4607-8675-ecf5f127be90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218080, "uuid": "83cf3a1c-532e-4287-88f4-8e7f5a942d69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67ba67e-0164-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770166830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166830, "uuid": "68824b94-f3ec-47b1-8545-f04667c9745b", "comment": "Malware payload (Gafgyt)", "value": "2b8f33334017aaa5bad768a21894edf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166830, "uuid": "b0f33051-a96a-4f4a-ba2f-2518108ee2da", "comment": "Malware payload (Gafgyt)", "value": "f8729f600425aacc76a03b9f0e8eb3e2161e9e32a663ec1bb1176cac9a4fd23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166830, "uuid": "fdfc4a74-f46d-4553-9214-95ae86311821", "comment": "Malware payload (Gafgyt)", "value": "d3c94ad42a244f524e0118d5585b75f566eb709c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770166830, "uuid": "9536d3cf-9eb2-451a-b19f-a373c2a28f68", "comment": "Malware payload (Gafgyt)", "value": "892102679fa7c66492c10b92217a3f86137c03e7473124839e9f78dbe81ef529e13b87a45e98a1bc6c1712cf0308fe31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166830, "uuid": "75389aba-2b2a-4ac9-b2d8-5cadd9271111", "value": "T101C31A377B270F23C0CA107112E31732EAB5D79934B95397B9E06EAC6F1A6843516BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166830, "uuid": "a9b425d4-27ba-4c47-bed0-825d8e6d227b", "value": "3072:H8883o8fD9T6p4osy4HCm5tTTFmGruK4O:FSXFvHCm5tTTFVruK4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770166830, "uuid": "db507e99-3e38-4094-98d4-de78c0c9e939", "value": 122505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770166830, "uuid": "580c6ac4-ce77-453d-926c-b95d3a66880d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770166830, "uuid": "f05dcf40-dd7b-4594-aae7-8ab5d61da745", "value": "pXdN91.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981cb6ca-01c6-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770208789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208789, "uuid": "903a23f4-b179-4093-b808-27d78564571a", "comment": "Malware payload (Stealc)", "value": "5f57b136b630fe69013418c29a9cd0eb", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208789, "uuid": "dd2a01fd-e4a4-42c5-9714-f167cebbbd7a", "comment": "Malware payload (Stealc)", "value": "f91e1d24b25e0231dea241938a1990362fa1e49d7f048bb91c036d2317161eaf", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208789, "uuid": "b4ed0818-ae06-4e33-b723-088adc23b52b", "comment": "Malware payload (Stealc)", "value": "219909f28af9219fe4474798e47e06106f5c336c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770208789, "uuid": "0596e17e-458e-4128-8524-5167b37a1038", "comment": "Malware payload (Stealc)", "value": "dd36be8f7e54e88b653b9c0422e68eeb5849d2a6c27568a95ebd3ce2ca6fd57e823d5a9f42f15fed848a78ccbbe449fd", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208789, "uuid": "03fe5523-9b0f-4f9a-a6dd-45884f136ec9", "value": "T1BF265B92BE40C665C6DBF13EE86191956230B808073126C36B751FB69D2B7C4273BBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208789, "uuid": "11ee9faa-b881-4429-968c-f2d15580bdab", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208789, "uuid": "8ad7c4f3-aa24-46e1-98c9-9fc12ac2c0d5", "value": "98304:1+WGo8wRd8yPrg+cdEuxznsBpRoNvlPnyE0/D97N:1BR7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770208789, "uuid": "525b1d3d-9243-47c8-bf52-6620a3c5c91a", "value": 4430464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770208789, "uuid": "a111c160-a7fc-467f-bfd1-3052b1b864a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770208789, "uuid": "d534614e-b232-4534-9231-50e3924f9b1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf68c63-01de-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770218944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218944, "uuid": "8e217d83-0ea4-4828-8dcf-d517f666be96", "comment": "Malware payload (SantaStealer)", "value": "be0e7aa84d2e0eae2d5905dea734ec8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218944, "uuid": "83f1a023-01e2-44ef-aada-6ff609202cd6", "comment": "Malware payload (SantaStealer)", "value": "f980bdaf2bc4bdeab07339710a05f4874173d1ef53e420856c210f6a10d8da26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218944, "uuid": "cbc6a2ee-8013-484f-91f2-f00566ed432d", "comment": "Malware payload (SantaStealer)", "value": "6d5718935a651606dab21f697843052738c6ac66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218944, "uuid": "ded0aa74-9bad-4296-848a-67685130c40c", "comment": "Malware payload (SantaStealer)", "value": "25f9fe4e2d206a3abf441b1747a21f14be68defee6ea3b6344e322410a586f0141b6b9349396018eb2d967d230ad5c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218944, "uuid": "ea14f127-4283-474d-954a-a8a444f5ce61", "value": "T126A6BFD9D16E44D2DC053FF9A8142AC79B2446328A7400683A6F7D898F774FEC05EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218944, "uuid": "ac8b752d-6980-411a-af00-5e7e9ac2eb00", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218944, "uuid": "0c1260f9-ee41-43c9-9c48-3d0bde37b114", "value": "24576:Qo8xwVg7ftS93x6Hsxeyt39tacwXOBRO68jHxihwYMmhyABpZlxPXubBGnWXtOqn:Qo8xwKpS93xvBnAXpTDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218944, "uuid": "43d729d1-1b2f-493f-8dcd-95724c5fd2fc", "value": 10045318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218944, "uuid": "dea01c4c-5af2-49f6-b7c4-0ac240a15609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218944, "uuid": "8fe0258e-f285-4b8f-ad59-b7648ad5276a", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876db191-01a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770194158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194158, "uuid": "a2878bd0-9e82-4ace-92da-7b70478149c5", "comment": "Malware payload (Vidar)", "value": "df5b5ed68b70c628dcf5b56ea0f9d643", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194158, "uuid": "25e6b761-0885-4091-9a61-1067602e7daa", "comment": "Malware payload (Vidar)", "value": "f9cdee92579af46bd346093552eae7a034253c8f999d83ffc274f1f6f87a7374", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194158, "uuid": "887881f9-ef96-4d86-8c0f-9018d4cc8e30", "comment": "Malware payload (Vidar)", "value": "1a66cde83f358092dbee7560e04fdd7cca2a142f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770194158, "uuid": "069d12f4-7cc8-4106-a9da-357b7cdc8707", "comment": "Malware payload (Vidar)", "value": "0578a363f432152a3bd384e56d8cda549a77c9938bdfa75653ac0082d1015db7b74c6724c4a5dc03cf07e24c81317da5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194158, "uuid": "36586680-5f1e-4a18-a0e0-836aace9b868", "value": "T19C364B2B72A0D1A9C15EC63AC0E3DF00E5F371791B33C6E752910368DA969C99F3E664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194158, "uuid": "b5549fdc-8d31-4425-bd5b-1405a1685d3b", "value": "71f78f4628cb6313a1d0643cb0123fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194158, "uuid": "038b2fca-8e14-4e8b-b007-0e596bae7341", "value": "49152:nbDzejgtRPTasHYMJ8DUAGxxYvSikQSVnRYOBS1nBE/4AB6C984CfqNzAf5:umJ98zwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770194158, "uuid": "63e3aca8-e2a7-4e88-abd9-2b4394cbc345", "value": 4951552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770194158, "uuid": "9ca7680b-e986-435a-b3bc-05b6583645f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770194158, "uuid": "9fab4d19-1d7f-4565-a424-a379e1fc2464", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bcfb76-01ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770210293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210293, "uuid": "dc3e94aa-ebe1-4e89-a792-e2bf6c0112db", "comment": "Malware payload", "value": "8341dd02e4ea02855d2d98eb26ac75ca", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210293, "uuid": "866fbdc1-5171-4fc8-86b8-0400eec43a10", "comment": "Malware payload", "value": "fb10cd116026ce4912245d49d329cb1208c565734068374d7864a149f73f2992", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210293, "uuid": "d19e7ccf-4f84-4ffa-a80f-99a099090c5f", "comment": "Malware payload", "value": "0e81c14a388d6f299c2e9cb747567137119b07ba", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770210293, "uuid": "22e3be8d-ab66-417c-8105-6569008366cc", "comment": "Malware payload", "value": "c3b32643d7f890cbc619438b3ec9c7c552912cbca61b1ed02bacebd3e7131c6795e5536b1e683400969e788b76fa4eee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210293, "uuid": "16b49281-6296-47f8-ac63-91c77412f38f", "value": "T1E5E512BB98B2B447AB504667EB0F1C1E335B19D43B24D346EA51915C2B7B1C38E92B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210293, "uuid": "7d8985dc-5533-4142-82f3-c122f666a917", "value": "49152:ROc2yD4lTPCOYl+i2Ru9s/+M6LUzVAqtNjcF6+MaC5mKxzP0wR92HYElQ:RoyEFPCxK4vi7tNjcHC5Tfm4UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770210293, "uuid": "796e118e-85eb-4d07-986a-38be31440d9d", "value": 3053011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770210293, "uuid": "f6d62d3e-06d6-418f-90e7-076ba43624b3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770210293, "uuid": "69d9b5db-6a25-4c65-808d-bf87bed86ce9", "value": "RECN60443P50R855.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf72d007-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168053, "uuid": "c3dcadbd-9800-4e1c-bee8-24340f2466f5", "comment": "Malware payload (Mirai)", "value": "d767367ac046d34b4da916ac0f53c2ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168053, "uuid": "927f566a-5ba9-4950-a54d-18566b9a8e01", "comment": "Malware payload (Mirai)", "value": "fba5e44480027746d461101cab68502a951d67427e89a14c7d708ef2aa0e2866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168053, "uuid": "e63f2793-5fee-4beb-b74a-4481ba30eebd", "comment": "Malware payload (Mirai)", "value": "143c399128215047ca509a7c71f5df29e2a6e499", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168053, "uuid": "a29007fd-75d7-4d54-a9e3-a7159040359a", "comment": "Malware payload (Mirai)", "value": "bb560fdb7d212479b01bf1074d74dfffaa8296d2fbd9af35c59cea5fd754281efffff767ea7b66d8cae4ea00772f71cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168053, "uuid": "da598050-745b-4d05-87cc-ca28312d7f1d", "value": "T1EBE2F1A3D3719052DE746AB2FA69C5CB6BBD4ABCD27B30B3060566182D5B0435F3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168053, "uuid": "676ea212-bde2-4e2f-ac02-c00ed60ee60d", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9Xjzxwj9q3UEL5I+:Porm1vpALgUJnLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168053, "uuid": "65a63a85-45e5-4f36-988d-f4d4bfaaea76", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168053, "uuid": "e16d29be-c261-4049-a143-a99dd83ccf31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168053, "uuid": "712cfbd2-c973-460b-b518-d73d55bcb6fd", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f46df4-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164540, "uuid": "fd18043b-fc59-4ef8-9a01-65e40da61d46", "comment": "Malware payload (Mirai)", "value": "fc7f1c2e9f9a6b4245e90f8887cad77c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164540, "uuid": "7ddf1793-c9bc-4d2d-b273-c901b4864aef", "comment": "Malware payload (Mirai)", "value": "fbde972873326b792c10b884486b7e5eebd700c94041b5c028922b1a1d52df3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164540, "uuid": "515783b0-6a95-4cf4-b6ae-c382e74cd8cf", "comment": "Malware payload (Mirai)", "value": "3df5b01a0dc45dd7e2d1a01d4cdc4d5c5f12b6dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164540, "uuid": "e5d96234-57cd-4ce2-ba37-0e5358739977", "comment": "Malware payload (Mirai)", "value": "2f3d7c197aebead7ab75897ec1430805a089a3ae3b968781eb2cb2d5098987dac6937a24c201497a0ffbd9f5f9be82f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164540, "uuid": "63091c96-b764-43d2-b1ac-3808aad77663", "value": "T11944F60AAF610EFBE8AFCD3706E91B0625CC541622A83B357674D928F64B64F16D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164540, "uuid": "45c39054-9a36-47b1-8a86-e27f6542d06a", "value": "3072:ORHNiou9QNjSFSSpXTJmg3UqW9PUzLIZ3fT4Nf85fwbZnBl3US5:wHItFSSpDUX9PQuP4+wRBlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164540, "uuid": "5a0a0e0d-394d-48ec-a615-6a8d63057a7c", "value": 277452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164540, "uuid": "050a289f-cd98-41bd-a40f-cc1f35c69664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164540, "uuid": "ddd81fcf-d7f7-483a-b13c-3b6a2b23c80a", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b771c4d2-01e6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770222585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222585, "uuid": "7bdd24ea-9a2c-4cb7-8686-3019244ea0a8", "comment": "Malware payload", "value": "53907416c93b649e531cb35afdfa386f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222585, "uuid": "946e9412-dbdc-4934-a77b-c206efd32d16", "comment": "Malware payload", "value": "fd366de9001eda4177d71cc5260c9f6bf66aa30a6a9e817a0c1fb399cf5facbe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222585, "uuid": "917ab8d3-e963-4e45-ae0d-e6f1c7582852", "comment": "Malware payload", "value": "a94ee79d47db9da36de4bb6baaeb37c798e55dce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770222585, "uuid": "ac4f1432-8160-4a88-aaa9-3626de33b1df", "comment": "Malware payload", "value": "ab3ebfa82b3499210fc1d097b1ea94cdeaa4a5f312f59a5d05a0bbd47960f56abf773a4fcc2b175971f97f1132bb5d76", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222585, "uuid": "1946db98-529a-440e-9d06-b2258a2c26ff", "value": "T14F8633E5A3F108F9E9E2C13EC2B58159E262B45B4B65C3DF576006522F27FE1493AF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222585, "uuid": "a77be80f-1caa-4eae-b792-2f15ec1c87c4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222585, "uuid": "c6e4d422-6cf8-4a78-bad0-8153051c54e2", "value": "196608:0O+zA1HeT39IigwTauDXURuA1AG/kCE3:0Of1+TtIiF2uARuA1kCE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770222585, "uuid": "5ba6c42f-6c46-42a9-8ddb-584185f46dcf", "value": 8590395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770222585, "uuid": "edd8dd1a-470a-4170-a979-e8c8169803cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770222585, "uuid": "be4f0ae5-ce3c-466b-a6d6-acd49ff9376b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8463a8f4-01a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770195441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195441, "uuid": "dc65fe9b-3078-4897-8f6c-f054f0431a92", "comment": "Malware payload (Vidar)", "value": "ed9cae5668bd81292745d3c34ec91fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195441, "uuid": "bbdd7913-75bb-4d94-8e10-c472f8d67673", "comment": "Malware payload (Vidar)", "value": "fdc2e491b81ad69a9c6d03745ea590a4d7f937cb9d0fbc48341fa084a18471e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195441, "uuid": "27a454a7-563f-4a19-a4a4-4d89b980cee9", "comment": "Malware payload (Vidar)", "value": "7176ceb245acdcfd065b9738463148d86d84880d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770195441, "uuid": "b9ba0960-d392-4d6d-a6cd-0ebf9a98946a", "comment": "Malware payload (Vidar)", "value": "42859bb795151401387908f91e5818fce1454076f3a8f785945e4ff8d9ac1f8c0f98ecceec3cb48e9d4415d49ba306b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195441, "uuid": "58e95c48-aa4d-4681-b87d-a0649119e841", "value": "T17B464A02BC9559A5CABFE23495B02392B635385903713BD35ED81AB60D3AFC4273FB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195441, "uuid": "af1d606f-5017-4743-8b22-bde377fa8ee4", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195441, "uuid": "0688a962-5fe8-4eba-9708-d55dfdb59870", "value": "49152:qiaY7/nU2BrvTUbZQDPAJyTkOt2XpgvuNEzSxIYBmH8FKLwvALXrK1YQRPAJyTkn:BnUMrXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770195441, "uuid": "c638d859-64c2-4952-b789-0dd489d3cca9", "value": 5533824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770195441, "uuid": "ce4f6a7e-b244-486e-a9d0-d58bb057a674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770195441, "uuid": "fa9ca9a9-5bda-4297-baaa-aea11c2c17f6", "value": "xfdc2e491b81ad69a9c6d03745ea590a4d7f937cb9d0fbc48341fa084a18471e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0774e730-01de-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770218854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218854, "uuid": "1b69b69f-dfe5-43af-a1c1-9f636a26538b", "comment": "Malware payload (RemcosRAT)", "value": "6b6f0125fb058d21b2c3adc4891cc47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218854, "uuid": "b9394ae9-d38f-49e7-9a44-b2c9a87d36db", "comment": "Malware payload (RemcosRAT)", "value": "fe2dcfff84a13a6ef8835a51a70d8d7b77e98635fbb2524f4fc03b5cb5f9a62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218854, "uuid": "d6b24c53-5e3e-48c2-9ef8-f0ed266572fc", "comment": "Malware payload (RemcosRAT)", "value": "bab9e32cb02900477d6576fad32bbf762acb1d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770218854, "uuid": "f6373cf8-0dad-4b7b-baa1-8dc8052ab4a9", "comment": "Malware payload (RemcosRAT)", "value": "2cdf7d32474a03c9185a509d21a184dbff35e40f7d175cda935b58fae273954224fb98700c9492345987bcd688326123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218854, "uuid": "e45cb2c5-83d9-44b3-8095-3234638b7c84", "value": "T125A4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218854, "uuid": "4fc400b4-4761-48a4-b348-510a4b14c96c", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218854, "uuid": "da64338f-967a-4f41-a5f3-5821cb272b07", "value": "12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSnn9:WiLJbpI7I2WhQqZ7n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770218854, "uuid": "43b52c57-5bc6-4ba9-9144-c0287abdc988", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770218854, "uuid": "c7ad007a-3b3b-4aaf-a9ed-ff80ba7be803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770218854, "uuid": "08583746-8814-432c-8aeb-8db9e1de6e30", "value": "remcos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d185bc6d-020e-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770239809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239809, "uuid": "42177257-ff91-4605-9459-ea34adbbf94f", "comment": "Malware payload (AsyncRAT)", "value": "5bd65ccc52c1b900dd5a80b22a4b81bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239809, "uuid": "a8aa0722-d2e4-4722-be20-e43764740d73", "comment": "Malware payload (AsyncRAT)", "value": "fea32668a5200cda959b27c6d39cb17e57136e41a9ffd717c12061be1bedc128", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239809, "uuid": "06e5992b-45af-471b-85b7-9b6ce564afd5", "comment": "Malware payload (AsyncRAT)", "value": "da37690fecd3efce69de5b32667445a8e91e4d59", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239809, "uuid": "324cbb17-51c5-4d00-a799-0b0dada1796e", "comment": "Malware payload (AsyncRAT)", "value": "33d8bbe35b5f07e2576315d2407c28831bdb347d5e97e45bf2025737f764fa5d2ff99c310ade5055f41e580c9eb91828", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239809, "uuid": "915c07d6-5e59-48af-8708-440158f0f5f8", "value": "T1E6034C087BD44229C5FF6FFA1AF365460730F5079E13D78E1CD8995A2B27B8489007EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239809, "uuid": "2d01359f-b984-4e92-87bd-62287506d8f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239809, "uuid": "14ea7be4-31d0-408b-889c-b5ce3b2d577e", "value": "768:ghDsK54vEGcEY6AH7iihGg3MuFa98T6TOMh73E:ghDbf9EY6OiE3/Fa98T6TOMN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770239809, "uuid": "9ee487f5-8704-43a1-8f47-e83b0bfaac3d", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770239809, "uuid": "7c0d77fc-cd96-4c15-8477-d976faae7a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239809, "uuid": "a7729e93-5345-455a-8338-530bef7cb449", "value": "xwormyu2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adba278-0187-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770181547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181547, "uuid": "03aad71b-bd09-4471-b0eb-566526e03a97", "comment": "Malware payload", "value": "6f7971d929962f44f54e545f28665a9b", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181547, "uuid": "a68f7a9f-12ef-4bbc-afc1-b5bc92beae47", "comment": "Malware payload", "value": "ff0f49b7d2c52925f3c10680bb365fb1727f44e676518c3808f176e6a239c6aa", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181547, "uuid": "2b6d58de-7f3b-43a4-8ca9-d9b494e75927", "comment": "Malware payload", "value": "a91baf7f6e4f5f4f6e17069f46cccc45e8c5a786", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770181547, "uuid": "b44a50c1-12a0-4199-91bb-8de3abcf11af", "comment": "Malware payload", "value": "95d29bee0fc73816c3e67e54f0dd463717aed5338d00a5a8a3541436d074646953b166896c3dff8b7dbc7ebf8743ea50", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181547, "uuid": "f5d3ff44-1b8a-47e7-9150-9e7532cceddd", "value": "T14412AE2EC746004B7455AD3EBCCF8A0BCC11924834683AAA8E73D36746D656BC04EF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181547, "uuid": "319abf6a-315c-43f3-be84-682a126a5bff", "value": "192:thWDeJ1gdHpH5edOAQv3VfdHKu7UXBXdRjcQaPJ/Hcv:+DxRpH0OAyZAXrRjcrPVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770181547, "uuid": "d43b126e-0edb-40e8-a99d-c70ecd10e4c6", "value": 9350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770181547, "uuid": "78569542-661f-4288-838f-eafcb5bf9958", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770181547, "uuid": "47c26870-5beb-45a7-aeec-f424295d7264", "value": "ff0f49b7d2c52925f3c10680bb365fb1727f44e676518c3808f176e6a239c6aa.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db4f73d-015f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770164506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164506, "uuid": "ba15d170-db9d-4086-a4f1-649db86112ba", "comment": "Malware payload (Mirai)", "value": "9493ce852a213d61e953777bdaca4a8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164506, "uuid": "a2fe87fb-ebd4-417c-aea8-5aeb48a7e22f", "comment": "Malware payload (Mirai)", "value": "ff7abe97e0fc15a834ac5ec241fc5dbb76b5f40a2f7bc973a24f9f1d2c5254d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164506, "uuid": "8da51a44-aaf9-4b52-8924-88bbd5733c1e", "comment": "Malware payload (Mirai)", "value": "d589dcae524b66e01036ac28507ef8129e74d1ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770164506, "uuid": "d1139c65-89c0-457a-b86a-4f09b10a28c5", "comment": "Malware payload (Mirai)", "value": "3c48d0f1a102aa399e50461d728cf25def1252463383850373e25edaf52038605aeb89a6eff6fdcf0140cb15a2751725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164506, "uuid": "defd60ea-4f84-4caf-b55d-25de3a4933bd", "value": "T1D383125FD104B057C93AC4FA03B656A7EEFD4EA67393C0A2E210AC474A15A383D8CD90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164506, "uuid": "ec39ff8e-fb91-424d-b1b4-447804e6faf9", "value": "1536:r7n6AClpnfyM6G+xkRQAni7t1w9mCyzpkYzEr/ItNJXUVqY7:affgGvi7t1cmCyVl+/In1UVqY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770164506, "uuid": "5a128d78-a720-4a5c-b38c-77024d6b3f87", "value": 81904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770164506, "uuid": "f65218f8-de9c-4b37-aa4a-0caa43035e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770164506, "uuid": "5a66eba2-a8b0-407a-b09b-c48aee0f3cdc", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931a7ea7-020d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770239275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239275, "uuid": "89470d95-65cf-4caa-b266-82e8290aa93d", "comment": "Malware payload", "value": "ad0485cebdf17b4083945576752aaf69", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239275, "uuid": "a2520b50-08c6-468a-b9b9-905b46de4721", "comment": "Malware payload", "value": "ffa4f084fedb8e0b3657fa1ab27f47cb89a98efc59aa71b6f7ab9661df97afb7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239275, "uuid": "2711d93b-fb49-47c2-a91e-d5f0ad05616d", "comment": "Malware payload", "value": "a2e7c2501fae308ba7b356f5ddfca9aa96d80da1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770239275, "uuid": "1d0cf1a0-ee31-49f0-9dc8-d25e8154530a", "comment": "Malware payload", "value": "58e4f1b38b6f3109369c3be18fceabdffe3758f53dda3478addf957dffff72ee4d0e8abb685505e7c89b6e09e64cb8e6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239275, "uuid": "59b02780-d3a0-49c2-a246-27da846ef36f", "value": "T18146230B931DA2E5C10E68F0A18058E173AD3E141568BBFF9A41F92B9935EE7D07F436", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239275, "uuid": "4f0ebabf-07d0-4e92-8318-2bffa662076f", "value": "203d63d5d9a088e2d84cef737227986b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239275, "uuid": "b42b1871-df55-438c-a249-553bcb1f2d65", "value": "98304:O6kA1NaU/Y8BW2Mtct8GJB1SA5xIxzg3j4CH24zYUzYXo+jhc1VjxELMIVUpwt1a:O0kUdWVs8GJHP5qNQ4F/UzYY6hPLrV1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770239275, "uuid": "910389d0-b4c5-418d-9ab4-e44c50e53986", "value": 5502296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770239275, "uuid": "555deb28-d54e-404f-a151-7c0f75729ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770239275, "uuid": "9e17eb90-687c-424a-bdcf-497cc442f91e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d004592e-0167-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770168080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168080, "uuid": "b821266d-a1ae-497e-9731-d95435c95b85", "comment": "Malware payload (Mirai)", "value": "576671cd54beef472d186847e250b0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168080, "uuid": "b1f3c573-92e0-4d41-9a96-f8887256398d", "comment": "Malware payload (Mirai)", "value": "ffac588e77d49640941d63f3674844633793caa5edf8eebbe7f74a60a6cf1570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168080, "uuid": "11bba32e-58e6-448d-ac63-09e59f4b35cb", "comment": "Malware payload (Mirai)", "value": "0369a976622a3663597f8dc23f79acbbf0392dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770168080, "uuid": "eb7760c9-f698-445f-a590-ea1bbe8d7ee0", "comment": "Malware payload (Mirai)", "value": "39d7394a3fffb3b9a8ffec574ec829ee8decb6e86b77ed33f6aaabcd9c08821692fb16a6b61b5b3ad5342c98ba2a2acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168080, "uuid": "762a770a-96fe-41fb-bd13-25cd0cc8e2c4", "value": "T1ECE33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168080, "uuid": "f6d54d0f-6ca7-447b-ae42-84ea7230810c", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVS2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7Wgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770168080, "uuid": "1f5291c9-da67-4df9-a543-e4a76a361a93", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770168080, "uuid": "29b40daa-c5ea-434c-9387-97011fa0f6d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770168080, "uuid": "0ac9ccec-32b9-458d-b6c8-4731fe08012c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3d51f1-01b4-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770200850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200850, "uuid": "4441cbbd-6832-43f3-bb18-b722a9935576", "comment": "Malware payload (QuasarRAT)", "value": "6e80f1ff721d8c1bbae10cafca6070e5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200850, "uuid": "32ec4956-50d5-4efc-8a4d-f8c5d4177c79", "comment": "Malware payload (QuasarRAT)", "value": "fff8ec58e389bfcec03ca66fe8bee39b849a948174472de91eb160ae35b78365", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200850, "uuid": "17a6cbbe-cf10-4308-8d4f-bc1e86deb15e", "comment": "Malware payload (QuasarRAT)", "value": "2c7d41e4a8d05d7ceffaaabbc3032532e195b569", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770200850, "uuid": "914c41ca-f4d5-4a4d-8241-b5ae2c20d9f5", "comment": "Malware payload (QuasarRAT)", "value": "83d55e3b6b244d2e614f3f6531cc13d98cb1fe16c4cb287c27cb670c445c63cb9a2037dece94ea567b093cb759c78ecf", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200850, "uuid": "5557b9b9-bfcb-44bf-b4c7-38b1fd3fff1d", "value": "T1F916B0F33495B994CDEEE65F865F8728732A1282B713118C179F0E94CB2394F7B8458A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200850, "uuid": "dfa8177b-09fe-4644-9730-a3f7b3f8b1ca", "value": "24576:3XYSse6R2smZhoAZSxU3CMdXEzFxYih8nbtG1yZxbwb3L/5MNIQv/Ly+iJvhKv72:32s350FN4tVpfL8ZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770200850, "uuid": "ede2aa85-7de6-493d-ae2d-ef27215e0780", "value": 4350326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770200850, "uuid": "170aa980-2c27-4267-9d7b-de27b78bbcf0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770200850, "uuid": "f99b8c7d-541d-4263-b804-e46b3adc8af0", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }