{ "Event": { "published": true, "date": "2026-02-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-25", "timestamp": 1772064182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "db5261fd-48ce-4484-b628-bb5f8b6312bf", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d71d0db-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012926, "uuid": "fc9b46e3-c0af-485b-814c-8e0b4d073dd9", "comment": "Malware payload (Rhadamanthys)", "value": "65026fb1e87a8bdb4f27736934e57ecf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012926, "uuid": "3d429d16-8a4e-4f63-9ff6-a93a827aa687", "comment": "Malware payload (Rhadamanthys)", "value": "000c6a9baaede5cf815fdb32523be04e41dfd77d61446a2d6f41cac8df8e0a1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012926, "uuid": "d0d66445-a98a-4931-8a23-db82f6ef4176", "comment": "Malware payload (Rhadamanthys)", "value": "c262827ecd70f6cdc3667f13262348c53e9d429e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012926, "uuid": "5dfc6847-672b-4eef-aa53-9168e0e80c18", "comment": "Malware payload (Rhadamanthys)", "value": "5c8c07532a17f427b016114cd70f522e77b8d9bff5d7ac14a2c587f724efc97d070faf189becce3e30c889f4c26680ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012926, "uuid": "13ebd4d9-778b-4245-a8ba-b89f8907c677", "value": "T1ECA3FA008E355CB483BABEB818921DF7CC778001C59265CE645FFFE5289DF0AA85766B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012926, "uuid": "656ebbc3-4220-4715-808e-032891dcd3f9", "value": "3072:GDB7b0QwVJTTaZFQET23KKSkQOZMePveKj8bS0iOGXzu88PCsRmJfvh4yRBufrcb:0vhWZZWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012926, "uuid": "bb1a8c9e-af8b-460c-af11-1ce88e58c665", "value": 100757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012926, "uuid": "71584c8c-4ea8-461b-b42b-99b0ef639b0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012926, "uuid": "284f5b0f-5801-4e49-8c06-8c3fa2707efa", "value": "invoice-1637482117.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3086c6-125b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772032122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032122, "uuid": "abe0022c-9122-456f-b675-838c69e75556", "comment": "Malware payload", "value": "123649f4a5e4c59b4fc411a55ef58064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032122, "uuid": "44ee779f-89b6-4997-93fd-bd61c70f034e", "comment": "Malware payload", "value": "0032f58d680849a26d4f9615e1001842fa80d9b1c7fa762066fb9f4b4adac179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032122, "uuid": "d889010e-f83c-4497-a9e2-7c06ddcfab97", "comment": "Malware payload", "value": "a31bb220e4cd192ed84f4cd95abf9fb1605b8a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032122, "uuid": "409b1c73-4e6b-4e04-a8c5-2f3cff0c431e", "comment": "Malware payload", "value": "91d103b63f736a9a8ed164ce1fcb3bbfd80f0c629e853e3050301010006aa43afc7884be693b660760b18ed913cdb3b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032122, "uuid": "a4d56270-8474-4313-b507-7d5322ed6fb8", "value": "T13C8299C3E3C49BE7E616B72722D66D2D970E17D8C17B50883DEBD20B226DC619209D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032122, "uuid": "6b4d3fda-208e-4c74-a957-a36cc5098f2b", "value": "384:o2PhoVoT5Udoz2FtYomZI+J/+s28P3YL63wKmTT9JCfnqBTTxgexRbueQOCA:BuST5Uiz2FtxmZ9JGp8P3aPTTjTTxgeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772032122, "uuid": "afc8a82f-819f-411e-b82c-9aee1d5c9396", "value": 18915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772032122, "uuid": "03f5f888-edf1-4d7c-a26c-f201722152f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032122, "uuid": "83fc51a0-ed1d-49c9-8bc8-d2ba844d6c1b", "value": "09c1d5_517eead1213c4963b14c6661c6988b54.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55f3cc5-121d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772005423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005423, "uuid": "14025ad9-cbfc-4d65-a3ed-369aa20db7aa", "comment": "Malware payload", "value": "8f2ed3558f628b1621524bde2d69710c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005423, "uuid": "c9e0e556-d952-4f07-a1e7-3c794a271b7d", "comment": "Malware payload", "value": "0087b1ca4ea11cc67541ab94f15d4f5b1835002fb13fb9ef5b7d506462c367af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005423, "uuid": "13065578-2ba8-4bd5-8c98-225d050f673a", "comment": "Malware payload", "value": "b73a82424f8962362b0998ce0a7ba4d597d7e1e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005423, "uuid": "47d3135c-3e22-4430-b9f9-ec8b12860f03", "comment": "Malware payload", "value": "ab0409f78e98f3aaf3d9c0c21a453f1bed1e48588368d07f1c6c9eefa6f7b5a174b14ce012043ac19511b42f39190c80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005423, "uuid": "48b3a23d-16a6-45f5-a25d-c51ef04b7b54", "value": "T192923BB806497C34F7C1DE799E3C6F09AEE881C42124E39DFA0F3A215E516ADD70935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005423, "uuid": "d94b9bd3-de57-4a37-8e5e-b063ebdc2d04", "value": "384:k5k/xNd9xaBTfJs5P/lzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:k5C/aBTfGNzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772005423, "uuid": "4576a2d6-9ce5-4613-8737-7694245ee2b9", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772005423, "uuid": "bfb4c854-946c-489f-8828-70cbf26032d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005423, "uuid": "8c44d99a-0b5b-4df3-b74e-a742e7ecb18d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114dc697-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051533, "uuid": "d9943d44-4412-48c7-b684-0c4eeecf1cb6", "comment": "Malware payload (Kaiji)", "value": "da51a0366f0db5d72cf9a86a4eb2847b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051533, "uuid": "76f08fb4-d27b-4fc6-8272-196811263024", "comment": "Malware payload (Kaiji)", "value": "0088509f1ac99fd21921ff6a7b1dfd4a1d069f33be5e12cb8416fadae8a26984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051533, "uuid": "ffd4905a-ef16-4e8a-981c-cff69deb89ae", "comment": "Malware payload (Kaiji)", "value": "74bc93bacb4e830c007d91ce15b884acd8a5a633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051533, "uuid": "2f153e8d-9b4c-47b9-8add-b28f36b51cc2", "comment": "Malware payload (Kaiji)", "value": "241f324abcc7fb091ad577e5f2135882c6826788b0c2f71b0feaf3ae0a197b5b72af459b893ba829e2db15e2c11934fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051533, "uuid": "75cfbace-fc0e-4725-9e4b-5eb00e0f0f7f", "value": "T15E463943F89095A8C1EED13086629293BA717C895F3463D32F50FBB92B76BD46E79310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051533, "uuid": "cc70bf94-4ace-4aa7-b9c1-89ff1d7384c6", "value": "49152:7Xa6xzZWhrb/T4vO90dL3BmAFd4A64nsfJPJ6TdXnT9aqeJaz2xNkapDnYRQoj1n:b2ONLBzSxtST7ElHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051533, "uuid": "dfa71760-8480-4a48-ab9b-c4962fe077f3", "value": 5435392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051533, "uuid": "4c8412ef-15a2-4a22-965f-8fcef522ef87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051533, "uuid": "dbf59296-8be4-4c2e-b8f7-106ab6291856", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231537cf-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051563, "uuid": "6e2a50e4-2901-44eb-9a22-544fcb7d6015", "comment": "Malware payload (Kaiji)", "value": "b323e66f13ee4732ee6ec90307dfdc69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051563, "uuid": "abf9c00e-ba02-44af-a1c1-2917b874705b", "comment": "Malware payload (Kaiji)", "value": "013377e56592c9cec7b94add7d5584d1572ee9c1346d4dfa4f10b1168070172e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051563, "uuid": "a5de6d99-9195-4075-b835-757833aed975", "comment": "Malware payload (Kaiji)", "value": "bfa80e276ab455b199680a413608294097f2ae81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051563, "uuid": "6c5b2c57-9558-4817-8c85-f5186fb95f0f", "comment": "Malware payload (Kaiji)", "value": "6ab83d9fe920c91c1d6119d4ab80e00ed086be3d8fcb25c462726eed586d7a01591d22f8ff2efb87c2e9073d851d132f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051563, "uuid": "51c24d65-6e0c-4b26-8d9f-e93c6981a426", "value": "T16D365B65BD5EE462E6C833783B7193D4323EBC489F4192235610FFAE99F67688F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051563, "uuid": "f959929a-8f64-4e58-9652-17eacbbf3e48", "value": "49152:7H+5dH9Zq/34LCFNoUAFKVCsZ5EN2q3OY2NXxB1:r+5dH+/34LCFNoUTVCsPEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051563, "uuid": "5842992b-67cf-4f0e-8930-2d7adb7e2393", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051563, "uuid": "a9cf328f-53d8-46a3-bc1c-38d4ec0b04c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051563, "uuid": "45bb3fb8-f5e2-489e-8a09-e523e92aee20", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5963f9e1-1295-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772056808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056808, "uuid": "b8407779-9a10-45c5-9fe5-2a08a22ae941", "comment": "Malware payload", "value": "dd6c9f93271fdc21c123cf3e6ea294b8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056808, "uuid": "552fb273-9377-4c03-a71c-589cb34d2f84", "comment": "Malware payload", "value": "0134b6f54e0f662f76082cb4b131096d540f71ab4abff93ef0a99f5e97b1f094", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056808, "uuid": "6df9e1d2-7a82-486d-8f55-ea3c16d8fb99", "comment": "Malware payload", "value": "3f15632d021472b98fb2993f6504ecea0cc5793b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056808, "uuid": "eb9ef19f-ac1f-4e4b-8ae6-17093801b3c6", "comment": "Malware payload", "value": "05843bd17f79fde80d124b1ae3c15d9f8028593ddef80dd80e51797ccab8fd733a5da6de2ec020af4592c168d5c91d63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056808, "uuid": "bab46d8f-bedd-404d-bdd5-4035dcedb8bd", "value": "T14D3301A8C85E6546C1DD49F1084BAC2FF8E0165DCDAB6712818A13D0F8D1EB622A7B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056808, "uuid": "fa9d97da-790c-49e5-a8b3-547abfb9b40c", "value": "1536:rh9DzyJd03h97BOgTa8ls1soOFlxRGapm:r3DmrmD7agsCFRGapm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772056808, "uuid": "06b5c655-2d1b-48be-bcbb-91ebda5a53fd", "value": 52964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772056808, "uuid": "c73cd13a-ed0d-4b9e-b1a5-f7fde113a49f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056808, "uuid": "394b3d9a-ca24-43fa-b1c3-42f207047d9c", "value": "Annual_Review.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959aca85-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017395, "uuid": "62a03bbc-75d9-4b91-ad3f-54b04ecc3f0a", "comment": "Malware payload (Mirai)", "value": "ef9d34c8647f049f82157429c64d0513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017395, "uuid": "3ba04ec3-59ed-47d7-a777-7d06aea2c54e", "comment": "Malware payload (Mirai)", "value": "0260f7c239b5741341c84b2334222c98a8bfa688fb058472c2ac390b039ea100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017395, "uuid": "b7c8ecfb-d28d-46c6-8f30-169b37d5933e", "comment": "Malware payload (Mirai)", "value": "acb59b0d2f66394bba3f69f7f8433a9bab2bb3d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017395, "uuid": "3a0237e9-45ae-4bfe-a319-75fb4ccff528", "comment": "Malware payload (Mirai)", "value": "8a440ea58f01e3158dfb2dd63cfa0c7b06fe21dc01f841eeed3e21421b0ffa224632d8b5c00690532a2bdba1fa86cd24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017395, "uuid": "198184c5-d74f-4d02-9f3a-d7cfeb818374", "value": "T16A82DF3052AF75E5CBF10431EEAECEC6971A0BB8D1FC369217586B78898210251F87DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017395, "uuid": "0e26031c-372c-4430-af64-2c1adb025b8b", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaT43+IhymdGUop5h5lE:6/V0P6+kom0tVAoNvm+to1T435s3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017395, "uuid": "7e9625a8-ba8e-4daa-8f81-a5e3ab8630db", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017395, "uuid": "50f12bbc-f208-48c8-b0a3-c09d7e85c578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017395, "uuid": "56d9fdd1-4f76-4b30-b60e-f097993f1bc7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ba4b0b-1284-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049586, "uuid": "2268a0e2-a5d5-4fb3-a156-41e14d55143b", "comment": "Malware payload (Mirai)", "value": "b2ae8da26fe88b5432a6790c09579cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049586, "uuid": "84848641-786a-4c52-abb0-d37e398783b2", "comment": "Malware payload (Mirai)", "value": "035d44ff97ce79ee9847878983532ff0343188ab6c48e16b21a69ed154984f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049586, "uuid": "110b700d-bea7-48c5-995e-de22f54f7e87", "comment": "Malware payload (Mirai)", "value": "d29dafe1c301192080aea65ef9127142f5fea130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049586, "uuid": "74c52fe2-b216-4372-8eb4-874284c0c024", "comment": "Malware payload (Mirai)", "value": "1a89954cf0bc40e63cdca6301c303c66fb9fbffef46fa9a651e1a14df596abed52c65c45cb9a7d67cf209ffa380be595", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049586, "uuid": "43b87153-98bf-4408-b257-35ca177b6206", "value": "T11483D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049586, "uuid": "af25cbb3-5ca2-4f29-a793-016d8076653d", "value": "1536:iVLyu95Kuokj752dCexuV/8UZlDwfkJ4MYfWz:iVLyMgsFezxu5VD1e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049586, "uuid": "9e39889a-1509-4389-bd72-e260b5b4e14d", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049586, "uuid": "f995318f-ec1b-4b40-b32a-c3f49e8480bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049586, "uuid": "d314880c-1b87-49bf-8d9a-3ad6a1b9ee75", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1b187f-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017408, "uuid": "7cc5b307-1693-4189-9a31-ab7b6621c85e", "comment": "Malware payload (Mirai)", "value": "d626895c9c650b6adc3adec005449978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017408, "uuid": "9304ccfa-eba5-4f21-ac05-0e3bf9f70680", "comment": "Malware payload (Mirai)", "value": "03eba2113e1ce14bec510ab7c3cb9536886d9cc46ec02936538a610104ff09ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017408, "uuid": "0b501c47-5977-40d7-a69c-a606c1d1d24a", "comment": "Malware payload (Mirai)", "value": "863d9a907b0ca226bcacc3e63e12f4d90977c93c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017408, "uuid": "67cffcc3-b7e7-4da1-999b-ba6e0596890b", "comment": "Malware payload (Mirai)", "value": "024d1f55cbcdb9acd432905e158c15e91575bfd5db82018914404a4221aa857afe46d59f12511dca29b9c99fb70e869e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017408, "uuid": "476e7b83-a18a-4124-a0f7-35e423474239", "value": "T1A3C2E0E07726FA31C420AC3DE52B4D8A3A51067C90FF353764268D359EC1A9A67F84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017408, "uuid": "5c2918a6-c26d-43cc-b97e-9115075f0738", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrc9q3UELuJ:NKy4qfqoeJdXWglLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017408, "uuid": "3c823496-41a1-4c98-b415-a48398def5c5", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017408, "uuid": "b3fe945d-dc17-4a25-845c-99faacd39a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017408, "uuid": "06a2d254-f873-44e4-8b58-32570ed0b20b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd71ad2-1256-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772029945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029945, "uuid": "e71e8c04-29ca-4e7a-a161-937bc3ef369d", "comment": "Malware payload", "value": "586fd4df94683f5177e9ae00a926372f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029945, "uuid": "c8840c00-5df8-4354-b1fb-506cf8aab377", "comment": "Malware payload", "value": "0437a7bdffbb3425189efb0ab7570f377bb255782cf0e31f69d4f17c1b07c0ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029945, "uuid": "012d7595-f306-42bc-9f30-320aa1bf24d0", "comment": "Malware payload", "value": "e386b0795b60734bf7393ccee5f306058c247111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029945, "uuid": "7659c6fa-4d8b-479b-bdd9-efb036601ad0", "comment": "Malware payload", "value": "e262953c2c3e3e3113871ab96e1326d40220bae7975a68f574d970d2705b73df81f74fc189c039e0b5080677d618bac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029945, "uuid": "7e1a0d6f-04ee-4b94-953d-625b1c2d28e6", "value": "T1413523161AC4A965F9445E70863E50A37BFFE1251966AB035F088BB827537C9AF0F331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029945, "uuid": "daa2e983-b6c6-447b-b3ea-8764a86d6cbc", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029945, "uuid": "4fb709a5-e9e7-4488-b993-a7bf91dac81c", "value": "12288:ygineAe+uyuCzU96/xpjWvH9aF6I8Phv7dYxSeUqVR9+tQxlhN6LkitYBKqsCHiI:yLnepyhT9WlaFGtdYrHR7O2y/FCtQ3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029945, "uuid": "f99ce1cb-af8f-47be-8878-8038e6d51a32", "value": 1059664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029945, "uuid": "254d8f52-c5c6-45cd-a591-4efa51596db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029945, "uuid": "3757e535-cb99-47d5-aa01-707c4b12ca45", "value": "justificantePago_es_76458745966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a055ab-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991981, "uuid": "36e1ad89-e697-4a21-8ad7-42e2e4d4b68a", "comment": "Malware payload (Mirai)", "value": "6e2e890e4b1176ab69fba48226b4177b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991981, "uuid": "fb599f8a-64f1-4492-a9db-70475fec906a", "comment": "Malware payload (Mirai)", "value": "05986837193a910afb7ca31dce0e3e40a394f122da2d8adb7c77d5c20fab0904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991981, "uuid": "20a0cedb-4055-493e-8e69-5542ac46ac54", "comment": "Malware payload (Mirai)", "value": "0c63978edaf50d45ac13a9de00cbd8e8a05b9139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991981, "uuid": "62c3a17b-10e4-49ff-89d2-119e11008201", "comment": "Malware payload (Mirai)", "value": "6187eee26b7470bde917b0b458b5ab9333019d83e6c74fe26166a2916ba1bcd83770cb8f0d1e3bfe380d7521ccdc0806", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991981, "uuid": "778e16d5-1e79-4ff3-a8e0-355679c72491", "value": "T1A3A32A7680645EB6C012A4F065B9DD310F257DD31B6F1AA46278B7A04A7F4CBB08EF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991981, "uuid": "9be5ccf9-c50d-4721-918a-5a42dec2f9b4", "value": "1536:P0Bs5JJkmUZtBaNwXDvTbPf3H9Q6d0RHisiy:P0kwmUZtB9XD/HXBki+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991981, "uuid": "f16ef23d-fbd6-410f-a9d8-3726c8c2b12f", "value": 98824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991981, "uuid": "4681baf3-513c-4d96-abcb-a2f728b2e468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991981, "uuid": "5d400932-3c77-4819-be25-32f891e5a15d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1e43dd-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013081, "uuid": "97488da1-a6c6-46c9-be33-c48ff0c3f770", "comment": "Malware payload (Rhadamanthys)", "value": "955c157c48f26a08898ada30b3ccece1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013081, "uuid": "6338dabc-79d4-4407-9333-b7694a34e00c", "comment": "Malware payload (Rhadamanthys)", "value": "06ec1f8d66cc4bc6643cf202eb64675297e9c0ba7f8d46a20c008cc88442f4d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013081, "uuid": "e692867c-cbb0-484f-bb82-00639d070d90", "comment": "Malware payload (Rhadamanthys)", "value": "317139842a2f187988f6a024bb0952c148bbf692", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013081, "uuid": "f27996d7-a34b-4034-9058-8e415968008b", "comment": "Malware payload (Rhadamanthys)", "value": "4de379ced3ca838a63b712333d6d2ede7cb91905499de27eb94ec67cfc34ea3d90edb225b51ffe871f6b3aac96abe34a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013081, "uuid": "950987d8-1d5f-43c8-b7d9-fd2f715213f1", "value": "T17DA3E71B2D12BCDC1671DCD6AE18CDF5890F85475621A9A2DCBABF30043BB19685CACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013081, "uuid": "c3034f08-a1d7-4e88-bcff-a00ae156f668", "value": "1536:GDB7eKg20UX7drrFa6r8ZsOJqBrlWACuzSpIs8ArFtlBCtDK+OHuldXOZ6BkQWJ0:GDB7b0+hLePA26BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013081, "uuid": "5e3429af-27d6-4226-b2b9-318eb436d8a3", "value": 100090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013081, "uuid": "ce01e619-1519-4fe0-b4eb-404273d5e809", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013081, "uuid": "ff99f3d0-c809-44e4-867d-b8bb2f5e4d74", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e2f83f-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771992034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992034, "uuid": "99efc32f-874f-4d1a-951a-73c3d4a2d87d", "comment": "Malware payload (Formbook)", "value": "9590a654cd44db8a51cbe025252b8442", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992034, "uuid": "2ab9bbfd-426c-4878-900c-8d68352c212d", "comment": "Malware payload (Formbook)", "value": "071dc520f5524859f2de1ce11ed1e1fb0f0ba50dea82c9093d031d19e43d01e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992034, "uuid": "ccaeb38f-090b-4e84-946d-e45b96b0114b", "comment": "Malware payload (Formbook)", "value": "e5906150d683bcbb0d993733c216d9fda4ed1d3f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992034, "uuid": "440c0754-1b83-4c19-81be-7df3de63052d", "comment": "Malware payload (Formbook)", "value": "f40f851541de162ed5f807fabe0ff1355391c9a8bfb36c2e7d7772ff93524067c4526cd6a4451da78fa63cce8cd82351", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992034, "uuid": "7fcb1b33-c090-4947-a620-5d894c0e338f", "value": "T1A2E4335C9B81B3C1EE56184E270DE85F3D486D3FF8D9F2B2440F305A692C244EA7A62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992034, "uuid": "ef43bb89-017f-4dd5-8a74-055356f1ebc4", "value": "12288:BdtmDV69AsPgyeN4ymsXzDbp8T7OmES4du0HX/RQcCU4qL/ANFt:BrmRrzmfT7hES4du0HpQcfLIvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771992034, "uuid": "b571daa6-6002-4b4f-a8bb-8c43759aea60", "value": 710601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771992034, "uuid": "f6690449-4521-4f2d-9ac1-f56872b70202", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992034, "uuid": "1dd50272-74bd-4500-8388-bd73c7b9f77e", "value": "DHL_AWB#6078538091.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e53a88-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991995, "uuid": "ba457970-f601-4177-ab62-f6c86a638308", "comment": "Malware payload (Mirai)", "value": "e57fe061839c434f21d3237f703d7554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991995, "uuid": "bd215730-da91-4219-b4fa-fa7ba03fd0c5", "comment": "Malware payload (Mirai)", "value": "0777d670afbf79d3e262581249b9670f46dcf4870a0a544936f6c505163dbc2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991995, "uuid": "bb41dd75-d0e7-4ed7-9eeb-003fc8cd891a", "comment": "Malware payload (Mirai)", "value": "3227de0e6dc531692b3f9b3a46f139d5c18733a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991995, "uuid": "0817a083-3bb0-435d-b3d1-5e0a2bdc662b", "comment": "Malware payload (Mirai)", "value": "413fbd81846e0ccd55405c34f03c2a36d1b299c2c1d5ef48578e053816cfd4cedca1d73d6fe12b436b4f5da3af446799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991995, "uuid": "fc7db142-8c84-4b5f-9fa4-001ef468e9fb", "value": "T13A830976E203D9B2D40310F211A7EA7B5E20FEB71471A986D3653F90EE334C26585B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991995, "uuid": "5b71a313-7e2a-44d4-8596-3f3631a732fd", "value": "1536:jJYE8XEdrovm8wX2JypNSig9Wxk/DkhWG:tYE8XKroBwXp7Zg9WEQhWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991995, "uuid": "502b1b98-3a9f-4019-95a4-be9476df6987", "value": 88164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991995, "uuid": "0653decd-b83d-47ab-ac1a-39629e51e1d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991995, "uuid": "cbca1b7a-d5a5-4031-af3b-d10622837a2e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a30c1a-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045584, "uuid": "77eb42cf-c02b-448a-9e91-b80b16b1b3c8", "comment": "Malware payload (Mirai)", "value": "38b32b48854e3c556f3b00f1ca77b8e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045584, "uuid": "213e737d-34c5-4e08-9404-bbcc5ee674a5", "comment": "Malware payload (Mirai)", "value": "086cea439e51f5c06b1c7a9f35e42ca52aacf1f19dc6a5cbc1659f02a4fc3ce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045584, "uuid": "512454b1-4909-477d-a791-b84c44fc7a2d", "comment": "Malware payload (Mirai)", "value": "0e0e2575026dd317a42dd1cc884db1c73330ad56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045584, "uuid": "19419e26-bb06-4297-b0dd-9777b1021b6a", "comment": "Malware payload (Mirai)", "value": "d70f5e06b6ac109b1f0bd8d6ca6c115053a8d28601b24c77bf324c1c9f3d3829a139f2c6cc0a16adcfd64f515f8805c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045584, "uuid": "126c11af-d2c7-465e-af70-6e2385ac8c1d", "value": "T1D1B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045584, "uuid": "4e286330-b10f-4bec-965d-81d48eb1c736", "value": "3072:MDVLSItJP+Xsp4JlN3HBjmH1cuEgvniuN/:MDV+ItJH2l3HBjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045584, "uuid": "4d26b6b0-3f0f-40ab-9aaa-5b74277d0c01", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045584, "uuid": "581b6513-520a-4db4-9b65-e0102e94e5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045584, "uuid": "4a764e1a-0a1d-4d0f-ace6-5f853f2418bf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503e5f23-128b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772052498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052498, "uuid": "f2739385-155c-46f5-984b-895b2b78562d", "comment": "Malware payload (Mirai)", "value": "a2f23141cd57754ff65240e10ed36f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052498, "uuid": "b093758b-7949-4147-8cef-a14f7b297a22", "comment": "Malware payload (Mirai)", "value": "09a33efc39807d04a19ae1382b5500b452ee029f0a2ce4d2a1ae365e3195ae4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052498, "uuid": "a7b44d3d-d3ae-4c67-b59c-ddb3bee9ecb3", "comment": "Malware payload (Mirai)", "value": "c2b76221caf26d430c878a7b04015e8fff83ce53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052498, "uuid": "d3232421-368f-426d-9476-060a2a08952d", "comment": "Malware payload (Mirai)", "value": "6d038493e77f75f604e658304f505f051504f75e3d1aef0641c2f50ec6bb62d892bf1954a6c191e79510c71cac34a31e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052498, "uuid": "d698c21f-5d65-4527-9eb3-4e1e90ae8bac", "value": "T104F2E15893080ABEC35DC0350F660399E6690329A5534F2FF994E787EE058FD7C8A9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052498, "uuid": "98c207c2-d263-40e6-a4b9-ee9d6412eb9c", "value": "768:4FMpBkCVD3n8uLYe0KAT/sLB9G46ziZsHnNFn6g/TVvg1cJgGlzDpbuR1Jz:Au8sYexg/CnsTHnNTTVvg2VJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052498, "uuid": "e47b5109-1076-4efc-a1f6-3bc5205ca2b5", "value": 35704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052498, "uuid": "8e67773b-1c00-4ffe-9ba2-f51d03095c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052498, "uuid": "5e92d290-ba1c-474a-afc2-4fa208425486", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4d7e42-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991986, "uuid": "51b9505a-7eb5-4434-8a8c-de0150056d20", "comment": "Malware payload (Mirai)", "value": "27d93de67b8cafcceec7fbda5a1366da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991986, "uuid": "ea063235-596c-464f-9740-8f86838d26f9", "comment": "Malware payload (Mirai)", "value": "0a2088bfc13fdddc84d626b5405a9f3e3eb570c0bc28cb6499e2eaab0e945497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991986, "uuid": "f314041e-f7f8-469d-8707-3f3664b54a4e", "comment": "Malware payload (Mirai)", "value": "35502b796b22908685ddbd20f8fe13bdbc3b2f97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991986, "uuid": "4501e56c-9012-4385-bd00-158e9099a94c", "comment": "Malware payload (Mirai)", "value": "f836303f546de618f52f0fc510b02fc91cc9fb984952633ef61564f2dccc56dac23506fac9b7b963d6e30da1f2b3197a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991986, "uuid": "6c4a410f-c0a8-4223-84b6-933f6cc46d1d", "value": "T12BE3753E7A11AF7EE168827107F69F70DF5929D326E18240E26CE7085E7128D1C9FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991986, "uuid": "f374848d-eb4e-4a37-bf5d-702064b15cca", "value": "1536:+EvHUdcrjBnuEVZNbaie2rKhtTmaTtW5cAYaPWHaTPOZZQlaXoa0NnrWeDspNKhR:a8Bq4NYa+HaT1w2WYsjGERstf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991986, "uuid": "20752e4f-0a7b-4bb9-8dfb-9ae356ee164f", "value": 147776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991986, "uuid": "f1af8d5e-144d-4d6c-b3b0-133c8b37e9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991986, "uuid": "525704fd-34e3-4f72-a13a-d588ca7b9c72", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6684d5e-121d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772005532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005532, "uuid": "64e229cf-0084-41ae-9d68-7d8cbb5906d9", "comment": "Malware payload", "value": "be603aa6fd1078d236106ad4d9516e63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005532, "uuid": "2c5afa60-0df4-4758-9a62-2c202b0d7653", "comment": "Malware payload", "value": "0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005532, "uuid": "665028a8-2962-4126-b4dd-b93970a4ed54", "comment": "Malware payload", "value": "ef6b5a29cf2aff05b650236512f19e1dfcf54817", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005532, "uuid": "6c85b3ee-12de-4df0-adb2-04cab78a0325", "comment": "Malware payload", "value": "71e61c0a142a7cfd626391bf0093c7578fc67542908bf8b2d589e5cea9029cd5f40b0bb93505efdecfaad06a07ede2b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005532, "uuid": "6c089372-cce9-4b49-b3ce-f872313900f8", "value": "T11BF1715630D2ABF011DD417C1FAB2098A691052F6D0E3C65BE5D7828AF3D6C632F83B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005532, "uuid": "029bf4d0-fb39-4854-bcca-6a75404f1350", "value": "96:2OsqmLI/14ZTNBzuSDzIrtpTzq8c93IS46KtIUUpU/vqQ7i7ocrJyJTT1:2vLkcBzuRc3I96Kt7MUXFcrMd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772005532, "uuid": "9f41441f-faac-474e-a85c-b5c726f80643", "value": 8194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772005532, "uuid": "cd39982f-08fa-41eb-9795-8b0ca286e8e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005532, "uuid": "735160d1-1165-4c44-8cb4-d435e6daa8ba", "value": "macPatch.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4377d626-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003084, "uuid": "e04c3dee-89a3-4159-a69b-0fc13ae48ed0", "comment": "Malware payload (Mirai)", "value": "2872b9fb87f79386ef2dfc24d3e0b4ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003084, "uuid": "69426dab-e995-4421-a566-196e93f8f067", "comment": "Malware payload (Mirai)", "value": "0b5db13b09dae805c3162f7dd53cd7b1ae8fa875aea3b5afd8fa82742f09d1c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003084, "uuid": "441a2fff-0a73-4122-b7f9-29cf7e71f544", "comment": "Malware payload (Mirai)", "value": "b94c6dea04b931f5edd6bd2ef4facd264c612ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003084, "uuid": "f51e9f21-5f4b-43b2-b9c9-24d38f95b59b", "comment": "Malware payload (Mirai)", "value": "415cd36dfad7ab987f13fc018cb7411b9d9885b03bf70524c9260c06758e61f3ffbd0c8295816555d206af67a2f4d43d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003084, "uuid": "5ae0b6a8-9d7d-45d5-8907-25f6edca2163", "value": "T18D835C42B70C0A43E4570DF43B3F17E1C3EA669121E8FA89690DAF4A92B5E325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003084, "uuid": "1b269185-f88a-4029-af5c-0acc16c4fb1b", "value": "1536:dz9VbQTRWYfbJDQX1m5Ck8PtC09gXBfdloNjDrIe+pj/D:V9VbQJ6FmskEtcfdODrYjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003084, "uuid": "a29daf48-0068-46a8-94be-57102c99db61", "value": 83436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003084, "uuid": "0f676072-cf88-45dc-8ad4-2aecdc808492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003084, "uuid": "89399f13-580b-4bb6-8915-2dc80218f753", "value": "ez_nigger.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec848594-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035580, "uuid": "76dae347-d5da-446c-b0f1-ee9cdc8e7a2d", "comment": "Malware payload (Mirai)", "value": "d091ec777dcc4c521a40611cbaa7a01f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035580, "uuid": "dab1876f-4def-4ea1-a7db-2335c6faf62c", "comment": "Malware payload (Mirai)", "value": "0be23ed97ba78bd78fd81f727aab2eeaeadde933b04e300deab0bb78d00562c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035580, "uuid": "5e86e250-7448-449b-966f-f8a9500489f5", "comment": "Malware payload (Mirai)", "value": "dc90f6116a751f8952cec858b3845878bb5dfbf0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035580, "uuid": "2da7265d-51bd-4284-9026-2264887ce81c", "comment": "Malware payload (Mirai)", "value": "2b15df9fa7c4d920d72cef9caaeb9e6784384865ad1c794414865bc2f3bc3c2debb8bbdebcf98d91f2a5c75f2a96932f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035580, "uuid": "76f9fb5b-e221-4c51-ab8c-83408f4ebaae", "value": "T1F031E2E0A266C861FF4A1A28AE1831D6448A3D1DE77F34FCDCC7D9C4961D98CA315DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035580, "uuid": "b1a96dbc-c714-480f-bf67-93334551f2db", "value": "24:TX+GBYAJmVcpWHKkwFLCbL+wJq2fmqm94P:6Wd8VcpWHHwFLCb6npx9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035580, "uuid": "f7e6f0cb-0eaa-4ed5-ae26-dfbd58794f89", "value": 1623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035580, "uuid": "0a27d23e-b4c4-4c06-a127-c835d1df7fc5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035580, "uuid": "5aa4b834-4e33-40e4-a71a-c6e250b07a3b", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc45536b-1244-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772022211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022211, "uuid": "4f5fb2fc-6567-4f48-999d-b8c01e367842", "comment": "Malware payload (RemcosRAT)", "value": "6ce74244d4540dae6409ae5055c6637e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022211, "uuid": "710520a9-bf39-413b-85a5-70575412503f", "comment": "Malware payload (RemcosRAT)", "value": "0bf202c84b88c0c4c814cb41ec501118bd9452527316301181960a7fba8446da", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022211, "uuid": "bb49c86f-4e8e-4659-a2b6-d03b68573310", "comment": "Malware payload (RemcosRAT)", "value": "00264f91ed6abe6ed482b556478f86d9cc010662", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022211, "uuid": "ea1bc146-b9b3-4af2-aa77-10eb580daf69", "comment": "Malware payload (RemcosRAT)", "value": "a8e298369d03ffd7c77dda084efa017466b5e8e76b7abdf52914ee4fe3eed0bf1f852a857c29ddaeef3dadb1883da3e9", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022211, "uuid": "633e1536-98b7-4841-a97b-1e6b9b5564d2", "value": "T166E5B0274B70AB829F2C2D2E14F0560CE7B7A5449D0AB16DFA137D9B9DEBE12037450B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022211, "uuid": "5a251a17-8e35-4d38-92e3-66cc5925803a", "value": "24576:bsE8qOFmJK0LvwMCq8UUWDpRWw3Av0Whopbux15n1dS:A90sB50WRzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772022211, "uuid": "cb2d276c-80f5-4795-a446-dbe0ffed7b95", "value": 3196729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772022211, "uuid": "be66eb2a-ddd9-4ad2-9fab-795e8f71e30c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022211, "uuid": "13bf48c3-9962-4107-95ab-842aeb7617fb", "value": "SPEC-Nostro4500119910.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362aabda-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003062, "uuid": "7e77f161-ef53-43f6-a591-b02b2ad8a797", "comment": "Malware payload (Mirai)", "value": "03a0e71f5b128be61580cfaa34a69429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003062, "uuid": "4fc29b6a-c8cc-45c0-afbe-96453f651012", "comment": "Malware payload (Mirai)", "value": "0c395ed2f9adbd71048a2c2bf7b437ead57f777de0b9b17d43fffd7ff47685a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003062, "uuid": "954e4253-e08e-4191-9b8e-e3f0c0cbe2f5", "comment": "Malware payload (Mirai)", "value": "a46f8949036002e6191d53c88572b132c5115f37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003062, "uuid": "43b600c5-4dc2-4bd4-a1e9-80417fb49365", "comment": "Malware payload (Mirai)", "value": "67e514cf0f7c04d05586ddd58dfba61bf92936947e4b502516878027ca2a4f120ed09b34bec4ce0ea7ddb73de70b734a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003062, "uuid": "bb8d344c-3e6f-4d39-b890-4909af3fcd00", "value": "T18A834BC9FB83E4F0E95605B111ABF77E46319D221020CE6BDB94FD72ED22A52E11B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003062, "uuid": "c2485e2e-6904-41b8-8ba3-391543ad0be1", "value": "1536:hSYyng4DguDU8KJbdC8Eo11AUr31QxS+wd9zJ7zr:hSYyn5cudqruTmJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003062, "uuid": "d95dc1ac-64eb-46cd-8fee-7918a6f53567", "value": 86772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003062, "uuid": "4ae623b8-906c-4882-9c6b-dedb69757561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003062, "uuid": "521e8862-04d1-4674-b9be-26aa5a117881", "value": "ez_nigger.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319f963c-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003054, "uuid": "653cbc8d-6ed7-486f-ba6b-11e552db0422", "comment": "Malware payload (Mirai)", "value": "acd405c3e36300b130418ae6cb00b4d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003054, "uuid": "333dee3e-07c5-4640-999e-f151cd5cbc76", "comment": "Malware payload (Mirai)", "value": "0c6fb120b5ed230dcaa7ae3600df6a8d4b0efbbdbe63cb8eb7ad1f7737d7dc7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003054, "uuid": "a25d3619-26c9-4d4a-850c-e87ba379ee20", "comment": "Malware payload (Mirai)", "value": "2ab6d9f93ce1a9963934ce65307979087bd52310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003054, "uuid": "7e43bd8a-91f2-4466-ab58-c8ea4e18bc12", "comment": "Malware payload (Mirai)", "value": "aa7328146b772bbe8fbbf5b562febb17a45fcf585831f2afe51bc5421b6e1f9e7b7c3d9d50244c8b4603729e8c2a0393", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003054, "uuid": "cc999a59-d621-4622-970c-a757ff56bb52", "value": "T114932896F401DDBEF80ED77B4493090AB230E3A109831F366257B867AD761E49973F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003054, "uuid": "e3cf49e8-cf88-42b0-91af-06da782d5003", "value": "1536:Ltn1p2xk39dDtO83Qi2+Xn3eFm8FjinqIHzUhhPXPfsdFW8QMT0yZnH:Z1p+U9RT3Qt+Xn3eFN8zmhvX8QMRZnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003054, "uuid": "4b5d311b-8a79-4657-9c13-7272fdb4ea37", "value": 89592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003054, "uuid": "aaf312e6-1693-41dd-8b61-09ecfd3cf051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003054, "uuid": "15009656-9231-442d-b0f3-7abd36abd988", "value": "ez_nigger.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c722e-124d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772025985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025985, "uuid": "ff621894-3dc7-42d3-8485-e1ca32d1105e", "comment": "Malware payload", "value": "a97c2825318bb089f2e4676f4808a355", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025985, "uuid": "909d85ed-c1d5-4595-ad2c-f7eb71c6f1c5", "comment": "Malware payload", "value": "0cc41c9a9302463c01ec04dbc01ba89609d1c502f820afffc8cf8a9caf3555b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025985, "uuid": "e6c5bb6b-3567-4db6-9ac8-187630761638", "comment": "Malware payload", "value": "748fee77015f34f7dd2edcfa12bf59681a98ce00", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025985, "uuid": "304c74c4-fa20-41c7-99c3-080a4555f990", "comment": "Malware payload", "value": "4719ad98304d269eb80ec8cb7edb7717635ca1580a62997ced814b6e66b82cd6e352f1d408d9422373f91031f9f1bcfb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025985, "uuid": "02981a47-a038-405c-997d-4f58704c3849", "value": "T1E9924B7906497D34F7C1DE799E3C2F0DAEE881C42124E39CFA0F3A215E116ADD60935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025985, "uuid": "9a531ff6-9b70-4f2f-88ce-cb13b4d646e3", "value": "384:PVk/xNd9xaBTfJs5P/BzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:PVC/aBTfGpzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772025985, "uuid": "d54f750d-aa07-4d49-9b23-0777664f7209", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772025985, "uuid": "7704ab7f-b496-45fb-8830-139a39b05c04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025985, "uuid": "b35e88f8-4008-40dd-abdb-896c3d9ff5b7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d94530-1251-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772027591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027591, "uuid": "476f21c9-8539-412d-aef7-247bbdc5dd41", "comment": "Malware payload (NetSupport)", "value": "e4b1fcb3b3922082e630524ce6d015a2", "object_relation": "md5", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027591, "uuid": "22924c07-8657-4353-ac79-98c452c8e8c6", "comment": "Malware payload (NetSupport)", "value": "0cf4c4fd920f6453018b9b43214e6c894bbeb3d0de07e73cb81c5c274c77f298", "object_relation": "sha256", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027591, "uuid": "8abe9539-b4e1-4cf7-9252-3f21243f3319", "comment": "Malware payload (NetSupport)", "value": "ff74a699be086280ff5462ad22f52a50d12d1622", "object_relation": "sha1", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027591, "uuid": "5d4534df-044c-4ff2-b040-e7ab43e94179", "comment": "Malware payload (NetSupport)", "value": "d755ac645e7d861b4c6e6f6d9b510c5832e9a25138ee18cda5d071c09db801529f105c6fbd1da60933a7ca99f842f015", "object_relation": "sha3-384", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027591, "uuid": "79167f37-a1bb-412a-ba78-d4921555f56c", "value": "T1FCA2D116B6DC7162FFB59AB5244286104FB3B80B53EB2090F6D1E8E9BC716784BC3456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027591, "uuid": "4fa18631-4c3a-4915-8548-03c410ee866f", "value": "384:I2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSf4q88:I2+x6TLKQXK1myQCSr2VS4jTXaRnPAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027591, "uuid": "0bda767e-d9e3-4e48-82f3-ec8a306637c3", "value": 22198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027591, "uuid": "4364bb19-a43d-4609-8838-f171ed003563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027591, "uuid": "a792be1c-13f0-4368-aa98-2a0ad360aea2", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1594578e-1225-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772008591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008591, "uuid": "c6b861b3-1bf0-4b34-9338-93c1511cec3b", "comment": "Malware payload", "value": "bc007946919df92576caeeef8562433b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008591, "uuid": "6f7a4daa-92b9-4b23-85e5-d0588d8031d6", "comment": "Malware payload", "value": "0de87d04c8fba2d2fe51200ec17d7a2c15fe121cbeb1fcee5d6451d6d1d96e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008591, "uuid": "00e8e922-055a-4366-b8fe-45705db0ce2f", "comment": "Malware payload", "value": "7397346e59fa98ee785db40f932dfc4019be13db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008591, "uuid": "0376b21c-eea8-4582-8065-5d82ba2a3217", "comment": "Malware payload", "value": "6658a9a0905fd1541969fb8779c9c81c6ac01421a982cea43a5d271db63c66dd9b3010531527e00465a72d6371819eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008591, "uuid": "1b6800a8-c93e-4730-a3e5-f96e8a240ddc", "value": "T154569D02F7C41B91D07AEA38CA5BDB33D3B1FC250775A24F0591F2491EB3BA15A6A52C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008591, "uuid": "722aa781-ddc2-42bb-b9bd-fd3f07951ffb", "value": "c2c2f309faff434f95cf58b8cace7468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008591, "uuid": "372616a3-9779-49a3-8bfc-2db890109f4a", "value": "49152:qzDpyeH1sfZE2RL98SYxl6z+1OA2WXqQxYzrj375XsAmm3vEz1Cmf0kRvIoMwh67:oi+qjVXswcJCmf0MvIoMwh6Lp0At/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772008591, "uuid": "23d119ac-45b6-4ef2-905f-3eb7dc895a6d", "value": 6215680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772008591, "uuid": "d7368548-7956-4db2-a6ba-65689fd82339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008591, "uuid": "64a48a3f-7243-4d52-ab89-3c5b4c6a8d4c", "value": "PROPSYS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f20d55-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017399, "uuid": "a4d1bfae-0252-4996-9782-bb0549a0db70", "comment": "Malware payload (Mirai)", "value": "242166aeb6303652248fa17cd46bf116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017399, "uuid": "08e69b42-5d11-4ce9-89ad-9b2db3b024b8", "comment": "Malware payload (Mirai)", "value": "0e5ce8920fc81721e195d6567473daeee40023ae542c0e641a099b39441f20cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017399, "uuid": "6e928b8d-a72e-443d-b9f2-cbf498c86be1", "comment": "Malware payload (Mirai)", "value": "d77cdeb504e9058d3cad32337fa1534ae4308611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017399, "uuid": "3e4f8c91-2375-40ed-9993-4b98005bb034", "comment": "Malware payload (Mirai)", "value": "b85d2a14c920993508821dd95ee2efd8523e51410acd39035c8fef401ca1aa75b14bd3ac1c8df6062b3c88f970f5f705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017399, "uuid": "876f63f8-0c16-4b5e-8460-5a74df06e587", "value": "T1B9B2DF3C1B151B98DE1AC0BD83A80B613CB81B259142AD8B6217ED939F568747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017399, "uuid": "76f8be87-109f-4bcd-a996-b5faea8912f5", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiqiDmd1JgGlzDpH7uNj1JX:6eD8ZSWvZHZbs1row697qohQvg9qgi1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017399, "uuid": "359bb0af-643f-4a87-8e9e-5ff42ed9b67f", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017399, "uuid": "c4abc1fc-c1b7-4141-856f-6983ad683937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017399, "uuid": "d67d6a01-c4d5-41fb-a9d3-2bacab73097a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e1e225-1256-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772029906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029906, "uuid": "a358077c-e305-48c3-8b3f-edbfe95cbad3", "comment": "Malware payload", "value": "6f08250038b3a54d3606b1df0c9d3b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029906, "uuid": "d1be498a-208f-4f3f-b253-b07d83ed31a0", "comment": "Malware payload", "value": "0e75b34b784b03ec6e7cd7ac341577ad6cbd949068ec1bf3954d645617d25f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029906, "uuid": "cb807b83-8aed-49f8-8c9a-c78912844cf1", "comment": "Malware payload", "value": "00ea5da8beed4e213b1c3bc1e908334c909259b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029906, "uuid": "120cfef9-baed-47a7-997c-807793c46948", "comment": "Malware payload", "value": "7e3215196b1b3744eb43653ae046a9ef4a6f655f1f59359c2b501366b6a385c2353b46595cd32c86ed815043884a30c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029906, "uuid": "77565b8c-9479-4ad1-962a-114775b9bddb", "value": "T16D159E2EE2E14437D1672A39AC5FD7DCA939BE102938984A2BD50DC84F3D34534E62A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029906, "uuid": "65844b2b-5172-4b7b-afc2-1c00e66615bf", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029906, "uuid": "7e39397f-657d-451b-b5d4-c627f7ab677a", "value": "24576:VlluEBpPj6o4CPbE9taCbGIW5gEyGBVG:Vlwa1VOUyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029906, "uuid": "9cb947f0-210e-4dd7-859c-629cd7528abf", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029906, "uuid": "d5e4d3d2-e77c-4fe5-a4f2-212d263c5fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029906, "uuid": "0b7743f4-a99a-46a8-a89f-ccebca8c031a", "value": "6f08250038b3a54d3606b1df0c9d3b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54debd50-1216-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772002254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002254, "uuid": "f3a7f061-270c-4cfd-af33-2773eb64ee52", "comment": "Malware payload (Mirai)", "value": "169afc07bffa7fde00b71a8818554412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002254, "uuid": "5638ce5a-288b-43b1-b440-d3528f69bc51", "comment": "Malware payload (Mirai)", "value": "102d0a827f8262556711ad8338b0f85121ef18e33d797749fce92f8c05ffcd34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002254, "uuid": "c1859d93-4e43-47e4-a548-e7976850ec6e", "comment": "Malware payload (Mirai)", "value": "3adc1c19e02501534b6c3b7f56fc511c4d307e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002254, "uuid": "58a93077-68ea-4465-8e35-ac45df2c95de", "comment": "Malware payload (Mirai)", "value": "605678cf6f5f63f4e6276b77e5bdf50a542409ea3a73064ea3bd2a33ce3470bb77f1f5c636c3d5b5e61d131881ca21c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002254, "uuid": "41d4f836-c580-40b9-96b2-648ba4eb4e81", "value": "T171D31859BC819B11D6D526BEFE0F428A33135B6CE3EE7212DD245F2427CA95B0F7A002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002254, "uuid": "a44d917a-cdec-48fe-87e5-e99bfd19c774", "value": "3072:D2t9xIKM1GdhSGB6mjzemdLL+MHbwWQuGOauAxBj+qWBDsXSAtXWFQfa:at97M1GdcGB6mjzemdLL+owdjOauAxBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772002254, "uuid": "85f64bd2-74dd-4f9d-a22b-e03b400e43e3", "value": 132076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772002254, "uuid": "8f683548-7381-4706-bfda-87cc469543c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002254, "uuid": "4dc37093-559f-496f-b200-1a63700ba50d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72a2e80-121d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772005426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005426, "uuid": "10dd5822-8372-4144-b545-0790dc8c0a2f", "comment": "Malware payload", "value": "9e7009d9b2bc27dea835322570d482cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005426, "uuid": "e4bf8693-13d5-4a3f-ab08-4f29d230bc67", "comment": "Malware payload", "value": "10467388e1a1d0fd9d926491aa303dae3f76d2acc2e47b01e06441ef75ddea90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005426, "uuid": "bb6bb545-b5eb-4a70-8355-4117d4da26c7", "comment": "Malware payload", "value": "53ef63d2a79d33422a097160a6de8c1763277ab9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005426, "uuid": "cbb310e9-bb5a-40de-b77a-6e67c3d52d70", "comment": "Malware payload", "value": "c2c29f1fe05af4fff4f0c270a39e93ed87f10f941188844ae631fd4dee75092ae3ce1b4c1b091a66945bbd8640cc406c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005426, "uuid": "fe69b3b5-ef85-4a09-8e76-6a395d347033", "value": "T1B44533286D890C1527A71FF980D1603329FB3DE70506F5CA8FA6B9E94910319627ADFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005426, "uuid": "b02b4466-83e7-4ad3-9633-7096ff5d6411", "value": "24576:1LtgPMxTuZCyMPxb0BOftAoiEkQYxe8o8yP6gVnYl7Yz:1LtoMxTuZCBqOoEVx8y9y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772005426, "uuid": "d3c5307f-46f9-4d67-83af-9d3e4ec73e0d", "value": 1261308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772005426, "uuid": "a820f491-1c21-49ad-bba3-2b610316e580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005426, "uuid": "a3a508b3-98df-4198-8bba-af058fa2888c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f95aa1-124f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772026821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026821, "uuid": "751258f2-8bc6-4351-88b9-35f5c28801a1", "comment": "Malware payload", "value": "fb5eb5526050fb6cc29076f8ff5a0c11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026821, "uuid": "d3572faa-823b-4d71-95fa-0159731c9f15", "comment": "Malware payload", "value": "1049635e6c273e50f7302d58f7b56131a36e998f7cda76281eb9cb3d991b8c32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026821, "uuid": "a4b4fa48-e09c-4184-b92a-b6fe3a9c7700", "comment": "Malware payload", "value": "163bee32162b45164ac2509b2bac91503171ab30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026821, "uuid": "023c9ff8-56a3-4418-aab0-1461e83d7abd", "comment": "Malware payload", "value": "764480cddd268bd40a76ba50d53baca8e8600a5233415770846902bc7d95f59caf8501004c57d1851ffab60c79b90595", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026821, "uuid": "0e0476a7-294f-4b32-b206-00fd8babdcd5", "value": "T1286196D57844312F82DE1BAEBFC7AF48F13E14A92F14E4E8802459A1A863FC52552DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026821, "uuid": "ed12165b-0f87-4e18-a8cc-7d0ea89a864c", "value": "96:9m+UHkC9wKaycl53QfMjcOmZ1aHdW4yckF:c+o3KJl9QjPlckF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026821, "uuid": "6d794b90-ebbc-48f9-961a-d0072abfc5a9", "value": 3299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026821, "uuid": "65aaa284-319c-4650-80b9-b98b4f399236", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026821, "uuid": "5d31bf93-eec3-44aa-a6df-4267adfa922b", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aeaa9c-11f5-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1771988324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988324, "uuid": "02b5c0be-2fb9-426e-8b8f-c0f8d25e43a5", "comment": "Malware payload (RatonRAT)", "value": "d60a896d12160161fa29fabc2c4abc7d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988324, "uuid": "f2483bb4-ec80-4e0a-98e2-e62609238e63", "comment": "Malware payload (RatonRAT)", "value": "10aa2fc4e6f97c189c0cb40f17e51df63c309be715eacbfc7e695394c69549f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988324, "uuid": "c7fc0cff-e0c1-4e91-9442-f21e1353e692", "comment": "Malware payload (RatonRAT)", "value": "9f46f8d8dddeb761dcf96058b3a31688b5fdf552", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988324, "uuid": "bc5f51fa-a566-49a6-a184-557580ea70e4", "comment": "Malware payload (RatonRAT)", "value": "a5ae1ba795362dd1ff8c3805bda2f1dea07c004c8e363721e37cb105a8a2caf833000553a526819af6b6ccdf3da8fe49", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988324, "uuid": "3a2b7fd5-dc41-41ca-9b4e-3728d46c8acb", "value": "T18706CF017BE5DE1BE1AF57B2B4B247100771EC95A792EB0A1D9036EC1CB3740AD1A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988324, "uuid": "94692a39-cff2-47e4-8d90-f8b5612055fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988324, "uuid": "d00b2671-32dc-4fc3-94e1-734c90071873", "value": "49152:7lm9N8DfgVUBsHjkmiGWU5+5WeLGpMZ7iKPyg0asWfTSwgW:LfgVUyHjkDGjYQeqpgm4NfTSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771988324, "uuid": "3398a9ed-edc9-4c11-959f-2c0e8420fcd2", "value": 3672064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771988324, "uuid": "9039de45-e19b-4c50-9a17-4337bc668fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988324, "uuid": "4901854f-f3b5-45ae-a371-abc7c356374d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8429688f-121c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772004911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004911, "uuid": "bf5a9185-29b4-4bf3-b041-e73526846dcc", "comment": "Malware payload (Mirai)", "value": "8be4ab5dd48e2327afe3b1df001e3e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004911, "uuid": "e17b7ca8-2440-4229-9bfa-49fdc5698b1b", "comment": "Malware payload (Mirai)", "value": "10f635da68cf55e01a3e82882c2fb2502c6ec800f608b5ac04f5b76c70981e8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004911, "uuid": "97bd928c-c50e-4b3b-90db-aab2e0006fc5", "comment": "Malware payload (Mirai)", "value": "8a6c8bff3def354c28690e4aee7f92af440c34a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004911, "uuid": "8f3f24a1-92f2-4ec5-8b77-7622d8396845", "comment": "Malware payload (Mirai)", "value": "9b5c79a3f0964ea51a2b018673362feb41503f194851cb2d349e01237bda6b71be8c2761fab5cffef4f89d47bcf5ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004911, "uuid": "36500131-2c63-4535-9182-8e7b958bd5cf", "value": "T1F2040845BC519B13C6C616BBFB4E428D772A1798E3EE3203DD246F24379B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004911, "uuid": "8998adb1-9f83-42b2-bd67-2b79b6fb5507", "value": "3072:lYSvPb19lynIQm36BToDitTFv96T93r4fyV6cJArPYg3n0pD:KGPb19lynIJ3sToDitTFv9653r4fy6cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772004911, "uuid": "57d9788a-77c5-44b5-8018-34b2706b3b92", "value": 173944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772004911, "uuid": "6ac0f6b2-8abb-4f42-9776-b8b615c50458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004911, "uuid": "61145114-d47e-4b11-951a-d6bab889c402", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360c3a74-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772045582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045582, "uuid": "a507e952-93fc-4847-91fb-0ddf2a272465", "comment": "Malware payload (Gafgyt)", "value": "bf0f77f1ddc55440bc49f380b12241a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045582, "uuid": "f69282ff-5168-40ba-875e-8e4cf21b46ca", "comment": "Malware payload (Gafgyt)", "value": "114581eed5046d996a55470d43f7a310f991c720346028d53cceb4c2ef8fdc8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045582, "uuid": "9107aebb-2ecf-4a5e-bef1-058a52041e9e", "comment": "Malware payload (Gafgyt)", "value": "b24f382a826735beb6dc3a44c33e46593b0ddd9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045582, "uuid": "d3328cc3-37d2-45fb-ac75-10f268582911", "comment": "Malware payload (Gafgyt)", "value": "4282d377ba39d4b9724c8c7c4bd647e700e40c18579ee9834d95d54b72339361b7427b63320f13f14e3f7458d6b38f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045582, "uuid": "2bd97872-1d16-4a6f-8d77-88513ce0b140", "value": "T1C8C3F831E8044B1BC2C223F6E75A469E3F351E9797E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045582, "uuid": "2a468f89-b9ff-4382-8332-07d8a13a0f00", "value": "3072:6jVlyaL5JCrIpv04sVbttiEiTmP46aQyfPlfKsNb:yoCJCN4sVbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045582, "uuid": "349f806c-6afe-4a5e-8535-65ec68eb9a7e", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045582, "uuid": "026a91e9-e64a-438e-8bbf-29258e13b36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045582, "uuid": "f9f0a057-5448-4162-b39f-56dc65a4828c", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbfa164-1253-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772028468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028468, "uuid": "b0db448a-0812-43bb-9c20-372050d841ac", "comment": "Malware payload (NetSupport)", "value": "db0a978fa61226e70f16a8733215492b", "object_relation": "md5", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028468, "uuid": "577e4427-d50a-40e9-b676-0e9ffef9128b", "comment": "Malware payload (NetSupport)", "value": "12391dcde0d2cd38d11aef42ed0790cbbb4b5ad3b92e592349aea5f80b6a2e16", "object_relation": "sha256", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028468, "uuid": "72f0a6dc-db84-40f8-b0cb-c84f2d6f3d55", "comment": "Malware payload (NetSupport)", "value": "52515b7be35283b59de68b686839e576a729da34", "object_relation": "sha1", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028468, "uuid": "4e92f05d-a492-4b52-a69e-459ab1651785", "comment": "Malware payload (NetSupport)", "value": "f56c077e241cbab87b104b46e84cd613df4c4e48db166f60d4713c2bfbcd7bedb8010f5ad8542f9b069b6366b076d837", "object_relation": "sha3-384", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028468, "uuid": "73b9db19-d92b-4478-a391-703954971ce7", "value": "T149A633A5DAA811FFF9EAD63CDE72C4A1C25A79171755C1D783E090B22E333C0663A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028468, "uuid": "8e0a298f-11db-4673-895e-48ca23f57d6f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028468, "uuid": "c82df2b1-491e-4e7f-9f39-3ee9efefa78e", "value": "196608:l14oWUoB9qLZBLkuorXQMQurH/P/XRLun2KKDFh:l14FCkuBhuDXY+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772028468, "uuid": "a98941cb-13d2-476f-88c2-cbc698f3e107", "value": 9669266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772028468, "uuid": "e9a42a32-067b-4e15-bf26-03f171e7a718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028468, "uuid": "e8c544bd-32fc-425f-af99-c37e25c1fa31", "value": "12391dcde0d2cd38d11aef42ed0790cbbb4b5ad3b92e592349aea5f80b6a2e16.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fdc48b-1254-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772028749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028749, "uuid": "81ac0bc7-95c3-4e87-b661-6aed8b29423e", "comment": "Malware payload (NetSupport)", "value": "04398f1fa65ceaf81281a9e55f21167e", "object_relation": "md5", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028749, "uuid": "37d9ee33-61b9-4ac3-94e8-46f4ac709902", "comment": "Malware payload (NetSupport)", "value": "12bc61cd5fc42b803fca4653eae867cb51a3de83083d7a9702af26ea63732666", "object_relation": "sha256", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028749, "uuid": "5acb4b9e-e824-45a0-9561-ff08f5bbb13b", "comment": "Malware payload (NetSupport)", "value": "2f231d4e9d0c1473c45268657af7ee2d0783157d", "object_relation": "sha1", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028749, "uuid": "24d6e595-1445-491e-8b2d-b7507f11b0dc", "comment": "Malware payload (NetSupport)", "value": "2850e529e1fdf6015f7476ed8b5deb3ca9c35fe89e915f4ae8cb0c5e3e4dc5c9eb13f684975f5e35495c3bbf8b04c8b0", "object_relation": "sha3-384", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028749, "uuid": "be687f39-ff4b-4701-b6ca-862803bbba28", "value": "T136A2D116B69DB163FF7596B5248286004FB3B44F63EB24A0E6C0E9D5FC715B84BC3862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028749, "uuid": "2a8fda0a-d16b-4019-8e11-e4eea2eaa839", "value": "384:I2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfmeinJj:I2+x6TLKQXK1myQCSr2VS4jTXaRnP7ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772028749, "uuid": "4acfffa8-db82-415a-830d-9e4dde1c3e42", "value": 22163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772028749, "uuid": "da1f719c-3e16-4803-955e-68c69bdba998", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028749, "uuid": "7ec13c6b-1813-4382-b0bd-5d1181e58f05", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95e66c8-1234-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772015415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015415, "uuid": "502f0768-eaae-4209-a45c-5e594b5cd54f", "comment": "Malware payload (AsyncRAT)", "value": "92a82456a47d740d650e598d13173518", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015415, "uuid": "d0b9a83c-087b-4fa1-8b48-5f7c4483e613", "comment": "Malware payload (AsyncRAT)", "value": "133f9f43162a22b1bdcda8215625958c6933bff556990768ee0a53dbf51a6de2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015415, "uuid": "7a50d0ad-eb1b-4680-869f-ea7dd2937873", "comment": "Malware payload (AsyncRAT)", "value": "296befba6a952876e26c002e4e20a0163ef3ce12", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015415, "uuid": "09412e20-85db-42f9-9625-d096db6bc6f1", "comment": "Malware payload (AsyncRAT)", "value": "3d12627ed76bb94dcf78ad8038f41484044b1664b82b56950b5a4cb7628e1bcb00b162c70faa8c45b02f51b74deac3ef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015415, "uuid": "6049f0ef-f4a0-4072-ad49-adc2e85da32a", "value": "T10E45BF0273C1C062FFAB96334B56F6115BBC79260123A62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015415, "uuid": "44abb148-6c96-4878-a162-d1c605bb37c0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015415, "uuid": "0476532e-3a2d-47e6-aa1f-0f458b04d7de", "value": "24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXda8UIOIrxN+lAo1i+0iKo7mW0H:ePVt/LZeJbInQRa8DcAyiEK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015415, "uuid": "e8f012c1-a2b8-423d-81c9-c8094da6e2ca", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015415, "uuid": "08459d56-a352-4e59-bb35-ea297156258f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015415, "uuid": "14712675-cae7-4fbc-899a-e4dc0b610323", "value": "z1MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360dbfba-120b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997478, "uuid": "bca16e80-a7e8-43cb-aa06-1d7269a7f29f", "comment": "Malware payload", "value": "95fcf034ef4a2820257807b7f4a2912e", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997478, "uuid": "d2cc7743-61d7-47a7-84c3-fed17492c7ef", "comment": "Malware payload", "value": "14436739f0a110dac9118f6e9df5f8006a00d5c1cfee8fcabd09ef6857177126", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997478, "uuid": "58d2baf7-fe22-437b-a03c-7cef65b784c8", "comment": "Malware payload", "value": "feb4318a90057d92ea5ab6420ed6164dd9605013", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997478, "uuid": "4e236fb2-0191-49c5-a8a6-dd7940ae9b27", "comment": "Malware payload", "value": "3a8762122c06a29e05811cfecd2905648816b6216d82bb99c16126cde5cfc7c7aa1d3b76cf97f0e420bc91752c699e8f", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997478, "uuid": "1659ad42-b061-4674-afd1-447f689aa187", "value": "T1096101AD7D5B4272897E6B505D432CB7EA902017332B66B8F18DA2C90FB45CCC1F468C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997478, "uuid": "5fb5731b-e900-4f68-ab84-220c8c33525b", "value": "48:lF/kK6K7lLgKKRMRj1fKuKQKIxRdACgTK0Ra0zV3y2K7YcRLg9B/Xx/K6q7RFtcj:lFpLlFJjwX1iPYacdg7gXxiF7dSGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997478, "uuid": "32548192-8f2a-408f-b507-6e26908d999a", "value": 3270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997478, "uuid": "a5d244ce-982b-4d53-8faa-0d3ac1c14a52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997478, "uuid": "b29da73b-1647-4c06-96c0-12ccadb40c64", "value": "14436739f0a110dac9118f6e9df5f8006a00d5c1cfee8fcabd09ef6857177126.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c1566e-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029898, "uuid": "4537a1f8-3b0e-4d2d-a11c-8082569874cf", "comment": "Malware payload (GCleaner)", "value": "26ed15c6e964c09e83ce1448e9cd402e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029898, "uuid": "6cbf5871-cf28-4e07-ba41-660341e97c0b", "comment": "Malware payload (GCleaner)", "value": "1498ead0281a8f8444d2150fca7711472488a2704d1e8dd20dcaf95d6dcf8b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029898, "uuid": "9651bdd2-fc0b-4807-b174-0140bf22421a", "comment": "Malware payload (GCleaner)", "value": "7989b9c3612d5d39aedcaf56518ffb226caf8a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029898, "uuid": "6db0c385-bfcf-4e47-b4fa-4b819a883bc7", "comment": "Malware payload (GCleaner)", "value": "89779f1c16c786c27ecc2c3361776a6c8b6bb0fc8d86ac478f60c5492f410dc59f513a48fd165645c4a073242321e54a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029898, "uuid": "a0366785-b1d8-4c21-a06f-6e60696b4bf3", "value": "T12F55AE23B2924432C1761639BC2B675D58E9FE113F38A88A2FE53DCC5F342417935AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029898, "uuid": "c3b8b045-1dfc-4828-9964-ff26118395ea", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029898, "uuid": "b2287a49-d07b-4218-9aaa-d6b641d543cd", "value": "12288:cVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICR0i97FiIvC200+fvTpr:cVwXV4HSmYq7MPPfEd+epgF3a2+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029898, "uuid": "94622857-4be5-4dac-8df7-aa3e30a6dfce", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029898, "uuid": "1c3c9537-046d-4218-b2d1-6c443c7123d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029898, "uuid": "19174d83-4aaf-49bf-89e2-029c31d8c14b", "value": "26ed15c6e964c09e83ce1448e9cd402e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d96851c-120c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998028, "uuid": "1bafa3b2-c7c8-457e-b792-4aa49bb413ab", "comment": "Malware payload", "value": "ce283f85a1d80763462803150cd88267", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998028, "uuid": "88cf26d2-c0fa-4cb2-a5d7-5f48d6821d4f", "comment": "Malware payload", "value": "14ebf6a7ca36c88a60f822b08a956646aa1e44d4adb5db79e6ceec4b1fb66a9a", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998028, "uuid": "8f4867ed-0bdd-4931-b406-6651b988f842", "comment": "Malware payload", "value": "f5a129ba4141361ca266950dc4adcb2c548aa949", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998028, "uuid": "c05dd4fc-8b51-4960-9846-7ad089e9d4cb", "comment": "Malware payload", "value": "9c5d5f1c83fe3a80077a85c447d9d42981fae4942869c0648efd3ac060c28cdcad15bb62be6390ef7c1287915b69cf36", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998028, "uuid": "1dcbf56d-3371-4ce9-a9ef-38975b754b24", "value": "T13C1602A0D55A8B92F063D4BC61D4B9D204353E136AD80CE1E37F2A089FBF8B66655F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998028, "uuid": "eb58f95b-ce4a-45b1-ae18-112b90efec98", "value": "49152:tCe8URnPYHY43saSkleDFvCH1pjPh4ScRbI0/JP38Gw4jMXhku8Wx0y+tOonhBWV:tCePRffvlEFJ4ZbIoJADxMFlhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998028, "uuid": "5d3c64f7-49cb-4bed-a378-692b19519b25", "value": 4042752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998028, "uuid": "a5724c61-d0d8-4f0c-97a1-fc644c80d197", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998028, "uuid": "2e6334ff-a2c2-466a-9c69-513dd3ef8703", "value": "14ebf6a7ca36c88a60f822b08a956646aa1e44d4adb5db79e6ceec4b1fb66a9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157f89be-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035649, "uuid": "d33c5cc2-46c1-44e3-ad95-94c5a12ad9fb", "comment": "Malware payload (Mirai)", "value": "ba780a84a628f72ea2a2cdcd9b6a5670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035649, "uuid": "d8750b87-a026-4521-b28e-7f6423cbb0e6", "comment": "Malware payload (Mirai)", "value": "15e9db148fa89ac9737b7db54820ed70ed8e2820f121224f4bdcbb68d44a320a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035649, "uuid": "d6cf2ba6-4a85-473d-8f92-91793e9413d1", "comment": "Malware payload (Mirai)", "value": "613f9872f83b0d4e24f34356bd2ca52f51cb62d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035649, "uuid": "1796cd8f-b8d3-4934-94e3-bc5b8c2e6aae", "comment": "Malware payload (Mirai)", "value": "7008f59e3fdc685978186a26a5268d6e7f9182210bd267fcbb500677e5172d4704036c2127c8d0fd02d2545d151b7a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035649, "uuid": "8968c6f5-adb6-4b56-aa2f-2ee1234eb127", "value": "T14D96F814AD842BEAD42C4F7990EEC96622745D104AF14B266264FFEDBC772787F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035649, "uuid": "80b40e31-5a67-475f-9f07-f881db3130a7", "value": "49152:KgmiCYRHuSFABGZadWNNAkk/uimm4oWr1YF1C14U3T4nojTm9/1C4rcTZm5Ev:6GZa2Fk/jsw3Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035649, "uuid": "3a72ce2c-08b7-4725-9b18-c9fadb60a7c4", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035649, "uuid": "0aae48fa-57d7-4626-b4d4-4666fb903e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035649, "uuid": "3251c2fa-0f92-4b37-a176-a826dad52d52", "value": "MIPSLE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ea52de-12a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772061931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061931, "uuid": "5b2ba945-73ee-4e8b-a0ad-0a9d3a56d925", "comment": "Malware payload", "value": "75e8286229380b8ce96549aff8dcc569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061931, "uuid": "076634f0-7750-452e-9ed2-89a0cc97f998", "comment": "Malware payload", "value": "15efa8f1ebf53545f40c704086a1fa857024765014643bcab22ff889bcf49afa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061931, "uuid": "0b34b3c8-9be8-4b07-bd92-dcc567ffda4f", "comment": "Malware payload", "value": "3ab65692e38e7a5bdfc9ec56e4b6b6939cbf5096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061931, "uuid": "4e4bb90a-6c7c-44d5-8a94-baea6a68fff7", "comment": "Malware payload", "value": "59bdd104481e769f1adce8e15c991ce9e50cff38f98212bf7046a0e16e14ee9047e3dd3e3288ad0d7900fc58fc8dd7c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061931, "uuid": "ad4e4c7b-2743-49b8-9ee3-5003a5f0cd75", "value": "T1C4C65B51FA8B94F5E9031831415BB23F73315D048B28DBABFB587F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061931, "uuid": "60ae04f2-a2fe-4fa7-a6ee-360e6afd0d0c", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061931, "uuid": "bc1ce42d-ea20-4b16-915a-09f1663d5ca4", "value": "49152:iTyYD+RNRYVvm2N26J8Uba5otl2pXip3yUx9bMAZuNf+glf/kuPwVtfqbqRjq2eg:E9D+R2mREVMAy+gdafYOlo7Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772061931, "uuid": "0ae3fc98-75b4-40a1-b100-3c7557d4b324", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772061931, "uuid": "bd12e932-dae0-4362-a8f4-9aaa21224321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061931, "uuid": "60d70280-eca4-4415-87da-d08afa601429", "value": "valonity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4201a456-1210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771999646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999646, "uuid": "06bf9c27-2cf6-4820-aa2e-8358fc2aab66", "comment": "Malware payload", "value": "10af4e0e90eb0ff371f32a049edc5511", "object_relation": "md5", "Tag": [ { "name": "Chartre", "colour": "#1F6162", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999646, "uuid": "cef859b4-491f-4c94-a50c-71760642395a", "comment": "Malware payload", "value": "167d5ab70f55c100e51833fbfea44048095889c162e1330df0631423fc547409", "object_relation": "sha256", "Tag": [ { "name": "Chartre", "colour": "#1F6162", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999646, "uuid": "5bbd035c-e40e-4f47-98b5-59be55180a20", "comment": "Malware payload", "value": "0588cf26b6e9210f86a266ac0366af1fd29f135c", "object_relation": "sha1", "Tag": [ { "name": "Chartre", "colour": "#1F6162", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999646, "uuid": "89b06eb4-5695-4b00-bd95-b662bc31829c", "comment": "Malware payload", "value": "d3829f9f0d519bbdfdca549396ba9afcc8d1b4a2ed1fb559cc96494ca3c4704dc9d0e76e155f5cf0c7ff6068867f06e5", "object_relation": "sha3-384", "Tag": [ { "name": "Chartre", "colour": "#1F6162", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999646, "uuid": "e4021927-0311-408c-a0cd-7f8084d98a2c", "value": "T180956D6471892199E18BD17009B47DB80EB33AE7A9CFD944C33DBDC15F25B66EB04B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999646, "uuid": "349e9c7c-2053-4978-9b8e-6cb58aa30d11", "value": "49152:8p5nIgUKI58q7arT62mcWvYWDLiq1b4v:cnRFI5taC2mVQ0p4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771999646, "uuid": "c0abb458-f2a0-4b90-8696-048bc0530286", "value": 1977344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771999646, "uuid": "fc75aaf7-9768-43ac-8de4-78a4ecaf17d3", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999646, "uuid": "50b6d536-f737-49f1-a625-dbdcaf534ee4", "value": "167d5ab70f55c100e51833fbfea44048095889c162e1330df0631423fc547409.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c4e8cd-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045580, "uuid": "f9010f06-5765-445d-9696-b3465dcd3d40", "comment": "Malware payload (Mirai)", "value": "1a62da667979f61c9ffdaf6151eb3b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045580, "uuid": "34e76d9e-1b3b-43d2-9cd6-99b4a76de0ca", "comment": "Malware payload (Mirai)", "value": "16840cf9f7391a5a0dbf20cdcac38022c82379aa1a3be51bbcbcab9ca6b639c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045580, "uuid": "b98415fc-fe64-491e-83e9-7cccc0be041e", "comment": "Malware payload (Mirai)", "value": "bad4feac440ec6ad26c44c8d047557dc0f10aeed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045580, "uuid": "b88dc2d0-0447-4dc9-bbe9-d2973715535c", "comment": "Malware payload (Mirai)", "value": "bf1abc31c0852f12cef3627f4d13ced8ccfddd300271679314d897d4a52c41ff7051491bd3a965a13017a80fa7846c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045580, "uuid": "08587a0e-117f-4df2-bcfe-9b50cedc971a", "value": "T19EB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045580, "uuid": "debddb56-d828-43a4-809b-c3cfd7131136", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZGoamm/QcuLB1niDNb:YuFX0GIk1MHyphDamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045580, "uuid": "36540d07-d4a1-4f92-9be1-27d02cf8c0c6", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045580, "uuid": "588dc866-7581-46a5-914f-0d72fb4a2865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045580, "uuid": "76da7286-53bf-4477-8877-11690b096be8", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a503d1af-1223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772007972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772007972, "uuid": "f96533fb-72aa-46bf-8546-1a51d29aafe5", "comment": "Malware payload", "value": "28ae6db271d67860fe05a5c5995426a0", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772007972, "uuid": "ea8f286f-83c8-4629-a482-dc93366e78ae", "comment": "Malware payload", "value": "16da5cd5dcfd9c29890f70d960999b1d80914b4834f88bc405ea60bda1118503", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772007972, "uuid": "d8544755-5669-4e29-8004-d34f7f823c6f", "comment": "Malware payload", "value": "2a7b32448119030db53cdf00a7303257be95def6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772007972, "uuid": "cdd2cb0c-a31c-4e29-8d60-f66b09f48420", "comment": "Malware payload", "value": "54ed44b2675ab72d73258d3dfa38024691930d9866877a6c8f5fabf35a23f079c9874e1ab7a650e46726a888b3579952", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772007972, "uuid": "ca61dd78-f474-421f-9e7c-feb13402160e", "value": "T1200401B75BC57DBED8AC02F7009370B4B2590E078978B176560347DE8D92A4E06A92FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772007972, "uuid": "d5882c91-e495-4223-b76a-df3c303eb474", "value": "3072:SoyOxCq8tfN5lNXlEMDoJDPDB98UK/dpowSqY3psPoLxzTa1e0JNFrrq0jE1H:9Hxktl5lNXlEMsBkUK1pownvPo1z8e0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772007972, "uuid": "9a9c53bc-0d16-4e18-b056-ecf82432ff40", "value": 183809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772007972, "uuid": "4695ca4e-af8c-4876-a28d-bfc6534e489d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772007972, "uuid": "c754e30c-c4a6-4fe3-ab0e-0945438b61a4", "value": "New Order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fd5ed8-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1772017391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017391, "uuid": "a977ed6b-2dac-4fb7-b860-6f55633b9d45", "comment": "Malware payload (SimpleHelp)", "value": "847d93d3bd2e2f175eee7567fcfe8e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017391, "uuid": "cb499530-6782-44d8-83b3-176985f51d6a", "comment": "Malware payload (SimpleHelp)", "value": "173f22e43c4e0a07815b433eca140f4ade7514ab29a8b9fdd27132553c5dcb6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017391, "uuid": "e1804830-adb8-4fdf-9de9-7a184df6de83", "comment": "Malware payload (SimpleHelp)", "value": "bbf65db4c62b1aae0ca9e5f90b41cff11bd183a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017391, "uuid": "5b52a365-b897-499d-9209-6431c8fb3472", "comment": "Malware payload (SimpleHelp)", "value": "6c427b0b6850e0256cb8b0830a75677df4e2b63c0b4fbe2710aa4900ac9a2b92cd4fda393693839d4b9fd9b561e29e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017391, "uuid": "47a01dde-0eb0-4465-b439-394479cf7a4b", "value": "T19C87331AF39599FBDE33D0FCC0854447EA9678E54381422717F085EA4E606E98A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017391, "uuid": "36d72ed4-9dd2-440b-a268-7fd01ba68a16", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017391, "uuid": "fabe73a9-7dab-4798-b2df-a59de03e0035", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1b+:/uRf+nAu2FuQd73XyFeDMnKT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017391, "uuid": "ef2a2f01-97a8-4ca8-8b68-f3d4b5c0c71b", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017391, "uuid": "380ff6fe-c1ff-405e-9f76-c3304c3bf41b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017391, "uuid": "a0a0c9e8-3ddc-46ef-a65b-d160aa04ccc4", "value": "AWB-20022026.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f41bcb-128a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772051999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051999, "uuid": "028e2966-aab6-49cf-b8d3-4aa21c46a7dd", "comment": "Malware payload (Mirai)", "value": "1542495c79bf09921805cfa6b7b85d75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051999, "uuid": "f88e933d-55b7-42ea-aa38-f9782b3343e1", "comment": "Malware payload (Mirai)", "value": "176038a6d13f6de54a869aae84110b837d50f10439bbb4cd4041c4ef7e1a1797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051999, "uuid": "d0ae6306-6b00-4de5-8e73-4ec783d779d8", "comment": "Malware payload (Mirai)", "value": "b82d7663a14321cf166d755249d953e4fb49142a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051999, "uuid": "e33f423a-c663-4c3a-9108-5f71f1ae50b8", "comment": "Malware payload (Mirai)", "value": "31aefe9616927f010e260781bbd471c487a2a11264b956858543ed91733601660b9cce45e0787d708465be1ff50b7f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051999, "uuid": "9b48bb04-ea9e-4ac0-8d31-b9cdd4370a2e", "value": "T112633BDAF801DD7DF81BD77A4457090AB930B3D502831B3B63A7B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051999, "uuid": "8c17e704-3456-4d34-912f-3949a39c6f48", "value": "1536:fAgVoBExE/V1DYrly8VhyCO1sxyWbxdJiLU11i+VQLK:fAQoBEO/jErlWCO1GySx/o+VqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051999, "uuid": "c0f58ec1-3238-490c-8350-98e9e62a45aa", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051999, "uuid": "df9bec1b-272e-4ead-88d0-9fe8466925d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051999, "uuid": "057dae67-cd95-4166-9554-293acb30d5f9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fa9b77-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772035888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035888, "uuid": "79e99d1a-8428-49b9-87b3-4d83e8e5e8ae", "comment": "Malware payload (GoToResolve)", "value": "ad342e4c5c01d7b30fd7115e2f94bac2", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035888, "uuid": "58563362-27b4-47c8-8802-ce4915454d14", "comment": "Malware payload (GoToResolve)", "value": "17d69d68261bbf1fe985b5912741a040225cf65894a242847391aef17ee0237e", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035888, "uuid": "bc813ead-2ea8-4a6b-8c01-5846f2013212", "comment": "Malware payload (GoToResolve)", "value": "cfeaaa4bbb280b4077453b4a399f8738b4891b18", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035888, "uuid": "829f202c-f3a4-434c-87e1-9f3d4c9e1808", "comment": "Malware payload (GoToResolve)", "value": "02a01550739305684e5a750460e6b4e72c0e69d3fe66f142bd6da2f47104d66b7deeff42f8f0294ba7fa81f2ba9c5cda", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035888, "uuid": "ce757f26-a3dc-4437-9e96-42711e338458", "value": "T1833733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035888, "uuid": "9d453610-abf2-4d99-b002-385a5786dd00", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035888, "uuid": "eba3b33a-80ea-46c1-ab9b-185db698e5ae", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035888, "uuid": "a92f189d-c022-4cb3-81df-8b1f353a89ed", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035888, "uuid": "b5e6800d-d4a1-43a0-a991-0cf49b851bb4", "value": "apple.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca4356-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003058, "uuid": "11be7500-e14a-48dc-8520-79b8fd1a3701", "comment": "Malware payload (Mirai)", "value": "36d6ef42802e8a6b3acf32686bdd1fbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003058, "uuid": "d221fb40-55ed-460f-b0d5-2d35361daf6d", "comment": "Malware payload (Mirai)", "value": "17e803d3e9dc909f1d9dce9fb0b8944bbf3e7177f7136ab235aeabf3a1eff5f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003058, "uuid": "16c83ab7-4a25-4aa0-b3ce-0872d10bbde9", "comment": "Malware payload (Mirai)", "value": "4cbb938572fd862a669613be66aeab61b77e4c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003058, "uuid": "9c802f5a-82b7-40a2-9ff9-263f688e2d49", "comment": "Malware payload (Mirai)", "value": "da2f26d8de01a085fef415d212705f99fd08b5242f48b538dd3a85204c3aabaca7400d2044e70eda08e174cec4a89604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003058, "uuid": "653c70d4-3d15-46c6-ae9c-359b7fc69cd5", "value": "T1C4734A4779C080FDC89AC138676FA23AD933F86E0134B25A27D8FA277D4DE112E2D951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003058, "uuid": "32f677e1-b997-403d-869b-1eabaa43aefe", "value": "1536:BvNYMmMJdgI0vb9sRUSdbxnzF1x1K/s5KWR7iOqoqYFK:0MALbKUSBxh1x1K/sh7iOqAFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003058, "uuid": "44c1a673-1e32-44f5-8314-6e92cb6e4eaa", "value": 79840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003058, "uuid": "aa25a941-f2dd-4bbb-babd-949b2ab84fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003058, "uuid": "9dc01c40-b080-466c-9cc3-0b394f6163c6", "value": "ez_nigger.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1bca93-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045594, "uuid": "9c873df2-7735-4f14-b45c-eca6e6acbc68", "comment": "Malware payload (Mirai)", "value": "3039e9e64d78fdcbf56481bebbcb9eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045594, "uuid": "b3c4d537-64a0-46fa-9827-5b6612f5cbd7", "comment": "Malware payload (Mirai)", "value": "1803910980685646cd1903858ddb5445dc1285800ca3af8a0c7f074ab8942cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045594, "uuid": "1c93c997-8660-4b60-972b-c530a02a5c03", "comment": "Malware payload (Mirai)", "value": "4a2df42257812994446ea32b14c9b7a0e4b39696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045594, "uuid": "a8098ea0-ad28-4505-aa4f-1029f4f470a8", "comment": "Malware payload (Mirai)", "value": "cfe0f3f8ba2b530b69088a343ad366458588cf8a50860a9947bd93ef3a0bddb5be78e249098f8cb7d26e4cadaf7aa25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045594, "uuid": "f75f33c9-ed3b-4538-a214-a5cc8b1e6a66", "value": "T192732931BA760E27C4C1A4B621F74B25F2F243CA26ACCA1A3DB10E5DBF716502517AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045594, "uuid": "04f0fa03-d96d-4dfd-993d-5dc3222d4aa3", "value": "1536:senZA+YFqLywGgWgU2UJdUKbVQJtWc75StJepVcc:7ZsCpAukcVbVcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045594, "uuid": "e05cfadc-a905-43f8-a0a6-41706e8a9eaf", "value": 76704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045594, "uuid": "784a37b4-54b4-45be-b7ee-c779d370a4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045594, "uuid": "5b849ae6-6089-49de-a53e-47feb2e01fcb", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae5e18-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051544, "uuid": "c03cffea-e729-4eae-9d81-1ff7d2a57bc9", "comment": "Malware payload (Kaiji)", "value": "6fcaaf79c191ca97ecd7f2b9d80168e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051544, "uuid": "3ab66e6a-7f50-43c1-ae12-7b0fbbd81121", "comment": "Malware payload (Kaiji)", "value": "1917e2424c87e83dcb8490bb99131356ab3f98392e06c041b9ea422a8f4e31b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051544, "uuid": "ecec86cd-8bd4-43d3-b421-2a81ee304944", "comment": "Malware payload (Kaiji)", "value": "a4a5f42911f1edaaff1e08617f8aba4c953904cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051544, "uuid": "8a0025b9-0741-48d3-ac19-eddc4ef1ed28", "comment": "Malware payload (Kaiji)", "value": "073049d55547ec8df4a26ab8372e62bc85c4b9f7a6e441bd7247568000be7731b87f3586dcc1cc6830e0c9fd15b72aad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051544, "uuid": "559a12e2-543e-4741-a3d9-0d70ae2428ba", "value": "T1B3361A57B8D28A42C0E4367AACBDC1C433671EB99B9B12675D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051544, "uuid": "e1a5a2e3-5951-4ad7-aa1b-7a5a2991aee5", "value": "49152:PJzG9XxZPF773LVPN9GnMbaVZGNJru8cYWPAXq7nLYvVOrzmpxUIU1F1:hzG9Xn53LtN9pbu0Jru8cYWPAXqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051544, "uuid": "7c564f9d-6903-42ef-89e2-c521dbebdb3c", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051544, "uuid": "20a2302d-87a5-4127-ab68-f1c205d0ce22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051544, "uuid": "da15f74f-8a2d-4454-8af8-1bcb64d479e0", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d5a2af-1245-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772022706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022706, "uuid": "7c1c9db2-927d-44a1-9907-0d4c1f9a21cd", "comment": "Malware payload", "value": "1a36b98ac2669dd97ee9844bc14e99dd", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022706, "uuid": "94d766b1-80f0-4b3c-8b78-34b6140e6366", "comment": "Malware payload", "value": "194bfa6876712a07f142f839ec13d233428ab2d0d46c1cd79a70616f55ac7ebc", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022706, "uuid": "e15e6b97-fcaa-48c7-903b-7f2f6a1f2649", "comment": "Malware payload", "value": "4aeb378df0f10e7eea3c8fc1e82e2b090ee12de0", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022706, "uuid": "e0650107-3b9e-47ca-afc4-ced93162b71c", "comment": "Malware payload", "value": "cf66e48833aea66210806353707282a5e8cdedaa1d5cb3743c4a81187b3c3dc132df9bfe091a951a930772080230b21d", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022706, "uuid": "ddab5945-1347-479e-b4dc-772b7b861e1c", "value": "T17852D57170C598252133E4F857919E0DF866811FD5020A287D6C33FAAFF2C2696F7E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022706, "uuid": "efae04e5-8c06-4e72-a49d-342e1154d83f", "value": "192:okoT7Hjz+yZhphrGUMili9Xq113blQO/g7g:CpQXq113pQOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772022706, "uuid": "06f057ec-2875-4979-8811-3d76854037db", "value": 13404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772022706, "uuid": "244b9e8a-b925-4954-9998-2a65de51ffca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022706, "uuid": "4154bf44-801d-4b3c-8218-5f99e76ed6c3", "value": "wp_02.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9265ea13-124f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772026839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026839, "uuid": "082fcdfc-a6a1-4460-96dd-605808e354b1", "comment": "Malware payload (RemcosRAT)", "value": "de0db67bdb6575cfd1fd290e9c9bdc22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026839, "uuid": "1f2f13e6-d8c3-4319-85e0-5723b16af21b", "comment": "Malware payload (RemcosRAT)", "value": "1a617773705434949b2c19d3dc860a2aa57ddf1de6b5e09ed54276f59d787b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026839, "uuid": "4b5f4719-d105-4abd-a3e5-55ae9eab6aff", "comment": "Malware payload (RemcosRAT)", "value": "529dfcc65632cfba043eaa11dbca2a6e67bf5e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026839, "uuid": "46e430b5-a130-4c0b-9d58-ed73a22e6bfa", "comment": "Malware payload (RemcosRAT)", "value": "8b5f033e98f56683f896804ea6654952c034208f6720bdb1851b2bedb32db22e1549d4777f61a07529677908e6132261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026839, "uuid": "ef953868-cdfb-499c-80b7-d232f051af90", "value": "T134E5BF125BDB1A38FA76551C04BC912A3DE4843FA9365CC7B3E3EA953A2F3C0399954C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026839, "uuid": "8706eded-1b2a-42a2-b2be-982b31dd3c5c", "value": "24576:ClMZsL3oNtGyVGGjOHK7QvtdYkGG9s478locTaHYWJeQ5a8rOrcfQF2AhCcavSO6:CgOPxu0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026839, "uuid": "98f27ddc-c4cf-4a83-b4ab-3fc316c12d15", "value": 3200102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026839, "uuid": "aa8eb930-7cb0-4b3a-b1eb-46e8c913ef5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026839, "uuid": "e1cc1192-74d2-48af-b965-c4ccade5e159", "value": "SPEC-Nostro4500119910.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9d23d0-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017378, "uuid": "2fd5b6f7-4596-45ab-b552-9b1a73c46aa1", "comment": "Malware payload (Mirai)", "value": "136ebb88cf914f502054a6525e6601db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017378, "uuid": "95ca7bb5-bcda-41bc-942a-748ff219e51f", "comment": "Malware payload (Mirai)", "value": "1ab5099ca53a7ac2fdfc5455f52f9b67036eb3d89a44ca98099a11cff86056fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017378, "uuid": "ca2e0bca-a852-4adb-a75d-a49d698ba6fd", "comment": "Malware payload (Mirai)", "value": "0975c4316d99b78e4022ee2ea5ac51fd72ba4796", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017378, "uuid": "83430b68-305d-4485-845a-f454556a1367", "comment": "Malware payload (Mirai)", "value": "824bc0e37476be2da2eb15526229e8a271973a946d233bf0c756ed35cf13bacacba4d3f7873c3f2773cfbbe09aa5402b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017378, "uuid": "a4cdbbc7-d6dc-4818-93df-1a2888d79adc", "value": "T1DDA2D025D345AEF4DFAF9D9052C2C2C27AE547C6278AC8E240FEAF017506046BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017378, "uuid": "29203b32-7f0a-4655-8ad4-3e546431a66c", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5zjNSmM4uVcqgw05VxJD:MRxsSVsMD6xiJJE5zRWNJo14uVcqgw0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017378, "uuid": "679e0de5-c0ff-405b-ac6b-93f9e768a95e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017378, "uuid": "c111bcf4-d176-48e1-9f2e-8e0efffbd32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017378, "uuid": "fd0874ad-aada-432a-a232-893de6e453bf", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98392914-120e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998931, "uuid": "fb21caa6-de6a-4737-ac40-da2f536d216f", "comment": "Malware payload", "value": "1c8c4746a1669b00f53d846158dd9693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998931, "uuid": "0bffc31d-3127-42fe-9342-49b31e1716ad", "comment": "Malware payload", "value": "1b9e6fe4b03285b2e768c57e320d84323ac9167598395918d56a12e568b0009a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998931, "uuid": "216164ea-c1e1-4980-9a73-e44289c02d10", "comment": "Malware payload", "value": "d97d21536c061e7a7151a453242d36f3ab196a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998931, "uuid": "12f70017-39f0-4ea9-85ab-81c6d5efc73d", "comment": "Malware payload", "value": "e3a50e3967e765bc5cf4299c698bb7c393668ba04a05f4a49911cc187f949ff9895126f0fcd6bff356a5ee7c87e04806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998931, "uuid": "5770a15f-28e8-463d-a531-39dd8016bad4", "value": "T110248C1463A00DF9F877817ACC522547E67278160BA0DBCF07A04679EF236E1AD3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998931, "uuid": "29f563ca-6605-461f-9fb9-4fbb0e2a9050", "value": "a256a8daec8bf648f34b2fb5956a1bfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998931, "uuid": "0b984c77-7f62-4eb1-9566-75effa730b96", "value": "3072:pBVBEtZ0Ws/UMmTQY/HIrgloh2aC/GnbJerraaKWSt4jT3ySy:Rsns/9mEYvIrglCckgn95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998931, "uuid": "35a689e3-28af-494f-8535-ae93785b7f78", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998931, "uuid": "4d7dc981-86f6-43f6-8daf-1ead48059669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998931, "uuid": "f26cb805-a35e-4c93-9650-4fedf66605f4", "value": "1b9e6fe4b03285b2e768c57e320d84323ac9167598395918d56a12e568b0009a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca5db7c-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034614, "uuid": "8460d67c-aa58-43e9-ab9a-b63681ac7561", "comment": "Malware payload (Mirai)", "value": "6d8aa39cdb3bc3836a2b84004b34e473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034614, "uuid": "65ec41d9-c671-45f3-8b95-f7f04ac282c4", "comment": "Malware payload (Mirai)", "value": "1dcbb4600ad02b9cc5767fbdf8e3021fc8833a4e18ad6a7f398b155c7a88884c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034614, "uuid": "4f6d106a-4160-491a-9935-0b99afcc5c11", "comment": "Malware payload (Mirai)", "value": "3f94d07cf113f8f73f374503178c1c0570f99105", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034614, "uuid": "79462889-71ce-4541-adab-ec3e100b858a", "comment": "Malware payload (Mirai)", "value": "2035975937519d7ba4f40b1f2aaf697f21b5ed791f1748d67a04204d6aab237a92a88a8a56606d8f5bc55d0301af3391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034614, "uuid": "340e45f2-772d-4a98-9300-ad0e695cc5b0", "value": "T129334AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034614, "uuid": "3b97f210-444e-4399-8af9-9b8a3d2d2da9", "value": "1536:GWa2d5sf1Gg+ya+nlQ5FmbLv5XfwVsp3MSfCYf:Gt2d5sf1GCammrm/xPMW3dCYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034614, "uuid": "d5d23ef5-c788-45a9-86ef-7f1e63885544", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034614, "uuid": "0260e9bc-c00d-415e-b456-4ca947833cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034614, "uuid": "028660d5-0c0a-452f-8ea4-1652aef7ffa7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2b99f9-1288-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772051469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051469, "uuid": "8010c894-49c8-49be-a445-b77f378562c0", "comment": "Malware payload", "value": "cff831e7e0b147fab88c00413d52d8fa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051469, "uuid": "da5b05c3-515f-4ebb-9cc3-3954d7c313d2", "comment": "Malware payload", "value": "1de321bd232a4dce10c575a1eb72fa8e40909f58f5f832ef0f418b023789a637", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051469, "uuid": "84167c5a-7ceb-44c6-817a-21db2ea82ebb", "comment": "Malware payload", "value": "7c8df31099a38659f810c455af80577a3d402324", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051469, "uuid": "21ef5560-ea77-4674-8091-909eaa755d94", "comment": "Malware payload", "value": "6d9188c46b54830a44c6b11effee7e9bfc2eb321962f66de65e695bf158c9f7cfcac46c5108a0ced57c084fa013484ff", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051469, "uuid": "58ca7539-eaa7-438e-8dea-cc01f692a786", "value": "T12863E146BE80D636C5470F7187DBA7A59B7ADC086F531807728BB34E6E7254011EBBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051469, "uuid": "fddfadb2-f278-4cab-b470-b47991d73f07", "value": "1536:hTPM3GEA/TLRpRsP3qrP70Pb9B+POZyJlst9/YobG:oA3RQDq2sJlsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051469, "uuid": "7ecd4574-d40f-4ed7-9d5c-83287c89ef59", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051469, "uuid": "75fe1c48-47f7-4ca1-a1ad-d287990790a3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051469, "uuid": "cdedd4d6-bedc-4438-b8fb-4b4ae2a84934", "value": "Procexp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e46cf03-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001062, "uuid": "a5148a14-2820-49b8-ab62-2aac6d3b9540", "comment": "Malware payload (Mirai)", "value": "cdce2d238f4e8e1fcd1d654a61c4b702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001062, "uuid": "04af1960-1cdd-4560-af24-29df1c97f9be", "comment": "Malware payload (Mirai)", "value": "1fa43c3b5fcf1f01c4a9d961fa7c97b53103ea65bf27e4815e55d4ec4f5be497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001062, "uuid": "e50da799-b496-409a-a112-51e9bedd2f87", "comment": "Malware payload (Mirai)", "value": "e6622fa6cb69f88ada0d9285ced472a9cee06d83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001062, "uuid": "76108eb9-2848-46d1-84ce-a09107dd5dd5", "comment": "Malware payload (Mirai)", "value": "510e67a24e4dc336db3f6df60310ca74a601fd3fde6f67450791466240185b58e219302946901f837bc4eebe1f36ea68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001062, "uuid": "6169e52d-84db-4bfe-a0c6-068093258eef", "value": "T156C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001062, "uuid": "afa6b974-d81e-40c5-8e4e-c86c298e6376", "value": "3072:wf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4pqe:wf0tJBR4NSALD7rnCrheiCqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001062, "uuid": "eac1ad45-e7e6-4d84-b9d3-298624715edb", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001062, "uuid": "87a2ab25-bf5e-476b-869d-19c3ece4630f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001062, "uuid": "21185746-0477-4b99-b303-f2a5282e6494", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09163c79-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012865, "uuid": "c8744b3b-44d2-4212-9321-57152389c1ea", "comment": "Malware payload (Rhadamanthys)", "value": "e74abda7841e3aef093c81866b8900fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012865, "uuid": "67e77c55-829b-4acd-a60f-29870f872b0a", "comment": "Malware payload (Rhadamanthys)", "value": "2076a7b9fd26e4c7e8f23701903eacb1d78c4ac86104d47c9cb4ee2c28046955", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012865, "uuid": "c26b608f-50fa-41c7-b765-0fc5abc830de", "comment": "Malware payload (Rhadamanthys)", "value": "315ba82a98909151a47f7d4eceb6986d4c1e82c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012865, "uuid": "cec0f547-f1e9-4b7f-9ebf-8460770f0a79", "comment": "Malware payload (Rhadamanthys)", "value": "cd5b0465445d96905c3e4adcb8166e834d634aa13aa17183619ba3e74ad00b6a771c29703bb72d696f528c4a68b7ae0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012865, "uuid": "5bb24ca5-5763-458a-87ad-044be943f447", "value": "T147A30BEDBF322DBD21D627E9EE9C8AE7700D0A4919FCC856D867330643ABB0144589C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012865, "uuid": "0bb91cc8-00e4-43a7-9887-7ac0895d2812", "value": "768:GDhd0i7J4sYKgY/CMNfWd/erXhhrN4R/HZaAny6H1oCSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20Gr3rN4RRaAnDZ6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012865, "uuid": "0cec5444-ffab-4f84-a951-506c08243687", "value": 100681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012865, "uuid": "50f234be-909f-47d3-9bae-afaf2da7fb5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012865, "uuid": "7f2e098b-7830-4b4b-8f9f-2429270424b5", "value": "invoice-1637482117.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476964f9-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012969, "uuid": "2577eab0-6245-48d8-90b2-83878a95dff0", "comment": "Malware payload (Rhadamanthys)", "value": "1aed8e359c151867f89ab8a1ffeec771", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012969, "uuid": "6151b081-5710-4332-af25-8089077ce85b", "comment": "Malware payload (Rhadamanthys)", "value": "20e98dcbe0ea19fa48947ffd3d120fd1c07b40e3f22d9ace701181358240ab9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012969, "uuid": "3afd4d7e-cf71-440f-9ebe-98870b148f50", "comment": "Malware payload (Rhadamanthys)", "value": "ea0f6d0d1af1ead13ae8f604faa93972849122f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012969, "uuid": "56a25821-daec-40a9-948f-503be1f56333", "comment": "Malware payload (Rhadamanthys)", "value": "bddc380a63f0aee3816bc57e54392f29d8441825dc4c4d6b3d23d064821446c6fca79424e6beaa0166ed44511eead875", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012969, "uuid": "0ce29fed-4578-464f-b968-9ce44d7dbdae", "value": "T1AEA32B145F32BA1548A53BEDBD76DB68464E042B5C04632A9E1DFFA2E1EF71E50303CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012969, "uuid": "15765835-e9ce-4b15-b6cb-eb1ba29a2a3c", "value": "1536:GDB7eKg20dSnrGrZV2NPnoUrJIAeC59846BkQWJ+aY:GDB7b0dSr8H2BnoUrJ2C59846BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012969, "uuid": "2f1efd5f-a5bc-42d6-bc6e-8535b8c53a29", "value": 102165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012969, "uuid": "2a7d445b-a59a-4616-b46c-b27c84319b2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012969, "uuid": "8825b413-d9ec-452d-a710-52f004bdfab0", "value": "invoice-1637482117.pdf (68).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54e3834-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035595, "uuid": "0ac04992-62d2-442a-bef7-c10be2ce6ba3", "comment": "Malware payload (Mirai)", "value": "2cc2a034575dab050e764895d9424361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035595, "uuid": "0cafc253-f355-40c6-a3a0-3b227d2ff180", "comment": "Malware payload (Mirai)", "value": "20f951a1a8340db67379c9ace359ac4ff0dbf8e0e6f09b6b864310e61330736e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035595, "uuid": "5c9ff96d-9e2d-42f5-8527-7280ddb39500", "comment": "Malware payload (Mirai)", "value": "077573a8e32ad3519d2630b6f84cdab8d6b4e68d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035595, "uuid": "ba134542-d6d9-40aa-ab26-48b661abc28d", "comment": "Malware payload (Mirai)", "value": "8cda43f1dbbfeb79794949908ada12684b2ef29b2a38e449432ecb6e49aca4642bada5419dd8dc397cdcdf405ecc03c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035595, "uuid": "ba79c766-8ecf-4c2b-9280-8ec078e370a7", "value": "T116A533B912B763159C128F3C37AE227242CDFA85ADC260A0724D7C516A9FF3D710E56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035595, "uuid": "44deb697-1152-47b8-a060-b8abb9088465", "value": "49152:YDxMx8VnLLqjGWjyUkjR+6RLA2xXC0NEaIA7:YDxfFLqxNO82pC0/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035595, "uuid": "5d129d23-2ead-4b41-820b-97218dacc825", "value": 2178248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035595, "uuid": "1851c8e3-63b9-4fdf-9ed2-4e69d00364b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035595, "uuid": "0d067447-8a61-43ec-bd07-0aa32a8fa438", "value": "PPC64LE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b5956f-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001044, "uuid": "13ee8775-4228-4813-bc48-9b3ee0a4a758", "comment": "Malware payload (Mirai)", "value": "640965bef11113aa818d688b2749d64f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001044, "uuid": "e7b744c3-75a5-426f-ac41-80106a30d97f", "comment": "Malware payload (Mirai)", "value": "22ffc6049a2dcf9ea8aef5bb95367f820cce4b220fdfff739010456ab278134e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001044, "uuid": "50c33d5a-2abe-4afc-b66f-e466b7148f08", "comment": "Malware payload (Mirai)", "value": "185db31d683d17fc3afdb9a16263f652777f406e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001044, "uuid": "afd77ea0-2f35-4c94-bbc5-61250336766e", "comment": "Malware payload (Mirai)", "value": "0bf8515c60fd2b3ab5282f6a06259d7db0d7de6998289b87576e77564db5442538e58c34d191a80bbf77a99ae7cf3dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001044, "uuid": "304812fc-aa47-4133-86b1-e6e81acb44bd", "value": "T16932D517A7BBAE1BC4D033770193072162E95F916024472FBD0D1C8E2E9B3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001044, "uuid": "70561936-5569-4493-b9e4-369cf4deec44", "value": "192:xvrOR1CQOsz1NxfAzMH9iG0GhWaDpU/O7Q89AGSybmqeif:xvrbCzfaM2GwIU/kwGSJUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001044, "uuid": "5c335e30-12e7-49e3-8d7c-049ddfa55b54", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001044, "uuid": "a54801d6-ef5d-41d1-ae45-2652a9d99207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001044, "uuid": "6f82b017-0ddd-46ac-b47e-68c0adc07ba6", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05884337-122f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012859, "uuid": "2a1f1a86-7658-4a7b-9f58-3e4e4914f914", "comment": "Malware payload", "value": "e036fa7e86ebfdfd151634e09b5e18f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012859, "uuid": "399defb5-fbf6-4126-9d77-721d44332267", "comment": "Malware payload", "value": "2327596f06be8cb7403912358db279d7c650a53212358f6e252942a8ccd74d49", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012859, "uuid": "37e0bfdf-a803-47de-8226-b1e994ac4b2e", "comment": "Malware payload", "value": "e7cbe8fb6ff8e586635a67478db9ce3891b178be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012859, "uuid": "9d6fa632-2f30-4de5-bb18-ba0c1291a442", "comment": "Malware payload", "value": "31606a6e50beb7028b4284935a1b2a7328d7309ab4962efba68077e9c83ab991a805ba0bc7135b346da7bf3f45248515", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012859, "uuid": "1e0d5ce1-dd3b-40de-a5fe-a94337d3265d", "value": "T110A34C46270375F3538FF2E60FF7ABE4BD075416AA4D52829917A37181FB6EB080A4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012859, "uuid": "d8052fbc-e031-4994-afa7-d2e1a6133a51", "value": "1536:GDB7eKg20EcUcgrzr3zzcgscYocNcdcjAbcQcncG7q6BkQWJ+aY:GDB7b0EHTPDzKFoiy1leh7q6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012859, "uuid": "0bbeed2c-9a26-4b4a-812e-27f2c048f2ed", "value": 105992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012859, "uuid": "8d7f6a78-90c2-41b7-95b4-6503d9066943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012859, "uuid": "1a825b87-87b5-4620-8fb4-9530ccd1ded5", "value": "invoice-1637482117.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc58a3f2-128a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772052249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052249, "uuid": "649cd0d2-1c78-4545-9858-0f05d81c6fff", "comment": "Malware payload (Mirai)", "value": "f326b5185f1671a67f4de9d9e7738b92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052249, "uuid": "c87db86f-a4ee-4c81-8322-94cbbed69e55", "comment": "Malware payload (Mirai)", "value": "23b4ab355a485cb7f626f5e1f18bd7582887e43cd51d1cb4899b39933956dfc4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052249, "uuid": "3839cb12-dc52-435e-b0cb-5a31acccdfa8", "comment": "Malware payload (Mirai)", "value": "cac7b41c8b7d67f127673da79d4e21ec261f6fa7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052249, "uuid": "d1f4ba1e-6915-4fa7-b5e1-f1e49979d08f", "comment": "Malware payload (Mirai)", "value": "a3fbdcc35badd3278a8b3df5b20b4a2173747b8d5337e7f9f7607a3f4cfae97c9d5d4c470e7db55c0c13c272f2d5f695", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052249, "uuid": "df4a267f-18b3-4b54-abba-4de9e3ab6579", "value": "T14B41C4CA27D16435ACB69973F3BA0614358098C914F06E445AFD78F854ACD24BDD4EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052249, "uuid": "ab37c7b8-a13b-450c-8a4c-8c1a8b95ea04", "value": "24:vryd/sd/sg/szld/s7ZM/sXG/sHDD/s9IHZ/sJ/s7h/so/s+/sbyeH:vGGGnRG7tXREWHK62PJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052249, "uuid": "8e524531-76c8-4c8e-bbf8-c30b59cface0", "value": 1976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052249, "uuid": "55ef97bd-739c-474d-a1b3-ab3bd61e18b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052249, "uuid": "c6871cb2-c4ce-4f1d-b18b-3dbd2e238b2d", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae59b7a5-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034617, "uuid": "2c68f134-1bf4-46b2-b66d-6bc41c023009", "comment": "Malware payload (Mirai)", "value": "ecaad7cf57175b5d44beb0c543137527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034617, "uuid": "ac1ad76c-9fb0-4508-9fbc-ccb9911fca43", "comment": "Malware payload (Mirai)", "value": "23cf63aab69f8f6588784339bc700c4eae87be678c48b0843081b7124c6c23ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034617, "uuid": "54453812-74bd-4ce9-ba4c-653ec6c00c5d", "comment": "Malware payload (Mirai)", "value": "1ef97233f5b7e3ba1ee43086e00ef100e0211dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034617, "uuid": "7a02e368-aef3-4ab8-bc07-3f64b2115aa2", "comment": "Malware payload (Mirai)", "value": "26bc32b604950c455edb7f89f7d5d6b9e942bdf5f25a56c4b541fb422d2e430454c60bf78412ed7d9b9121716486b535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034617, "uuid": "6dff9177-9415-4617-9aab-ad26f3c4b506", "value": "T179434941F8819623C6D1127BF66E468D3B2613E8E2DBB3079E225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034617, "uuid": "9cd7e271-c14f-4fe6-a2cd-9061c1c4b692", "value": "1536:RjjQg6zvAqEkVaPU+klQTm9TliCs5Xvinf:RjoI/kqTGB9qinf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034617, "uuid": "7e64b3cb-1f6d-4042-a624-134cd282fd98", "value": 59648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034617, "uuid": "c6e8b610-b4f3-4a01-b8bb-13b427148a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034617, "uuid": "97ca96fa-af2f-4539-baa6-de4af60d69f4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6c5662-127f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772047312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047312, "uuid": "347129eb-777b-496d-b282-ada647e4c7fa", "comment": "Malware payload", "value": "6208475dd21568c8d6e98a26730208d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047312, "uuid": "d3d70871-e6ea-42ee-9717-11311de75161", "comment": "Malware payload", "value": "2422d1cefd84f93d49e1f2285358f5779519d8e6e795f9b760a1bf8b7de2493c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047312, "uuid": "280c29ac-bfda-421e-ac5d-3eb4bdbec553", "comment": "Malware payload", "value": "33455a028054689ace62639e16a4b86d16df977c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047312, "uuid": "cdcf1685-a1a0-4a5e-b8ff-25b579b89f8e", "comment": "Malware payload", "value": "5f044da6d4f0a0c123099d1de5ca6b19ba1c1ee804f642145fcc086ca8a59d8412dc3cb7d4263ba3121751328e3dcd6c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047312, "uuid": "47dc39e9-5dac-4703-a3c4-6570c738b171", "value": "T1C601E1CF2BA1F1458A2CAE14F26B0A547949D7C830700F59AB5A787678ED6107CF4F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047312, "uuid": "429ccbce-132a-42ed-8624-5cf5fa786b71", "value": "12:GLqvjjNIl5zAQ0LKjnOsLCl/2SEPtaKApiAzfAn:GLqPNI7yKjpG+/tBSdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047312, "uuid": "404bb6d6-e684-4831-b54f-6421223a39f9", "value": 696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047312, "uuid": "2718e5d8-d09c-47d5-aeee-f9ebf9b45182", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047312, "uuid": "08f948b8-f759-47fb-b3cb-697e8e64f2b5", "value": "abc2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d801cd88-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772029962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029962, "uuid": "957183ad-a87c-47e5-aebc-1c619c326897", "comment": "Malware payload (SnakeKeylogger)", "value": "430a34f8dd4ca18604ff1fd84115e61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029962, "uuid": "a3735b70-ef13-4427-a0ee-4d2276a3a0e2", "comment": "Malware payload (SnakeKeylogger)", "value": "24a07efb7c95800b89d34683abe09cf8e7d7776483f586abca769c2f98bb67c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029962, "uuid": "7535dea8-321f-4b8a-9bd2-fb97d257a916", "comment": "Malware payload (SnakeKeylogger)", "value": "a517c5c5c6fc4737c9c7af3a266ff1b5958281c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029962, "uuid": "3047d869-8ed1-4297-9fb9-443d31cf64ea", "comment": "Malware payload (SnakeKeylogger)", "value": "93d1a6a9a64d6efccd4bcc44e15c34876185f30157557849b186197d4f9bd7f4e631db42f4884521e9a6a2a44e82e172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029962, "uuid": "257ce649-8a10-4dda-a8ef-03db98260225", "value": "T11225E162CD43BB24C56C47BC812703D023F0E9039356D72FAFFE86E659A2BD5CA16166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029962, "uuid": "8bab8f0f-fde9-464f-b483-d5f56959f2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029962, "uuid": "474a63d0-804d-47e2-a34a-d254f13684dc", "value": "12288:7IMUm85aCEblLoRyEYLzXAPbCML87sgMXaO4RAwSW/+2PmvszdvWBn/F:7DtvllLoRymbJ8wgMh4CzWm2dzdeht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029962, "uuid": "622acf0c-50b7-4ab0-ae33-f954664b1a84", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029962, "uuid": "54db4dd9-41b2-4c24-bd00-36fdefc848b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029962, "uuid": "aa2c4fd4-6b31-4691-8c65-b00d12d1be85", "value": "Request - CSR-204S095-25-0062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e37b20a-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013007, "uuid": "a3649948-63d8-4c9b-a3d1-184cadb98b9d", "comment": "Malware payload (Rhadamanthys)", "value": "69f377a69813d95dd283f84cf862db73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013007, "uuid": "704e9517-dc67-42a1-9667-940cc5334740", "comment": "Malware payload (Rhadamanthys)", "value": "24aba1b2c19eb6eb8cdcb8cb6c09f1d36c133d31a658d65c8b2c465c61c4d5c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013007, "uuid": "d9d24f32-946f-4088-8d01-bf7a19e8a055", "comment": "Malware payload (Rhadamanthys)", "value": "0490f5e81d40ccb2b1b97bc4b661210f87415f54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013007, "uuid": "f4fc7805-0eef-4885-ace0-bcc5b1d9e7b3", "comment": "Malware payload (Rhadamanthys)", "value": "e182bfff24b1f06810461d55c70f4ea79fc381c8bf7773f866271e3aa21225e7638749b72c6217ba0b06a91216d9d335", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013007, "uuid": "88d9f73f-76e1-46ac-9610-f49e4b8480ca", "value": "T13A9318F28CB7247141CBBEB85ED245F6994A95761D3A85884C1FBB70A9C77302B8C1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013007, "uuid": "d221aca0-33fe-41cb-877a-013124fc6473", "value": "1536:GDB7eKg20lGAcrr5bMD3S+juNWHgJdox2ujluyVTRfnrHdZxr8f3mr3wDwc6/Dkh:GDB7b0lGAcrr5bw3S+juNWHgJdox2uji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013007, "uuid": "25e3b02f-866a-46b2-ac2f-25d70fae4b3d", "value": 96797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013007, "uuid": "7896911b-3779-443a-8786-cd6381082a34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013007, "uuid": "825675a7-b459-4b3d-a0d4-1b153d6d1090", "value": "invoice-1637482117.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4a2751-127f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772047552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047552, "uuid": "1b109b0c-8eb1-45e5-9425-57eacd99502a", "comment": "Malware payload (Mirai)", "value": "94481e61b6acf8c62b88956b649c0a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047552, "uuid": "1044c952-2165-482c-a992-1f75841c9eaa", "comment": "Malware payload (Mirai)", "value": "268ca9e3b4cc912a7e177ff52c711398af1d926c31b28ba303ed72be15de1d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047552, "uuid": "cc3e75c3-ce9f-4df9-acb6-772c0e0ad1f5", "comment": "Malware payload (Mirai)", "value": "83cc56fcfccfcbc33eea85991c5e239796189bc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047552, "uuid": "0a91af8a-d8f7-4a70-b797-5a79db853130", "comment": "Malware payload (Mirai)", "value": "57ad7b112c849747a42d9bdacfc11740c2a1fa91fa0667314573c9c1d9fdb3aaee19ac1ecbc77a5b164a99c5b2e3c81b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047552, "uuid": "12659996-71ad-4fd6-b7b6-3d7cfcdc93a9", "value": "T199633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047552, "uuid": "fdae9df7-4dd9-4496-9b91-42a4a3ec04dc", "value": "1536:lGRaTYmol/hGIAs4PNvA7QqGm75123tSt7l:lya7hJGGmVDBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047552, "uuid": "0bdbebc2-2129-4d28-81a6-3e54ac95c3c2", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047552, "uuid": "8d0c0f28-604e-4a27-ac6b-ebd8b6f9eef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047552, "uuid": "8cf35fc8-2728-4cd8-a5f0-1aecd2175222", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7500308-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035598, "uuid": "f2115f3d-c0cf-4ef5-a53b-e013e41aeff2", "comment": "Malware payload (Mirai)", "value": "b0a60b07381787a79524ae7bc48bbbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035598, "uuid": "8d6c3932-a1f3-431d-8988-67e36ad31658", "comment": "Malware payload (Mirai)", "value": "273d0221dc2565e9db2c66c0a817db6f97422456c451db8f478e68861e9ccefa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035598, "uuid": "59fd0209-4c85-4a82-a716-a85e3cf3f00b", "comment": "Malware payload (Mirai)", "value": "d9c6e211af09fc25808ee3dd192885a2adce7d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035598, "uuid": "bd47905f-194d-4de4-a0db-e960e7bc267b", "comment": "Malware payload (Mirai)", "value": "f17da9752058324a714c5f28eaa5de7b60a5201f0cd4339d3568e3ade9fab48618b4d6fae5960bca3523cd5d5b49f34d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035598, "uuid": "81f37e59-5a30-4337-a773-28faae8c0e1c", "value": "T1DCA53352B9CB1554D4D6CF9BE9BC90FAF0504D98964D129DADCFCBB2726E0A20C9CCB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035598, "uuid": "526c8caa-f9ab-41cc-99ff-74151ff0b793", "value": "49152:503NJc37/eVNm+rxADpS5GtEHVv4BKSX5XPYJJ/ANdwwFlgdqoDwoe+Q:509ur/e3m8SpS5jVwhX52J/A1lRonQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035598, "uuid": "8a1161d0-2e55-429c-95ef-cb6f5f695dfb", "value": 2115280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035598, "uuid": "0ff6cd85-8da3-4f78-ae5a-0427d0e4e6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035598, "uuid": "5db180a3-b2f8-4c55-98ef-d2071dda1f75", "value": "ARM64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7422620-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012835, "uuid": "532435d8-eaff-47c1-b688-468045ef69e0", "comment": "Malware payload (Rhadamanthys)", "value": "4b95f57c67d65e1374b6121378b75195", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012835, "uuid": "16b466e5-5a4d-4516-aa4e-02faec46c552", "comment": "Malware payload (Rhadamanthys)", "value": "2747aa4e97b6db13845ba46a6820642db66f1e197dae2b770eaec69fb7aefa46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012835, "uuid": "8afff45c-4bfd-4092-a8f1-a8135939308f", "comment": "Malware payload (Rhadamanthys)", "value": "097badf9e8dd01d547a4c889e5745f0bcac87bdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012835, "uuid": "0ee0870e-5364-454e-a45b-dc01c63eb85e", "comment": "Malware payload (Rhadamanthys)", "value": "df4a988da8c2874d8095f4038b6dd68f6dbd912d0ce228c5038a694098ec96db3b95dd35959d9bbd4dc48d0c1ce1724f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012835, "uuid": "f1393446-817f-4d14-8757-fc69ea0b4406", "value": "T182A308B5202DFD693D2C95F93A9F94A6CD1ED4861906693B80C37FF354FEA870208993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012835, "uuid": "7181118a-f80d-460b-9a76-6007985ecd1b", "value": "768:GDhd0i7J4sYKgY/CMNfWdUw0QEqh474uh1iiGbEwVs4dW63VkCiF77qIv4KrTg9E:GDB7eKg20ryrOrw4MWQA9Rz6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012835, "uuid": "2a27de5d-db34-4df4-86dd-3242a91118c7", "value": 101985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012835, "uuid": "98d6540e-d288-4bfd-acc5-d529386f148e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012835, "uuid": "5588e237-f92a-416e-9ccd-517ac1d70c9c", "value": "invoice-1637482117.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a662cd05-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017423, "uuid": "79d6e37d-2511-4946-8149-6129ef03b37d", "comment": "Malware payload (Mirai)", "value": "7a336ab35a65bb6c5c9af9ed5244e5ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017423, "uuid": "fc6ccc6f-c84f-45d5-915c-c480b572f785", "comment": "Malware payload (Mirai)", "value": "280a0d51166091e6589805967fbad39ec5e7ab074532520c4c702ced337482d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017423, "uuid": "b282470d-bdaf-4e10-b0b1-a556e2ad5f03", "comment": "Malware payload (Mirai)", "value": "89688b2af729049b126f9389b256cb53d1f59956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017423, "uuid": "ba286496-d45f-4fec-b73c-2a7ee2ece58e", "comment": "Malware payload (Mirai)", "value": "dba926735cc9332bb3396eab6424714b8d7ca0a79cceab31f852098f823a245df4b39a33a9606158fe563ac884bcaf63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017423, "uuid": "0c943e06-c8f6-426c-8c37-6b860d28ed75", "value": "T106431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017423, "uuid": "ee051525-7b4a-4b33-9b25-7dbd0354befc", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017423, "uuid": "eb7a928d-fb1a-4ced-a587-203cc88c571d", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017423, "uuid": "e62f7a5c-f01e-4274-8f8c-2d1ccf16914c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017423, "uuid": "53a31574-ca56-4054-acdc-439dafd5d5bd", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbe755f-1278-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772044330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044330, "uuid": "d14de163-f23d-4f05-a46b-565464c76a50", "comment": "Malware payload (Mirai)", "value": "000344c68880129e90ceae22a1709701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044330, "uuid": "9d1ea47e-64dd-46c9-9b83-145640163635", "comment": "Malware payload (Mirai)", "value": "284beacfb87f61dc15d3558bab24ffc9a07181d7345295f58e79080610452605", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044330, "uuid": "d56dd4ab-e1d3-4001-834a-5ea120a6345b", "comment": "Malware payload (Mirai)", "value": "ac08c937d2de09a618f232f1b60bddf503dbd3e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044330, "uuid": "0ce779ef-231e-41dd-a76f-21ad16e83fb8", "comment": "Malware payload (Mirai)", "value": "ddaaafb1ba9f00e55f629d14d3db92e7364d957a219380a46c475335a254691bd9f774cc24bbedb68225803a3d13985d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044330, "uuid": "ea640e7c-a193-4092-bae1-8152a53d840f", "value": "T1EE438C37E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044330, "uuid": "e92731a4-f708-4acc-9a8c-ceaf79f92e07", "value": "1536:Vaa0brW/Od9hlCR3KJwKYXwKEpPDCMC2+WP:Vv0brWGd9X5JXYypPDL+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772044330, "uuid": "5015b302-f102-4072-9475-f53c31bea536", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772044330, "uuid": "bc86708b-0a10-4a51-8228-dfedcf7b7cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044330, "uuid": "0e350326-3c3b-4c58-adad-97cd5a06fbe5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99a45f9-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035978, "uuid": "4779a4ef-7646-48a9-b085-b7e1e4ad041f", "comment": "Malware payload", "value": "c19571c8f3ce3fb160829515b760b21f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035978, "uuid": "54b895ce-c5b3-48d4-9d9c-b0e6204818e9", "comment": "Malware payload", "value": "28beeb84738834b6c91be39dceee8a0d7e68e9c84d0e66ed4b77e0e84baa4a28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035978, "uuid": "69143e9a-9daa-4ece-aa2d-f54e5a3b72b5", "comment": "Malware payload", "value": "34947d8981a4c6a59fa02dad03ae969df9ff3648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035978, "uuid": "e4925c86-ccd8-45cd-baee-47cf4f8b94e6", "comment": "Malware payload", "value": "9555a5a7fea2b0f4da192b8bf23efc80f9e67ae19f3d20507c5b6b5d2776a686fa938dbd6a3d3d56721bd8495278dc09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035978, "uuid": "610781cd-6b14-4e96-a019-0ea3e3deafcb", "value": "T119864A07EC9506E9C9ADD63089669213BA727C495B3063C33BA0F7293F77BD069B9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035978, "uuid": "3284e60d-3766-415c-ac82-9e6f2953a603", "value": "49152:n/CrO/q6/18hv1MFc8oz3XE8aSHAb5s9xUjALzpT39Fq2L6zg2uSHFCt/0jsWfqD:nqp1U8aDdszHE1zmNZozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035978, "uuid": "ac400cef-59ac-4b35-86bc-784db1a47895", "value": 8443816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035978, "uuid": "7aa55bda-5889-4b6c-8805-fb433bdee17f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035978, "uuid": "d69dd9f0-ef38-47bf-8cf0-8175bd52b3a3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ab233d-123c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772018790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018790, "uuid": "37f7f9b7-874b-4af5-b5b0-942d8e3e6bb8", "comment": "Malware payload (NetSupport)", "value": "5e9b7349fcabc7cb34c3a4d5c3468641", "object_relation": "md5", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018790, "uuid": "c9d8b4d3-07d8-46fa-bcb0-74289a547bd0", "comment": "Malware payload (NetSupport)", "value": "28c2426e93130038b7470e3b9ce5d6a531bb17b427aea61064157417c5ce6666", "object_relation": "sha256", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018790, "uuid": "ac090c98-0b66-48e9-800a-363a0d7441d1", "comment": "Malware payload (NetSupport)", "value": "3afb18434b95d99b3eb61a4cc7e388d843cacb69", "object_relation": "sha1", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018790, "uuid": "62716900-19ce-477c-b111-81ac9ee4bb55", "comment": "Malware payload (NetSupport)", "value": "8aef7e1d0f2ad884be935080cd1202090ac44b67754f89e71572ee432b7120a67fb21c7dd55e198f63caad599a6c31f6", "object_relation": "sha3-384", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018790, "uuid": "216d0a0d-f0fb-4c92-b501-dff77f16fb06", "value": "T133D633A4A6E811FBF9AF933DC862D992C59675663B49C183D3F8C1A12C733C4693E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018790, "uuid": "023fbad5-2be0-4d05-99ba-df2c1780accc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018790, "uuid": "31160783-397f-4cbc-9ebc-e83e061fe924", "value": "196608:J14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorDurH/P/XRLSq2KKeF:J14FSsFl7dCR1C99/Lku+uDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772018790, "uuid": "dc2f9db2-722b-4c8a-91d7-ae13b13055df", "value": 13413159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772018790, "uuid": "3249d0ef-7f71-4d7b-bb05-78ae7c402f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018790, "uuid": "7c4cbb72-b5be-47bc-94cd-fec7666183b6", "value": "Confirm.support.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489d4411-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045613, "uuid": "d1db0dcd-965f-4790-90df-9e2e9d0ec4a1", "comment": "Malware payload (Mirai)", "value": "a3a01ad05fa10b42409b9f6b48e40e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045613, "uuid": "a72f9ec3-97b6-4b62-87a3-9daa9ba1d61b", "comment": "Malware payload (Mirai)", "value": "28fc7f9f1587e43c90368c8257295bbb7dd3b053b16f5b19c1c8c2f0b5849f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045613, "uuid": "6f0bcf4d-2d1e-4827-86ac-0512ae4f59e6", "comment": "Malware payload (Mirai)", "value": "10bb9c76b8876df2528cba734500329602fabf5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045613, "uuid": "e6510218-2924-4b27-90ec-fddf3fb12084", "comment": "Malware payload (Mirai)", "value": "608deb7f2855092fbb1549c0344bb52372cee611b5a0484fb6d97c558c65c1a11decb07e67a09c237cbe74d7f02b2dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045613, "uuid": "7add97e9-e7c1-40a2-a318-f64735d071a6", "value": "T156E31A56F8818B15C5C111BAFE1D128E37231BB8E2DE72129D246F707B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045613, "uuid": "f1a65da2-27a5-49dd-9a64-b38bf087652f", "value": "3072:TcFkrqwVxUMCbBqthVK3z8avWtOUaf0hzjp1b:TukrqsPiqtDK3waqM0hXp1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045613, "uuid": "5280a5ff-9013-4df8-99fc-64378a1fa222", "value": 152444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045613, "uuid": "71fe2102-27b2-44cc-a2bb-3bd9cae784f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045613, "uuid": "2b94a741-7030-467a-b234-24972f4adc1a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e514e72d-1252-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772028266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028266, "uuid": "1ba3214f-d01e-4f62-a5c3-dcb4db2937db", "comment": "Malware payload (NetSupport)", "value": "47a48603a01ee364aff61878cf2338a3", "object_relation": "md5", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028266, "uuid": "bb91ee4d-3eac-4b40-924e-366c42e8f406", "comment": "Malware payload (NetSupport)", "value": "294bc3cfaaa432056fcd52f6cc69069d40dc12a2e440d8909156cf94b2cd7d1f", "object_relation": "sha256", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028266, "uuid": "c73a05cc-ba29-4972-96dd-7d3252672c48", "comment": "Malware payload (NetSupport)", "value": "5ddfe44233a4ef80f6e2c11eba889796ff8ccfe0", "object_relation": "sha1", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772028266, "uuid": "990cdf7e-ebee-48c5-a4ed-a8cfd230c924", "comment": "Malware payload (NetSupport)", "value": "b9ea819fb421d75cbaeb0c3874c10225f06662a7cdcc079f1333a5ee10a2ffbfbdf95937c6bd8500a4d656308f0be207", "object_relation": "sha3-384", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028266, "uuid": "1860e127-4be1-4504-ab8c-4ee7cb9315aa", "value": "T131A2D115A59D7062FF7596B524828A004FB3B44F63EF2090E7D0D9D9FC712B85BC3456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028266, "uuid": "8b19bdb6-9df0-4f95-aeac-9f2b3d5e9fe6", "value": "384:I2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfdzi+q:I2+x6TLKQXK1myQCSr2VS4jTXaRnPlzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772028266, "uuid": "5f9e2550-d23f-41a2-9468-4dcb838536fd", "value": 22197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772028266, "uuid": "006a8563-947f-497f-b57e-9be996bfc204", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772028266, "uuid": "bf92716f-dcfb-4bc5-975a-32dce9284e2f", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7989e-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991983, "uuid": "a42d38ce-3b93-4b40-b4ee-d552e3756240", "comment": "Malware payload (Mirai)", "value": "f161a1cd3170cf8caebd53e028cba697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991983, "uuid": "4bef4839-86ae-4ec3-a498-3c94cb16415f", "comment": "Malware payload (Mirai)", "value": "29cdf182b1294aebff587ea2f3cbf442e18b4d2de578cb0e34411a14ff1b5192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991983, "uuid": "ab4fec06-ea5f-4c66-bfcb-cd897a3c20ef", "comment": "Malware payload (Mirai)", "value": "9b3c8b7ffcfbe147e54bb8a6a5c8e64000c7e2b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991983, "uuid": "2b4d28da-bd75-4b15-989c-d0ea17d00018", "comment": "Malware payload (Mirai)", "value": "62bc74d796e20dce7fd83262618197f9e98603adab46480b957c54aa377253b1ced0f38cb6f656d01da99e3fb33d540a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991983, "uuid": "97f2880f-e298-42d1-b3ac-4ec0e0ef0de4", "value": "T131C3B53B27230E23C0D650B012A75633BD74DF8730B856D7AAE07D9D5E3A9943492AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991983, "uuid": "5a1f9a5a-0872-47d3-bb66-2e6cab41e609", "value": "1536:I+9fsTcb6Tyaw6cC9X1jgBe+wwJiGqgtIFVtHCcgscyeA:yqot9Ue+igHRscRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991983, "uuid": "4138d4e3-5018-4972-8571-92d2a3c7251d", "value": 119708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991983, "uuid": "aad49c7a-5787-429c-9671-fb96a92370ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991983, "uuid": "b9276cdc-2e1c-4ca6-8e59-be29731be724", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c718b13-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012870, "uuid": "b968b86b-7664-4491-9a9f-5e912b16a8ba", "comment": "Malware payload (Rhadamanthys)", "value": "f5ba5a5f8469badbe0322ec3ee8689c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012870, "uuid": "3b80ef51-cd14-4814-ab59-5eacc831cef1", "comment": "Malware payload (Rhadamanthys)", "value": "2a8a0f2146496874f9d382ddf49d340943ff13b5ec7518306dded9b1dc7e21bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012870, "uuid": "f30905af-fbd3-41bb-ba1d-4b9fb8b3031f", "comment": "Malware payload (Rhadamanthys)", "value": "6b27f7aead6a753da6d773742e8ac4534d19ce3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012870, "uuid": "62327f5e-ddd3-44cb-a37d-5039255dad72", "comment": "Malware payload (Rhadamanthys)", "value": "6b4db2e9503434a94779aa63bd0973f2d4a0a7fc6c1a965c2a2dbe47c829a560d02e126435bebd7cd3794907a70d8ab1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012870, "uuid": "ee7ca089-3bf7-4aa6-be1e-0ab370049697", "value": "T12CA3195B1EA26CA63892A8C00FA9E45BE44BB055DB5D74296A3FF220F8F07718D154CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012870, "uuid": "19be6981-e2fe-4d98-8e47-a6324b59f060", "value": "3072:GDB7b0Qm7Ck0qsudkWc6BDRBnud2e5xIrxdVJeshOmy5kYhND+Ls7gggjqhYegkm:0Pm7Ck0qsudkWc6BDRBnud2e5xIrxdVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012870, "uuid": "38bf791c-f521-42db-ac2b-f4a68b48afd6", "value": 100823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012870, "uuid": "50a5fde9-c87a-4079-a239-f57ccac9dce8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012870, "uuid": "c1e8ad3d-6da5-4278-808b-3d6f0423fc5d", "value": "invoice-1637482117.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b4d73e-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001078, "uuid": "34789651-7516-4b13-9629-3ee35aef9b1e", "comment": "Malware payload (Mirai)", "value": "6f170e25813351c1dd1dfa7a59d538b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001078, "uuid": "49c9a4f2-870d-4df6-b10c-96836fea2f9f", "comment": "Malware payload (Mirai)", "value": "2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001078, "uuid": "59de73a1-5254-4c93-8173-e62fa1dc94ae", "comment": "Malware payload (Mirai)", "value": "e543fb4ffe3e465990f9e9176244ca46ade74e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001078, "uuid": "34ed4a69-f14b-4732-b6ae-e9efee689a3a", "comment": "Malware payload (Mirai)", "value": "ee958f27705d44f61e15734ef6780cfcbed23b8540ef363c169f199924339269d177083acebee7c61c46e9318f19bc6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001078, "uuid": "a0343a64-72ac-4595-ad90-1c64bc638027", "value": "T1F823F2C3A6BFEDE9CDF6893D1D2B95D8BA1185193B0B0BDB01AF11E87D245C23E12950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001078, "uuid": "82943a72-d6ad-4c1b-aebd-5f0242b0dfd5", "value": "768:/CYlu1gzShvupCJk8hRIE3kpNwWa0xeKyxEy2e0bDG44:/cSzSxupEl3kpNTxe32THE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001078, "uuid": "8c1816aa-6600-4602-834c-116507640a77", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001078, "uuid": "7440c6f7-9b5b-404b-8b04-b02890995e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001078, "uuid": "c35eace5-3e48-4110-a5a1-a491d3a32e14", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ea4028-1275-11f1-a769-42010a9c0008", "comment": "Malware payload (Pony)", "timestamp": 1772043011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043011, "uuid": "e8402905-fa92-46f3-bb46-701c6d9f4118", "comment": "Malware payload (Pony)", "value": "430b7a1c0eeebd1d898c1698fe8c3089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043011, "uuid": "5a77bccf-0ebb-4268-991f-8a6600135eec", "comment": "Malware payload (Pony)", "value": "2c0a31962b535dcf0ffd10f646ccf0549b0792d3aa3bd7405a8712f097f41d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043011, "uuid": "578faaf8-c12e-4df5-9a71-33af8664169a", "comment": "Malware payload (Pony)", "value": "5dd72939d56890c89991a22393b1376aa426ddff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043011, "uuid": "c38238b9-537d-4fc7-96df-b99e73cf320f", "comment": "Malware payload (Pony)", "value": "a0273bf42d9769baef77fae55a2d2077e8ee68ea19153298d563201db7770cc1aacd1e89475fe602ee9536ea4f266a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043011, "uuid": "e6d1d4a0-2972-4b12-9f7b-31a8f4ce4ef4", "value": "T19094D08276CF5CCAEBF24D740B6A9BDE41A491E48461B09F577CE1E56A3F60293CD320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043011, "uuid": "bac0fd62-f04a-42de-8316-c944539f874b", "value": "4208def63ba62dc81f4d7e36c67633a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043011, "uuid": "50208d58-5ad8-43ea-a305-72e436ada549", "value": "6144:fO/Lg5YFDcw2PcW5v64zHpZsnqBpSXddf6KRTL:fO/Lg+oVPcUy+JZsqpSXddfNRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772043011, "uuid": "64d82544-755a-4c90-9801-0340c1b1472b", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772043011, "uuid": "81af24ff-a23d-4ee7-aee7-20846b019d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043011, "uuid": "86c1f285-b03d-4a75-b0b7-5952e96d1b8e", "value": "430B7A1C0EEEBD1D898C1698FE8C3089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4908344-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012723, "uuid": "0687c130-bee9-4261-9cb9-cee743f17a67", "comment": "Malware payload (Rhadamanthys)", "value": "aaf48b0e9717358b33541aee47a5b91c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012723, "uuid": "619f3db3-9b44-4c25-89f7-29792823e02f", "comment": "Malware payload (Rhadamanthys)", "value": "2c27216f835766c96c7a398f1a1efede67f590c52d56ec44f84d87941e3a61f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012723, "uuid": "2defaa12-f275-4458-99f0-ea915bd9565a", "comment": "Malware payload (Rhadamanthys)", "value": "fe85a0f4f351785ece3ddc28d2f66f2870e31b25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012723, "uuid": "8c39e2e1-a2d7-49fe-98b5-8570f2dd2bd9", "comment": "Malware payload (Rhadamanthys)", "value": "4da9866272342e9f0d38a3c1b946079affe60ccbe64f4bbedde74e13ea3d3d0c39efa1bd034a47fe16738fd1f6e471e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012723, "uuid": "be2c493d-b772-4005-bebe-1fd18dd9acfd", "value": "T16593F70B4DB4DEF02B8226C3FDB908791E4A96B6DCD84C2E9C57738049F47B51522ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012723, "uuid": "687d3d10-baba-4851-854b-43cf21320055", "value": "768:GDhd0i7J4sYKgY/CMNfWdNbVHzrX1ZrSvNJEkHJ4eDrHPA1Ul5ih1ySLAuAAroQD:GDB7eKg20TrDrSvDH7AaA46BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012723, "uuid": "e577b8c4-57c3-4515-8347-d40e73c44760", "value": 95487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012723, "uuid": "72e3994e-231f-41c0-91d6-f2fd8c08b9ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012723, "uuid": "b15402d7-dde8-4e78-8c5a-3a4d33a98b4b", "value": "invoice-1637482117.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e249e98-120e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998753, "uuid": "3a941af0-d152-49e3-a5ef-dd7ab4a4169e", "comment": "Malware payload", "value": "88e9acbc222b83d524dd4174367dec8b", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998753, "uuid": "af6dc4c6-aa8c-46cf-96bd-45768f020522", "comment": "Malware payload", "value": "2f459140eaf8cfae6c034f2355217ff3581833be93bfe4cd749e3bedb94cff51", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998753, "uuid": "989306ee-4569-456a-b292-5be3324bb900", "comment": "Malware payload", "value": "975c763e050d0a9a46f0aafdde66d3e7f0626c5b", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998753, "uuid": "f77d2b65-7b41-4f6c-abfb-e702aad71809", "comment": "Malware payload", "value": "8bc574a0044432727765cad4215672831399198d0a154cd19e3258bdbe8640c7ba8a831b40958a1d6ef9b751571b20ce", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998753, "uuid": "8880b7cb-1c3c-4a97-9f65-50dd5190c281", "value": "T1B555A7438D448B83E02982F8BD437DE91E273B19E9C52EFB53261E8F3E695221D8D51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998753, "uuid": "89f01304-bcc5-46b9-b6f9-e2c42992edc0", "value": "12288:VLjApcRHX6O/9PrqFvKQk1hQe1wt8myjtjajl20ERk9lQKxpAjjjjjj2jjjjjjjU:tjrd1MbIQeeORk9lQCE1UQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998753, "uuid": "69661a16-17f7-4038-bee3-6188b54e6cc5", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998753, "uuid": "2c3e27af-1cdd-4af0-aa7a-aac70cf23b88", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998753, "uuid": "7d77f1a5-d7ca-4049-8552-3ee361103a1c", "value": "2f459140eaf8cfae6c034f2355217ff3581833be93bfe4cd749e3bedb94cff51.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd98c0fa-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035931, "uuid": "17352052-4712-4daf-af29-b87e0da90f65", "comment": "Malware payload", "value": "3ef68de721e458dc8766ad6efd1c17d9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035931, "uuid": "a57cb6e6-de7f-4a6c-bd64-2938aa087e71", "comment": "Malware payload", "value": "2fa1ec3c0056cc9d6e109b05a58a1e2fcb3b17c6a17c87da5c1b81cecae62ce5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035931, "uuid": "ef839404-38c3-40b3-a096-e06d546bdb58", "comment": "Malware payload", "value": "9d87f35995a9d6228a512768970301cd217fbd9b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035931, "uuid": "72d83028-96df-427c-a9bb-472de0eeba70", "comment": "Malware payload", "value": "975ea46a2db1bcb920cd6f4bc5e9df14890526c47fd4959bfc527d094e9ab8b545311770cc3d440055bf74941856ea84", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035931, "uuid": "169ff523-e576-4dd6-aaa4-5df68ce3c30b", "value": "T12306AEBCB59C2C95579F5B37CB9AADED47762A234A8754C95014B6C20E233E3FE03806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035931, "uuid": "368e14af-d9a7-4689-bc5c-b77af9278603", "value": "24576:GiCG5MSJHsMsNfdZFXFarE4MmukEcsU/V0M+pun3IYBBYjznY7DBSlluoHrz2kF5:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035931, "uuid": "2edbd704-b11d-4e10-a0ad-736e782f44fa", "value": 3915580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035931, "uuid": "96c33aa7-c000-4a8c-83ff-2de6126a39cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035931, "uuid": "a188b1d0-2521-48f8-91e8-130c40de4072", "value": "document_530bc30bd5d21.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9caee66-121c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772005001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005001, "uuid": "5d720d14-eb51-49c4-8380-880ac3fb7a70", "comment": "Malware payload (XWorm)", "value": "d8a4b013007f5ac346013406ddd8f783", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005001, "uuid": "5b4f20d9-356a-4fff-8bde-dc6fb4bb0421", "comment": "Malware payload (XWorm)", "value": "2fd18d94e14f0d6f387f32eee284d5896fe345f690b32cd754f0439d4f16aaed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005001, "uuid": "e197e025-bf1e-4c68-a20d-04d3ee82b394", "comment": "Malware payload (XWorm)", "value": "cb90a9742b0c3616fe525b094f772c50a50abd2e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005001, "uuid": "09dc441d-3ba4-40a1-992c-0abf7981b93e", "comment": "Malware payload (XWorm)", "value": "3a1060abed99c9b29837601a932c56086551602b2e997b2ef937865a9bef287847242322741f261430f86fbf37746751", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005001, "uuid": "3d9267f5-3436-4a2f-93db-b724832858d4", "value": "T1F693F1515D8CAF74DBB5990C81EF28C19BEC1F0B10526A8BAB33DE866F7B24851D31E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005001, "uuid": "c106a85b-bdc3-49d2-bd14-b99598a20605", "value": "1536:efsZRPZRxW9n7H1uxeTOVlY+XaOq4wkSceGOLFe7aJqBtAWZ70i2BT4KB+GY6/T+:efs/PtcH1WeTOJqTXcOkN337v2l4Mhhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772005001, "uuid": "8f0c351c-db48-41f3-9d9b-ace3c3fd88b9", "value": 95086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772005001, "uuid": "bcd7010a-d0ab-468a-af69-045ea762b464", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005001, "uuid": "eba61525-d511-419c-9b25-a39736514b22", "value": "FGH09876546789.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4023a06c-1235-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015534, "uuid": "36e8c5d9-69d3-444a-8c00-48787d9640ca", "comment": "Malware payload", "value": "4c68a4b90adfe24f07c01ffda1290433", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015534, "uuid": "e2c22bc5-3f36-442f-b22c-efe13b073178", "comment": "Malware payload", "value": "30a0eee35165ca7c52b9e05709fc004a6af6e328778f2aab4c8d6f9079a383d1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015534, "uuid": "e0603f61-7e26-436a-af73-24faac01ebdc", "comment": "Malware payload", "value": "8fc97de89b5cf0f332f0a4589db8368894182a26", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015534, "uuid": "bb24fe65-22c3-4e23-afd5-e1f082556a97", "comment": "Malware payload", "value": "233d1a50a6150509cb04c5d6ee6285350dd84487de6ad29e4d2027511483d2492a4de6a8cceb9dbd3cf575ac26eb4521", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015534, "uuid": "8f430ea9-2ceb-457a-a101-daf024a819aa", "value": "T199D0A77F025156C5CAB0D764459A1253A8B9906F41887E550CB60510BD705722F885F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015534, "uuid": "a582644b-db32-4327-b68a-f105fa6825e8", "value": "6:duGi0vgdTxDOrZzMA4V0xsaAUfwDOrPrrUAdMhJEvn:d1vgLOJfi+NbcODrr0h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015534, "uuid": "47ceb9fa-6580-48e8-826b-a63095f0e1df", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015534, "uuid": "d8981e80-545c-4759-b152-0c005d688b13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015534, "uuid": "e611fece-a323-499d-90b7-c4b9e713dfd3", "value": "stealth_bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a95020c-1285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049857, "uuid": "6d125847-b62d-4103-acff-38b029678c18", "comment": "Malware payload (Mirai)", "value": "4bcb1ec62133cc62544d871fbeb3f311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049857, "uuid": "06d7773a-ad4c-4eef-93a6-304b39b2ba07", "comment": "Malware payload (Mirai)", "value": "30c0498fd35cef1aff07d42d50219be22124dcf39eee05fa603f8cd1cdf6ed0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049857, "uuid": "d3d90b1a-7b67-4d3d-8a37-3f27b8d4028f", "comment": "Malware payload (Mirai)", "value": "af16c3596bc80d6f316692e2da40a848eaa71f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049857, "uuid": "e916ab60-a1a3-4a29-a74c-2cfe43264aab", "comment": "Malware payload (Mirai)", "value": "7fd062cb7de8f996682ce218d544800128a2686cc83048edac06fe1f162195a4c5c1becef7dc6a367408bd8c513e71dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049857, "uuid": "692244e7-ee6b-440b-9c6b-9eb2c4f387f0", "value": "T1E9E32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049857, "uuid": "b2b8e3de-3fe3-47c6-80bc-6306117f15cd", "value": "3072:CJLce3pC5mO7/abHbz4NpaIJ8VIJ1FMUXkkTM/9cHMY:CJLceS/abHbz4NUIJxHMUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049857, "uuid": "db6ceedc-5444-461d-b09a-7b43421222d9", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049857, "uuid": "07ad16ed-6d3c-4afa-a259-5fd5dc9c1f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049857, "uuid": "b7fa319f-5af2-44e2-9b6c-939a906ac438", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b186ad2-123a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772017727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017727, "uuid": "a1f6778e-0b4c-41bf-96ff-10aa2001144c", "comment": "Malware payload", "value": "7a183bd25d190662c3008c794f6cb604", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017727, "uuid": "5d944c02-5ff5-4457-8cc6-d29ecffddc36", "comment": "Malware payload", "value": "30c71d644bc72e0d55d46bed753ab3f72dc77b7f1be0e34693c957939a779507", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017727, "uuid": "bf1db1de-9a88-47a8-b334-2ecdf7e7d90f", "comment": "Malware payload", "value": "39f6799543e18d9ebc68099e62a30f2e67913034", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017727, "uuid": "82b4a757-988a-4575-a0ed-b4c06235863c", "comment": "Malware payload", "value": "85a7f0f755522b2ee6d36c5fbdd73bfb2194125e7bb5152b5f45eb5b51bd3ccaf04cdab06645878e2cbb1fa9623633ee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017727, "uuid": "bd5cd339-0757-46e3-b570-6c936c830613", "value": "T1BF659FE068694CBDFEE0597CE6CD1A1D16662C820B9A28CF37DC3F5466323A3695F503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017727, "uuid": "6130563b-7084-4f92-ab97-c555bba4b6e0", "value": "24576:AsM4R5bgNI11wtFz+vWwMDt8KIgTpCkt6G02mvV:lnpjQDtsCt6x2md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017727, "uuid": "929c4812-a12d-4814-90f8-1cf642e062c3", "value": 1454366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017727, "uuid": "df918b1a-0bd9-4214-8182-8363ccaa9159", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017727, "uuid": "e58ccd82-4d6e-42f5-b60d-cda6ae548961", "value": "BRICS Report.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a222c05c-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013121, "uuid": "23e13ca5-3f0c-4e06-9b1f-d7348b629c10", "comment": "Malware payload (Rhadamanthys)", "value": "4d247f40b0651b06cc96f9317c9cea69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013121, "uuid": "7618235c-13c0-4cfc-b3bd-787e4c2ad34f", "comment": "Malware payload (Rhadamanthys)", "value": "31030324a813c318daf7b73cbbb2797942249198baf0f08cd5f96ccd8f551e07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013121, "uuid": "1076af85-35b7-4982-9f6b-5037b571795b", "comment": "Malware payload (Rhadamanthys)", "value": "088a6556b34299df5a33545e27ce79992617a11c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013121, "uuid": "4c9c6c32-8f55-4e9b-ada9-7d2313da8859", "comment": "Malware payload (Rhadamanthys)", "value": "9a3367d0e2198fd4455c165255da1afc32e8012a70bb5314170845258dea949c484868087bdebc2871be5563ba68aad2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013121, "uuid": "54481900-844b-4aa2-9401-57d059c9b825", "value": "T14C931BE42B91BE74A1467CD078809EF89EA87D27CC10E631D4166B71473ABB61D873E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013121, "uuid": "5c78ed20-8615-4931-a7e9-21701acddd0b", "value": "1536:GDB7eKg20TSoCrLrr3575sMiyQAxNiIPZ6BkQWJ+aY:GDB7b0W3rwOPZ6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013121, "uuid": "25207340-2f56-4cd5-95f2-14bfa4c376ba", "value": 97514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013121, "uuid": "eed73dfb-b324-47ec-8486-9b14e500e127", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013121, "uuid": "cddd3109-74d4-4b03-affb-c7c766d1cd72", "value": "invoice-1637482117.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f90b001-121a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772004098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004098, "uuid": "c9238670-0a99-4b78-9d61-91a5cf0fe65a", "comment": "Malware payload (Mirai)", "value": "05aa1be27f6ba1a86fbcbc783285eb88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004098, "uuid": "72e60a09-af99-4fc2-ac4d-94e8a619923d", "comment": "Malware payload (Mirai)", "value": "3139b0d6e77ad728a21219e1297a54f8eedc5771eeb1a5a6796e13f2b0960117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004098, "uuid": "75d27fc4-e33a-486f-9b7e-3b0018fbd2cd", "comment": "Malware payload (Mirai)", "value": "ce1f6af935cadc3088d65d297d4ec074830ec2ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004098, "uuid": "94b574d5-9c83-435f-9d6c-5f2d19a038fe", "comment": "Malware payload (Mirai)", "value": "b72c5461d837e1574b0403094f561192cebff03f96cba58b52f9f10c0301049a31a72d8b935090cc5109cac774ddff03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004098, "uuid": "dde4c325-a80a-4974-85b6-2c57b11db0cc", "value": "T16AF3F845BC519B13C6C626BBFB4E428D772A1758E3EE3203DD256F24379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004098, "uuid": "7ec50118-b075-4129-b62c-d99eca0eaa03", "value": "3072:I53vPopIPlzl3D0Lxprxi0VvbvbA9VzxK4ZTW18Why19d+xEd/:4fPopIPlzlzEDg0VvbvbA9VNK4Za18WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772004098, "uuid": "56b178c4-6972-491b-abfc-0d22e2deb676", "value": 170392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772004098, "uuid": "a6bb9bea-ccbf-4d53-8be1-3e0f626565d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004098, "uuid": "8dab26fa-b700-49e2-8677-c22f7d8ca6a1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff16a57d-1296-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772057515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772057515, "uuid": "931d2c7e-05fd-4e3e-903d-300245ec2b3e", "comment": "Malware payload", "value": "bba2570a642bb08881e8a9c44744c621", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772057515, "uuid": "9b444764-e549-4c5b-82aa-9d32b84cce54", "comment": "Malware payload", "value": "319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772057515, "uuid": "591fc6bc-d86f-4609-95a1-ecdfa85fc314", "comment": "Malware payload", "value": "481c3aa22cb5a7c42a8162bcf44263402e80e094", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772057515, "uuid": "6ed3d464-9541-4698-854b-1d3eb84dd6d6", "comment": "Malware payload", "value": "572423ff3a3d3cef68531b7a0807b12a50ded132fb670570bac589e5ad45d5edc6c1b27fde723e5432303d0526c6d048", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772057515, "uuid": "2794a957-3ba6-40d0-b784-9dc034c2d1e1", "value": "T1DE269E07ECA108F9C0AAA37189B296577B75BC481B3263DB2E60B6782F737D05D79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772057515, "uuid": "9026385d-b258-42b1-a5a5-2a4fc63e2b55", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772057515, "uuid": "6e7d6479-b1f3-4101-8e13-641a93afbd91", "value": "49152:zvBpREoKui1aUorEZYz3h1h5XEVWWAf4HKa5q4qhrSivfXwUIL85eFGTK6URIg0Z:zv/yjHkd/YtqhrSqfYL8EfD0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772057515, "uuid": "e4e964d2-d26e-4586-b1ec-b59752d6ae1c", "value": 4680704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772057515, "uuid": "b2836ab9-f75e-484c-97c7-5c0f3ecb863f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772057515, "uuid": "156d6da6-a545-47d6-bcee-61c4881c8aa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09839c23-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051520, "uuid": "b049364f-b871-44a2-b0be-b562d33700e8", "comment": "Malware payload (Kaiji)", "value": "5f205da58520396de86631d28f29ea87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051520, "uuid": "ef1724fc-0575-4e4e-9763-bcfd28ddb692", "comment": "Malware payload (Kaiji)", "value": "31d4ef6aaca605c0cbe19fe0ca4e70151e232e5f61d963cdd0033d67785165fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051520, "uuid": "8e6c34f1-630f-4917-a1c4-04692a4508be", "comment": "Malware payload (Kaiji)", "value": "04b27c55de7dbe67f3d0e999317c07305bb2ea09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051520, "uuid": "4314940e-69d8-4c17-8e8f-126c3ba8d6ec", "comment": "Malware payload (Kaiji)", "value": "e8dbd7b80e89d2e9204eeef6fcd2bc1d5e9309c1bce310605c9e1fc01a7fbdc7b7d27067eed1b93d5d917f461bc688b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051520, "uuid": "6e6de3ad-96e7-4445-89fd-20a9ac1c4716", "value": "T174363942B7086FA9CA60493385B38ED117727D996F315343AB14FABEA8B63054F15FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051520, "uuid": "c8401276-3927-48e8-9344-867534a7c72e", "value": "49152:i2LzgioAq4P670Og/d6I+eFRgjpmbLQYLy280ntKyB1:nLzgioh4P670Og/d6I+wgjpaLyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051520, "uuid": "dde597e2-c8ec-4355-8a1f-41c30862059c", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051520, "uuid": "51b72db5-ffb0-4911-aeb9-7eaad0182f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051520, "uuid": "866cb426-9dd9-467a-a980-bad91ef71747", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a80220-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051559, "uuid": "a3e80e1b-068c-46a7-9853-bc4f3734c663", "comment": "Malware payload (Kaiji)", "value": "41eaf1e8b9fb784e9b97e6b184c13505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051559, "uuid": "f178b12c-c169-423f-ac32-083802156fb7", "comment": "Malware payload (Kaiji)", "value": "31dd81d0c95c4c15bb38863bcfbfb385171ec3510f192aad389ab7e4aa1748ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051559, "uuid": "dc202664-8f39-43d1-8510-5bea6893e3f7", "comment": "Malware payload (Kaiji)", "value": "c1cecbbae8f883fb4eb5bfcf80b39ac6f46a9244", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051559, "uuid": "000eb2b9-bbb8-441b-a8c5-706c715c9918", "comment": "Malware payload (Kaiji)", "value": "5a33bdb62b88455a9f5b289a6e785974111e66f6ec991432d7bf2df6ca82b84e1faab4874ec618011588f84ce4854027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051559, "uuid": "b95f7f0c-85c9-420c-ab9b-cbdbb97ebe7b", "value": "T1D4365C80BB0CD139EA5B0A724C738F2063617E46C1E4866B771AF76F05B16E65A0FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051559, "uuid": "2e5abbc8-5883-49da-ae94-2dcc56b4cb32", "value": "49152:UbfIMWeDTyKn8Nrwtt56e3JLxKYzYR2iLHwOng/KosjiwoNG5bfkf325NV:MgMWeDTyK86t53txKSi21S7/kf327", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051559, "uuid": "f110d6ac-760f-4936-bc71-67a227a1aad4", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051559, "uuid": "8ee418ac-65b9-477a-a578-a8207334cfa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051559, "uuid": "3fe7ab2a-5653-4842-9aa7-cae1929a23e4", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514a86d6-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003107, "uuid": "559d9026-a7aa-463c-a29f-8a57e412dc92", "comment": "Malware payload (Mirai)", "value": "1baabe6fa9c10bb5bc9c81af87327748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003107, "uuid": "b481db8d-2fea-4985-b186-c16718fffd07", "comment": "Malware payload (Mirai)", "value": "329697799d8c260732f02a2d036bb17e429ad681c30702597bf64181348d6d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003107, "uuid": "484281fb-d4e4-4120-904b-6edc1f9282e4", "comment": "Malware payload (Mirai)", "value": "b41623f78a7cd4ab6f2d1c5388e7305ebbd72330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003107, "uuid": "84ea916d-f5f6-4648-b2d5-4f734b455523", "comment": "Malware payload (Mirai)", "value": "4c93cf795d3443c39d6576cbe37e870499d67ea31a9c86eb2bcf5487cb514451c896fbb6740ab3ffbc3c4ac04a350b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003107, "uuid": "553311de-814f-42fd-a74a-fd1d72b3b889", "value": "T1C1636CC6EA43D0F1FC6206752177E7360A73E5392069DA87C774E932EC53641AA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003107, "uuid": "8f63d756-a611-4b91-93ea-e41adb4041d7", "value": "1536:DrpARyzrfyjsIEfp+q0dZyYYPubr83cpTUjE4GgDoXE/z+Q:3piyffyYIip+qE/r83yUw9gM0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003107, "uuid": "67676869-e55b-4a52-910f-dc6fdfa832b8", "value": 70832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003107, "uuid": "8d3bdfba-3c08-4cb5-9634-f7a09759d32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003107, "uuid": "29e8e3e7-3e92-4d1b-9143-e4340354a2f5", "value": "ez_nigger.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770212cd-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771992004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992004, "uuid": "d82eddf0-309b-4d61-99c8-1a41324a36e5", "comment": "Malware payload (Mirai)", "value": "9fb63eb0687cdda1d0849515c7370daa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992004, "uuid": "daeab539-3499-4c0c-8434-99e02b0e4a47", "comment": "Malware payload (Mirai)", "value": "331b245f671a6d020f5736aa59976a981de3233f12954fef41ab16841c0e5eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992004, "uuid": "3b75f38f-df09-4684-bc6b-98370d8255bf", "comment": "Malware payload (Mirai)", "value": "f16bcf33495ccb35c39cb8b67ba7d168b5debdc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992004, "uuid": "bee587f6-9ada-4dfc-a331-b45977845e41", "comment": "Malware payload (Mirai)", "value": "959105f0402b908b90db083a99fccf674ab1fce66ccb330dd59086297633367203d3a339f93eedd1260185c3d2003ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992004, "uuid": "32ee433a-bf4a-4dbe-abc3-e65116019e15", "value": "T155B31A34E4504B1AC2D322FAE659815F3E231FEBA3EA30258B34BFA057F26D71575924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992004, "uuid": "498e453c-533b-4ab2-b572-450552eeafb0", "value": "1536:QMnmu0qJkU5gqLlIuaufJCIzdhiC/VV3NfHRuO5JB72xW9YLqMq:241HOuaGVV3NfHUOjqylMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771992004, "uuid": "d74a4643-9f7e-44db-89e1-e9cf7c163594", "value": 107488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771992004, "uuid": "e5e53a4b-8bf2-4425-b330-e082324ce2d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992004, "uuid": "636920a6-0952-4ba6-b032-9d0a6f403c54", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86762593-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001049, "uuid": "7335d9b5-7538-4ffa-8582-d45ed7014e23", "comment": "Malware payload (Mirai)", "value": "da9522f17cc35dfcf31f5d836536019f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001049, "uuid": "f8647eda-7057-42d6-8862-cb4bb45c3f05", "comment": "Malware payload (Mirai)", "value": "333cb5f771c828d85004e9842dbd1c01edd7b7295e2d0c1fb8d32b112a2be9e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001049, "uuid": "573aa692-9a47-42d7-afbc-3f57f3c099ea", "comment": "Malware payload (Mirai)", "value": "6579f2286af2e7748b3462e0e44680535719a26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001049, "uuid": "ed989467-0e9d-4043-b734-141f7bccc551", "comment": "Malware payload (Mirai)", "value": "bb05141b468a97106c7894c471165e62cc5ad0bb58a995a28be07ffb5b653debde4220f773f5cf9c178b815a1b82ab09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001049, "uuid": "0994843f-dda9-40ec-b295-e9e49dfb54e4", "value": "T136E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001049, "uuid": "08515f21-726b-4d6e-a778-8076405c2d74", "value": "3072:6xjJw1Cc/0s6YAPwenUr48pzfR+JonMy:6xlw1xAop0YfRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001049, "uuid": "7f792fdc-6c38-4494-9f63-430a96949764", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001049, "uuid": "e55b21e8-e6b3-4baf-94c0-88cf82ef3c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001049, "uuid": "2845422a-5b39-45a4-a905-0cae1befb15c", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a190c428-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017415, "uuid": "55a0a1ab-deeb-4a79-8deb-3a16f1178c24", "comment": "Malware payload (Mirai)", "value": "216cf6b202f0cd7cf8fd0984455b4386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017415, "uuid": "09119625-806d-47fe-930c-ee39e12dde5f", "comment": "Malware payload (Mirai)", "value": "33704c6f682a5399f3a763bbef351afae4f64759a4d9eab086e3530fc4e13023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017415, "uuid": "b92342d5-eea8-42ac-9f47-dfdc9290e41e", "comment": "Malware payload (Mirai)", "value": "d9595480fd7ef9178d74bc33910a356028051ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017415, "uuid": "ff986fdc-33c7-46fe-b15e-f1eaab3fffaf", "comment": "Malware payload (Mirai)", "value": "1a5ecbfdb0d81d62d7616abca792dea39d3ffea3456a9510ea0e035e6f29b98ba714f1dce40105b7ccf06fb11e13ca02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017415, "uuid": "b8bd789a-87e9-4545-99d5-552a661342b8", "value": "T1EDA2E0217F1DE98FCC37B23887E5E5C692D17D24C29C86866781C11BBAB36C46824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017415, "uuid": "8e7da542-40ee-4674-9e33-0947257541e7", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRt3vSyD:798o08kxofBE+ZkXaT47C2Epit1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017415, "uuid": "ba97f9d0-8fc8-4ed5-b351-423b57474fa9", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017415, "uuid": "9eb7045b-b4e7-4a15-aa91-9250521c15f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017415, "uuid": "f43c21f8-5440-442b-bebc-6936a0a4c35c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa1901a-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017404, "uuid": "160b63f6-1c73-419e-8233-3f36b7b0e80f", "comment": "Malware payload (Mirai)", "value": "32a60dc7f923c35c338ede6d1e261208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017404, "uuid": "dfbf8a06-8889-42a6-8c86-3ac498ff90b8", "comment": "Malware payload (Mirai)", "value": "3762a6a3b989850716155a080bf907ddde31d00903cf192dbd01fe3584bc3b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017404, "uuid": "f07bec5b-46c6-4110-9f0e-cdc2448463cd", "comment": "Malware payload (Mirai)", "value": "1d3a7c0d2d185704f2117f0f33ac8b272191de0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017404, "uuid": "45b6520b-e587-4a45-8176-855a747a34de", "comment": "Malware payload (Mirai)", "value": "bcd5e948a8fcffa016c608b008195fb7a8bd9161998734983feac8178b3c7c8426c393fe5233da77bccc40041c4af669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017404, "uuid": "66544fce-6276-4d31-bda9-a4d1a0d23c0c", "value": "T1F7B39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017404, "uuid": "d298517d-5946-4d8f-b2e0-03bd07f786b9", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1l/LWy:c9sSyzz36YaWWgg1lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017404, "uuid": "d3cf532a-f2e3-46b7-b8f1-651d9af4a938", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017404, "uuid": "b648d11a-e731-41a0-b87b-c2e17553ce6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017404, "uuid": "61b7c628-5a79-4466-809a-485bca65adfd", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025af9c3-122f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012853, "uuid": "fe098f90-0a39-4421-976c-eeba101bc5eb", "comment": "Malware payload", "value": "967af459f8ea6c8c2336d3b644bde68b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012853, "uuid": "369b4126-7655-4081-a9b5-1d546b8b3703", "comment": "Malware payload", "value": "37658f6c5ad657c21d8f08d4d3cdf8ff02e7f088277bfb5598518950d11302f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012853, "uuid": "399f9c9b-17c9-46dd-b297-c484a9a8771c", "comment": "Malware payload", "value": "ef3cbe110b5f0eac0c01e70341c485b991c011e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012853, "uuid": "0472ecaa-2c2a-40cb-8f2b-863b78056dc9", "comment": "Malware payload", "value": "5069ea2e15d9471c0f4ce44afa17cadd143b90dd7a03b4ab845805bd885f9251548aec1a83c9d13adfc323fb5e4e163f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012853, "uuid": "0c96b54c-44cb-4371-872e-108407af34af", "value": "T1F0A3FA109AB2DBBC081F16AF7EC643E9891E6F111656B525931EF64CC4BFB603970AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012853, "uuid": "cfa593ff-57bd-486f-9cb8-af056f981cfa", "value": "1536:GDB7eKg209yKzEOlX3VWIkkcnTQpULbjoP4oE3BU7RUkkZ26Mk6Gd/vSjVCY2rLx:GDB7b0AvJfLHbRoJ2J5SLc86BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012853, "uuid": "38f7e7ce-0a43-4160-a98d-933d43571a74", "value": 98159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012853, "uuid": "ab0998e3-4242-432e-be8f-e44170133d36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012853, "uuid": "d8c1e559-b72c-4c02-9b58-86f0485cfaa3", "value": "invoice-1637482117.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d922c6ad-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012784, "uuid": "3232d166-6a50-4b8b-8c82-9b3b935393e7", "comment": "Malware payload", "value": "9429f00fc5bc574b448649cab58ee34d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012784, "uuid": "45e1d513-0d2e-42e4-ad42-030a852b1127", "comment": "Malware payload", "value": "387a0adbb3c5949028cb76d9179357b422ece6a53844b0780e6f4055795187e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012784, "uuid": "32bc1dbb-58f1-4ac7-84f3-65276e6cf5b4", "comment": "Malware payload", "value": "5418315cc7167cdd4614c269e39d7bfec1867d91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012784, "uuid": "99b93aca-a531-4ba4-8cc0-984b0b5c0d96", "comment": "Malware payload", "value": "8336e267c4806dfd385b335b16d3b988430fa3cea778841c9f0d2285bf0f3f6e9633d01afe8de9116ad05763b38c4d2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012784, "uuid": "50953f69-fe6c-4f09-8b6a-e4f4878d82f4", "value": "T194A32B3CDEEFBEA6A9C755065CE602FC958D6C5B6F09F9108442FE02235B30424DA7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012784, "uuid": "6d81c1ae-08c9-4591-9140-4a0fedde1118", "value": "3072:GDB7b0Myt7aW4DDyzJ5j5XcG6FE11RUyGKlADpcO/A8/bjNQSrGm7PAl0oYy41Dw:0zbW++ooWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012784, "uuid": "7a5c2c05-2151-4a90-a8d0-12763ddc0bd4", "value": 100126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012784, "uuid": "2709a92f-508a-4bf2-98b7-df8a1b5e215b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012784, "uuid": "58a2fcbe-4aa6-49bc-8b43-b7111307366a", "value": "invoice-1637482117.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3ad710-11de-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771978109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771978109, "uuid": "da410184-2e0c-4ddb-a391-da661f4b90da", "comment": "Malware payload (CoinMiner)", "value": "55c65f788ec7a073942b81d8c987c386", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771978109, "uuid": "73acf0a2-261a-41f7-9a7a-f8b18132943d", "comment": "Malware payload (CoinMiner)", "value": "389d3fefcaa011c88e9c9b613b9f546e7fac0a5c0878d757045e2bfb0ca71f9d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771978109, "uuid": "00e4ea83-d2db-4422-8253-daad0893ec2e", "comment": "Malware payload (CoinMiner)", "value": "567f8e2d213b65ec7ec1b82a86cece32a70b1265", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771978109, "uuid": "422bb855-e3e8-4bd5-a9fd-2daec664c772", "comment": "Malware payload (CoinMiner)", "value": "f2b8cc21908956edc778d7e19a1192f86a10c646e304281ecbc2dbed661754a6a3bca2ae7522aacc46126a72bd6ae759", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771978109, "uuid": "74206bf9-29ce-408d-bce1-ba6041e26c06", "value": "T1DEA6CF15A3B40071FA3BC674C9268733DAB1BC965B34C50F0259F2522F77EA29BAF215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771978109, "uuid": "bbcacf68-406e-4def-a364-613fdd99714d", "value": "de93f2c3ac12b121f15db149d1837f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771978109, "uuid": "2ff23d49-cfb3-4fc2-ade6-cfc1ad514f6d", "value": "196608:adWM0vfBJa0uzWDrdCB9IGruIoNJKlG1OoBjS:adofBo02WvMPVrxoHKwEum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771978109, "uuid": "0db660f9-a2e6-4eb3-9d55-148c197260b4", "value": 10261386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771978109, "uuid": "bad99270-07eb-4698-ba50-a4e7ba663395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771978109, "uuid": "58b2b27d-74bb-4f84-b986-e6d744d377b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9417b3-1224-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772008252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008252, "uuid": "413fbe24-e032-4a25-9a77-896c7b2637cf", "comment": "Malware payload (STRRAT)", "value": "a441bee1407c6ecbe20e3b30e19a65b2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008252, "uuid": "7d26d116-16e6-41be-b6b3-22ccbc6029cd", "comment": "Malware payload (STRRAT)", "value": "38ea8738c8db55fd66acea43923f8892aaa7b637af607a7f96c94aead6a87fab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008252, "uuid": "b552b26c-9261-4cd3-8811-fa1a11e766ff", "comment": "Malware payload (STRRAT)", "value": "79bd8379703c08f3a7a3ab58a320c64a41c9cfd4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008252, "uuid": "b9f51cf5-ca2d-4d7d-823c-42e5ff41f330", "comment": "Malware payload (STRRAT)", "value": "425f9949f74285bd08231fdce2eb5367039384be8d4ce6164507de02883391b75e31b7d34fb11d26218ce49736486f3d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008252, "uuid": "a2b9c53f-eab7-4c7b-8ba6-6bfe48f83078", "value": "T160A329547B40F072EB63B073095C934AAB70E8EFD25461E72EF0ACADDCE98421F56685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008252, "uuid": "92cd7891-2983-48ae-9f4d-000cb783b686", "value": "1536:IBTy3AI8QFznj7FRSeH7OZJJsKvGzQWXqWUo1hn/:IlhIfBVcI7uJCQ2/v1hn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772008252, "uuid": "ad14867d-2098-4828-98bf-60f05964b365", "value": 98442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772008252, "uuid": "6f80c3a8-ff68-475a-805d-b432bf76e969", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008252, "uuid": "fa6ad643-63e8-4430-a6a5-ef13d14769ab", "value": "Teklif-Formu.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0526a96-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034620, "uuid": "5d89a434-2abf-41b9-9e74-598c99c34628", "comment": "Malware payload (Mirai)", "value": "de387a90044ccf4cb9850493f9834aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034620, "uuid": "94b1a2c5-b8aa-489e-ac67-9fd2637ca0c7", "comment": "Malware payload (Mirai)", "value": "392f7308571f57b19099c03353c02bd41a57a00a1345fa7b1e98b4c794052e00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034620, "uuid": "aa0f395e-d3d2-4bb1-a14d-6f0b896404b5", "comment": "Malware payload (Mirai)", "value": "21b9e6083627ee73f5b4f415e76e88fa12d92247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034620, "uuid": "730458c8-8c0a-40a1-9578-b5819134d9ad", "comment": "Malware payload (Mirai)", "value": "9079a13449841a7e68129ea1a0295b7539afc655a80c48343478ed71377ffc4aef74e23785fa48cbec22d75365f5801d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034620, "uuid": "64c9c64c-3fc2-49ff-8778-ad24e501fdb2", "value": "T1F6330907F681C0FDC49AC174476BBA3AD93771ED0238F2A67BE4EA223D95E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034620, "uuid": "d4fe69b0-e37d-4ebb-b647-f9f7bd967f26", "value": "1536:Ru31CxXVpHlCrxsNnVfvj56+H62r4DaEXzd0OCUjCYb:Y1sXV5lCKNVfvj51a0GaEDOVUjCYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034620, "uuid": "1f8e8027-516c-4aa9-acf0-91ffd9086127", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034620, "uuid": "746c37fd-9044-4ea2-a5cd-6228931d6bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034620, "uuid": "2cb8a724-bc39-4a3a-bf42-a9d6f031d2c1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54ae884-1211-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostFetch)", "timestamp": 1772000295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000295, "uuid": "f85e9754-6105-4e9b-b3ff-4a832b1ecc5e", "comment": "Malware payload (GhostFetch)", "value": "6293f165dcff36c8556f8795327c5004", "object_relation": "md5", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000295, "uuid": "55bd8c90-3309-43b6-8f4e-f74b09527def", "comment": "Malware payload (GhostFetch)", "value": "3a19c19d9f3bac6628a968110477ee01e5867b2534e914e1be5c4485947bd819", "object_relation": "sha256", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000295, "uuid": "d8dcf4fc-edfc-4b2d-be01-5b7e49c05920", "comment": "Malware payload (GhostFetch)", "value": "ac982b7b46e085e0bb51cba2edb61bff5910b6a8", "object_relation": "sha1", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000295, "uuid": "24c74c4f-c157-4111-8c8e-a547bfc0a84d", "comment": "Malware payload (GhostFetch)", "value": "f48067abf7f0bf51a37c0a95067cf290e8e928c6e30aba8585279ead94b27b3921dd6923f43d4d8786bfb231e7c8ed31", "object_relation": "sha3-384", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000295, "uuid": "25834e03-6a7c-43b3-8373-6d5efe72b8a4", "value": "T182045C5872AA00ECF53369B9C1534B42E5777C616B21AEDB033083759F13AF5AE3A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000295, "uuid": "6ca6317f-01fb-48d7-b202-106e2288a315", "value": "6d9148e6fe8f4b0c2d3be076d75bbd03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000295, "uuid": "5832935c-2b52-4930-bfe3-6c93544e7752", "value": "3072:6G59d2jYVa/UH3zYlsuG2uow1DxwUczRwt3QIsybbxZZT:H59d2jKa/oWs4QDxwlKTJZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772000295, "uuid": "cb932833-15f9-42c3-aff9-ef6e335ad2be", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772000295, "uuid": "5945976d-7562-4955-8bdd-bb08ae3cf8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000295, "uuid": "a2fd5bd8-ac66-4137-8550-601125d5259f", "value": "3a19c19d9f3bac6628a968110477ee01e5867b2534e914e1be5c4485947bd819.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c33da1b-124f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772026775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026775, "uuid": "dd19d487-3a65-4944-92d0-6f46ce92568f", "comment": "Malware payload", "value": "43a6581c65f16effb5d2a82f58786c61", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026775, "uuid": "3270a5a9-f398-4c9c-b83d-cba0b3ec99a9", "comment": "Malware payload", "value": "3cfa7942b9863652c7ab42d0c389e1e6ae3ec51b70d3145bf05b34564da8f101", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026775, "uuid": "e267878c-53c1-4a14-8bc5-badae88214ff", "comment": "Malware payload", "value": "05f9e23932c3f9d8d945df890ab5b92706847f21", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026775, "uuid": "dc1768f5-f4ed-48a4-aefe-ae6217480f47", "comment": "Malware payload", "value": "3f57aa9e06e6e25ceb9d679ae1a6f7960b19c4cc44cafdbfb481adc1f3a3f2bbee75b0863f03b34afc8b12155d7dd44b", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026775, "uuid": "97d341bb-9dc5-4c6f-9245-c7ec1970fa78", "value": "T13FE4236A6CA63432E9D4E8323DECC485D3AB05F50843AEEE5C6D09BF1D62B884735DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026775, "uuid": "ef1f3190-53e8-4669-b64d-cf941685b4fd", "value": "12288:HRaFd647Fppywd/Fkhuy1L1uYtHhVqUe6aCqPOP+MbnuS:YVH8wj734hzJl2Mbnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026775, "uuid": "88f95eef-36d1-48c1-85ba-16cb9f8c2c2e", "value": 677488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026775, "uuid": "eee19f1b-159c-4d7e-a08e-c8bd1d8e2def", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026775, "uuid": "5ffc99c2-4ac3-4575-a9ee-4b54d9378486", "value": "kfokdmfpdnokpmpbjhjbcabgligoelgp-2.25.0.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcfad5c-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991988, "uuid": "1b88d2f5-4b8a-43a9-990d-fb1860b2f307", "comment": "Malware payload (Mirai)", "value": "9b8baaa2ba831150f0326e6cb4e0f5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991988, "uuid": "ff5d9612-bb2e-49b0-bc86-5ca6fdbe38e0", "comment": "Malware payload (Mirai)", "value": "3f5b4c2288aa0b0761ffdc49b5272eb26e0e1d65383c851d828e57172126f026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991988, "uuid": "a9c59df4-5b2d-43ea-a3cc-c802e1dc9887", "comment": "Malware payload (Mirai)", "value": "bc0ac95e36a9264698a91778cd957010bd3bcef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991988, "uuid": "f9d6753f-8599-4995-b44e-ce0924b2e393", "comment": "Malware payload (Mirai)", "value": "a313e378d65c66232ab9bacec505e28228476a7f15b56f14ee26c5b8bb792762f432ccd7fa6789ab72dfa3bd01276733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991988, "uuid": "ff114f4b-b3fa-4984-bbba-7db3734cf55a", "value": "T172D31937D16584BAC08712F116EFC632AD63BCFB073121572394BEA05F3289ADE99746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991988, "uuid": "2bb89104-afb2-4cf3-bbd2-2fd39dfbdcdd", "value": "3072:IObua3kWiWwqgU+MdZKtXO8TmqFY+ickmr1zwT2WNn:zk85dmnWfckmr1zwT2WNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991988, "uuid": "00ef001a-69b1-4cfd-b753-131c51a34fe4", "value": 136901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991988, "uuid": "8c642478-1393-42f0-a76f-c536dc691330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991988, "uuid": "ea85e92d-543b-4a09-ab97-cad2bbe3f469", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d29ba25-1209-11f1-a769-42010a9c0008", "comment": "Malware payload (MuddyWater)", "timestamp": 1771996551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996551, "uuid": "d3a4032c-450e-4b76-a538-b743ab3866a4", "comment": "Malware payload (MuddyWater)", "value": "bb3587d3da3fbe4ab8c36721d9435327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996551, "uuid": "1154a02c-c94f-4bc7-9df9-0c1d5a508230", "comment": "Malware payload (MuddyWater)", "value": "3fa148e2d3fb86cecc15c276c5329496beba9aba14a6024b561efabf2e4e68af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996551, "uuid": "53f435b1-573f-41db-8009-9a8bd0385eb1", "comment": "Malware payload (MuddyWater)", "value": "62ed16701a14ce26314f2436d9532fe606c15407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996551, "uuid": "440dc43d-1ec5-4753-bf3b-b6c8e9b8d26e", "comment": "Malware payload (MuddyWater)", "value": "a9cc17a0aaf1e8635fc0909651a4679ab1b16c2c56c1cfbd6e9aff47f6ca070e441bd77b77ae797722c25711ce310eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996551, "uuid": "d1641858-ad02-45a7-b25c-d66f734db849", "value": "T1D395330F73B5052BF173C7B884674D8883766461839996EF072913991DB33A1AC3EB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996551, "uuid": "7198f086-9a89-4d55-8194-641d04c2cee8", "value": "36de90fd2320bbe5701f41a19bbf5fc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996551, "uuid": "a18bbb40-2985-49ea-b5d4-1c76c9ecb637", "value": "49152:ESUYl7YmXr6/bCNPDWOdxxQlAtWimyQ7yDRtDNh3iN0ohCVu4H:AuJ6/bC979tWIQqT1opW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771996551, "uuid": "78289946-2c3b-407c-a06e-186ddca90f77", "value": 1905152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771996551, "uuid": "c03b0fb0-c58b-4b2a-b5fa-af0793eba994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996551, "uuid": "dbfcf5ce-bf4e-4f79-94aa-8635b09d92c4", "value": "3fa148e2d3fb86cecc15c276c5329496beba9aba14a6024b561efabf2e4e68af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaa0ad9-1282-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772048764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048764, "uuid": "f9339b9c-cf39-47b6-be51-e5670ae91c4f", "comment": "Malware payload (Mirai)", "value": "7b1edc155324346372a7d54efe34709c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048764, "uuid": "2f4cf185-b00d-4a72-bc34-2c58f864f811", "comment": "Malware payload (Mirai)", "value": "4004df497ed5b01618e4cc6ae8004532f25418b116837f6df31cb73d4cd173b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048764, "uuid": "2f1e77ec-cb7e-4d72-b6db-4377692d6522", "comment": "Malware payload (Mirai)", "value": "750790dfe34d3b169c503ba9f346d9d2ca24147b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048764, "uuid": "469874d5-5266-4495-bd5e-8a688575dc41", "comment": "Malware payload (Mirai)", "value": "af501d8e7efa9c7f23ccd608b4c0242e0a246ff4fbe5c05aa566c4f7cf9a9c4009ee24c96c01f3b0f159e691410acdc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048764, "uuid": "fbfd0c47-10a4-4585-aa8d-590f76d19edf", "value": "T151632851FC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048764, "uuid": "82745c4c-3f49-47be-b67b-cd8c9efaa4cb", "value": "1536:ONKlxkmiig51kRmO//kWUzObiAsDwY8rNRuVAvvWb:ONDWzk1KbiAsDHaJvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772048764, "uuid": "8b479b6d-c348-4fd8-b849-b642514c10f3", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772048764, "uuid": "4e9057f9-82fc-4d34-a78d-6544b4e63e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048764, "uuid": "46326d01-b029-4af7-bdd3-73ff432ee1fe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b3d6c1-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012944, "uuid": "1522949e-5850-4ffa-b356-00a073c94a12", "comment": "Malware payload (Rhadamanthys)", "value": "88fc71b365011b69be1d34554b82de81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012944, "uuid": "a136d156-f12a-419a-a3ac-ed7bd45b005d", "comment": "Malware payload (Rhadamanthys)", "value": "40175f06793febe4897971f5912dbee2eb65b7ed653cd633ed66b4917c66a4b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012944, "uuid": "8f3e2c2b-25a3-4de8-ab2e-db527d8f8d8d", "comment": "Malware payload (Rhadamanthys)", "value": "5a338262df9321d3d9d20bbdf8201fd27e04eb48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012944, "uuid": "37d286a3-644a-45bc-8d0c-e073399a2e24", "comment": "Malware payload (Rhadamanthys)", "value": "99c32bce0658a902062cc72f705282bf4028659d60bf1b135648373699d833dbc1200c059ec5e1f7a744545e8bfc83eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012944, "uuid": "17b92379-0f75-43d7-ab68-16f4d75d453b", "value": "T1AAA33AD91D12D2E4024378A83F1E29FB6C2AA1924616547540CEF7BA386FDB90187FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012944, "uuid": "e6036138-71f1-46dc-a380-e545a436d109", "value": "1536:GDB7eKg20vrLrG4yzFYyA70z6BkQWJ+aY:GDB7b0D3bOFYR0z6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012944, "uuid": "35fbc5c6-f7f8-4752-86e2-4aeaa853bab6", "value": 100060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012944, "uuid": "2bf31385-1af3-47ab-8343-fc535f2cf3ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012944, "uuid": "c7e45243-fa51-497b-89c6-74488f6ce5ef", "value": "invoice-1637482117.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3918edae-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045587, "uuid": "1872ec2b-7ddb-4e58-9b0c-d6bcaa80da41", "comment": "Malware payload (Mirai)", "value": "fd14d1004ea02d211dfa9ca2978f20fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045587, "uuid": "70d19ce4-375e-4b94-8e0c-218ae074de17", "comment": "Malware payload (Mirai)", "value": "40527e3df981060350d4fdf302f043506210ac565831fbb2f08a536c8e86f6ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045587, "uuid": "9a88b717-3f82-42c5-8a2f-37b87e6dad26", "comment": "Malware payload (Mirai)", "value": "f716eafe50eedd9a978b5d10dd2adfe55ce850b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045587, "uuid": "ceb810ae-00ea-4ff4-9af7-10458c33e2f1", "comment": "Malware payload (Mirai)", "value": "cc0cf435d182c67ae7cb096ee86a9718b8219b222be3957d742e52b476e319e19602896192fc48f9febfdd0d822157d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045587, "uuid": "d7b6892a-d4e9-4d89-aad4-32a4e8390a25", "value": "T1CBB33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045587, "uuid": "ca1e0962-04dd-4f9d-8e7e-922d26f3710a", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAp+TRCm7FnVqfJXFWbNb:T9a2aLqkrM0sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045587, "uuid": "ed8c5cac-599a-4789-81a2-ef37f03038ed", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045587, "uuid": "1ba4faf1-cc5d-4e56-b104-b1c3bf11cef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045587, "uuid": "ae486606-e184-4af6-8aea-b78b0c11c1e5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e324e7a5-1250-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772027404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027404, "uuid": "43b5bf21-4264-485e-8829-006d79ab2fa0", "comment": "Malware payload (PhantomStealer)", "value": "7d2462faf57eb68faca085d0e30985c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027404, "uuid": "65c21a31-6af6-47fa-a815-fea4e593b417", "comment": "Malware payload (PhantomStealer)", "value": "408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027404, "uuid": "c953a81f-ef23-4be0-9496-2d6a088d4816", "comment": "Malware payload (PhantomStealer)", "value": "8d5f16ba4bf9c88c02686d68ff285a8dcd039c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027404, "uuid": "5bb2cfed-d170-4ccd-b078-32d4044a080a", "comment": "Malware payload (PhantomStealer)", "value": "65e656d13372d3dd102a6ef738c7cdf25d609249ea7558cd37505f1907de67462c3b9547c2a3d0e25024a806b710c6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027404, "uuid": "249d7c9d-da31-47e2-b838-3b11869c1f0e", "value": "T13926C0C79BA86FC17F99956860FE0F2F9EB44248913DB6E02372BE375AF3144520B065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027404, "uuid": "b5683369-3abd-4bc3-9dfc-818b005accc9", "value": "24576:bWAONQACgOw0cWFWlaMWQI9OY3Kr5irymCM6DCYk6cP93LPLBtn6vXcAMk5amZAS:RtcA3xtL616FC42qBNq6HgZjX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027404, "uuid": "9d7f6a44-afa3-41c9-8e5c-607c5c220ee5", "value": 4561631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027404, "uuid": "e8cba21c-95fb-4c88-b9da-43e04ed1cbcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027404, "uuid": "bccf8b7c-431a-4914-b0ff-75c0c242e4f2", "value": "ESG-PO-000433.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0101edf-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001092, "uuid": "2c22f33a-97b2-49a8-8d3e-6874b31a2513", "comment": "Malware payload (Mirai)", "value": "bdb582dad53e668170f7ad8d3cb27a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001092, "uuid": "38d30aad-0297-4fb6-932c-f1f4407a0f50", "comment": "Malware payload (Mirai)", "value": "40e8cff1533cadd997f406fae014328c48b30b46f4d3f56166605daed077ae28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001092, "uuid": "484fa28b-e9c0-4056-bb6f-07e4d5300fde", "comment": "Malware payload (Mirai)", "value": "198f53ab404d4ff37d4aaa17d25b186161000be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001092, "uuid": "5e10d962-2490-4180-9b5a-abb8e96a3bc0", "comment": "Malware payload (Mirai)", "value": "e1e5d8e58d0993adf28a881414533487c520bca0f14c5f5a67e559ad99ac9d40c1bd90a095eade2d30c5225617f2da26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001092, "uuid": "f48cedda-17ef-4f74-bd74-35bbaa8690ac", "value": "T168E3875A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001092, "uuid": "0003e58c-eba0-48a3-88b1-31e453020214", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxMdbK:p4lybKpzEOfGQ+vEubTt4ouftL44dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001092, "uuid": "921573f0-0704-4c2b-bfa0-17619a9b6a42", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001092, "uuid": "a723838f-bfe3-4068-a66a-1c51e1970ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001092, "uuid": "26fb5cc9-9f51-4114-9f6f-31c7c6ed24a5", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eca97e9-120b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997627, "uuid": "7b01af85-94f6-4e37-84ac-5aef8bdec9c5", "comment": "Malware payload", "value": "85a2dba599390143c665e349f9f04161", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997627, "uuid": "498f59a3-393b-4515-b6c6-49018a0e699a", "comment": "Malware payload", "value": "4299bfda475b30306a93811a4d9948bec368dda819eb63b737c65c393b313a24", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997627, "uuid": "7a6c8c66-20a0-49db-aa51-0cbea9aa1e1d", "comment": "Malware payload", "value": "0365daf83e37d2c6daaae6c28b4c8343288ef2f9", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997627, "uuid": "fc8f9479-24a7-4874-befb-3acbcba5f554", "comment": "Malware payload", "value": "4077713a86cf0fc4ad7e87aafb4885b94380957cc245f31b0554fc3846409ef459639eea7387008b4fa4a71fd8ac4588", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997627, "uuid": "ac070cdf-68ad-40ce-bd77-c2f1a0a4003b", "value": "T100B4C6A0C5964A82F067D4BC60D0B9D208363F27AAD80DF193BF2A0C9F7F9666555F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997627, "uuid": "56607038-b268-4ba6-8d07-1f662cfc21be", "value": "6144:ZRCk4w3yvRaVEIpUg1F1yb/c9H5NyBJngFSISVX14PFIZrv9HwN5DEmjfMpeMA:ZgPw3yvRaVpUg1FAb/c9H51z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997627, "uuid": "f4cce956-1c76-4da7-8def-5c3ad0c4bb96", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997627, "uuid": "9d02a192-3f5a-48a5-bf78-0d0860d3ea89", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997627, "uuid": "9e1ece00-6113-4483-ac3e-1e9ca661ea15", "value": "4299bfda475b30306a93811a4d9948bec368dda819eb63b737c65c393b313a24.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79313b4e-128b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772052566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052566, "uuid": "b1ed58e4-fb9a-436d-8cf0-ae8d2c938405", "comment": "Malware payload (Mirai)", "value": "2229d58e109f02d687ae138aadf3afce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052566, "uuid": "157f749a-091c-4949-929f-c8df74f672a3", "comment": "Malware payload (Mirai)", "value": "4368352d7dc0debb46acfc7939774d9e088b1e78f3064fb8ea85fe9d671d7634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052566, "uuid": "4fcadca4-0ef6-451b-bedf-82c3eeba6889", "comment": "Malware payload (Mirai)", "value": "e97fd7d7e87e8a61845b63fad6b49b35950ac643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052566, "uuid": "0decfcb2-a611-48f7-b70c-36ad3557be20", "comment": "Malware payload (Mirai)", "value": "a5c1d14c239cdb88f5f82d3e3fcbb81f22af1726555790a6aaa0977ad57272774a4b2de68d8366a47ecd08b9ce43bb44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052566, "uuid": "23493724-9466-4f53-bb0c-09f5d089f5bf", "value": "T1F093C81E6E118FADF759873507B79E25A79833C733A1D581E26CD2102E6028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052566, "uuid": "73193beb-04ae-42c1-9d42-5218f35ed0ef", "value": "768:Io8JaY/G1h4+5BN0Nlb/apie/jO9GzeN2QbQSWWfbAJWu0vKe4DSAd5lMYFyPZ51:3o+x6CHjOkzO2OWWfhu6KeKkBeR9NFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052566, "uuid": "7415b494-04ca-4274-92e9-a24047fa29d9", "value": 89104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052566, "uuid": "2a36019f-8094-407d-b031-833e52b84499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052566, "uuid": "72f0a6a9-df9b-4f7c-a09d-a5ee46a93569", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf213864-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034645, "uuid": "8940a45f-3124-4491-b705-cc7f21f2bfc1", "comment": "Malware payload (Mirai)", "value": "2bb5a88cc018ee6cb9ee52e0b64f62a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034645, "uuid": "bc70f265-8616-498e-9f76-174bd5edb086", "comment": "Malware payload (Mirai)", "value": "43f4b1d07d97d930d30a11ff6cba36fe5d6cd7dbf8594b88c73b12f7996eb57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034645, "uuid": "6bf7d718-279f-4dc4-b127-7591f39b5578", "comment": "Malware payload (Mirai)", "value": "3579fb5aef3957a04fc8bf8ce53994895963f8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034645, "uuid": "096c536a-e217-4c46-8849-19c9f5c9dd59", "comment": "Malware payload (Mirai)", "value": "e33bbed354581207be6a3015c7d3447bb1d78c9f260905ddb89fb5bc80cb82a9f67fc60986de9d35ba064f00e12aea0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034645, "uuid": "8797c66e-df6f-4af7-947f-5994ed153416", "value": "T1B5433B31BA760E27C0D1A8B661EB4B24B2F547DE26E8CA0B3D710D9EBF715402553AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034645, "uuid": "c190ecc8-841b-47f6-b7c1-abac6fe5fcc6", "value": "1536:/fPucFQm4/g1We/ubY0qBQpu75nta1NNw:fucSb5uVaNNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034645, "uuid": "e0b1a6cd-9edc-4ed6-9d04-c0d28058d763", "value": 59872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034645, "uuid": "1539af14-e211-4349-b960-03ba718ddade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034645, "uuid": "f3a89502-503e-430a-8465-579910e469ab", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ee8d31-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013101, "uuid": "4589d53e-8b87-4a6b-8bd0-433ec6e9f18e", "comment": "Malware payload (Rhadamanthys)", "value": "0f4222457bc3788deded47464a1f5544", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013101, "uuid": "a4b46280-10f2-460d-b83c-55f141277744", "comment": "Malware payload (Rhadamanthys)", "value": "452c004a944a59678daf83034ef897b9e6a22c2617dd5732c57319c9a10fa1b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013101, "uuid": "f22c09ed-6e0c-437e-b64a-be24319ea037", "comment": "Malware payload (Rhadamanthys)", "value": "720e67d7f8d4ff70756020971a7ea3136d9ae677", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013101, "uuid": "bc0a6443-4afe-4728-8f31-d1fc9ee37301", "comment": "Malware payload (Rhadamanthys)", "value": "23daf50cdd582f2739dc31e3df53a4b95123af9492651d9f5c468a260790e6e8dc2073068ec4106a6844965028bea3ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013101, "uuid": "992c4367-708b-4e70-a3de-ccafac82d03f", "value": "T1D9933BC74913AEB82ACF61FE1ED135F90CAAC0044495BA4829EDF790A5DED6675C0CCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013101, "uuid": "29f41aad-a4c8-4f9a-a7d0-0b5d39472554", "value": "1536:GDB7eKg20w+qo+qB+qu+qn+qc+qc+qo+qZ+qJ+qM+qG+qn+qF+q1+qR+qT+qg+qW:GDB7b0w+qo+qB+qu+qn+qc+qc+qo+qZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013101, "uuid": "0162dda5-451c-41f2-8b20-dc8e7e764b87", "value": 97378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013101, "uuid": "4506248e-1acf-402b-92b0-a371551996d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013101, "uuid": "52343f5b-a632-4b59-a44e-91742d528286", "value": "invoice-1637482117.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140ef3ad-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012883, "uuid": "63ddf04b-5636-4e90-98a2-b63e020c4687", "comment": "Malware payload (Rhadamanthys)", "value": "bba93c9f364f7d2d619cef56c3312d02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012883, "uuid": "2ac5f3bd-6b63-4b2d-8185-2c15491fc99e", "comment": "Malware payload (Rhadamanthys)", "value": "4552b6b36b5715488c2d3a0c55cafdf020609974ad268c065342f5a8c0dbb134", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012883, "uuid": "8939b34d-5b80-48a8-a519-d0a191bcacc3", "comment": "Malware payload (Rhadamanthys)", "value": "e035c0c9b3bdc3c3f72c9151b7f72f03d58ffbba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012883, "uuid": "cb06c1fc-4a2d-46a8-ae81-acf6d23f0397", "comment": "Malware payload (Rhadamanthys)", "value": "962dbc353f364a9c82ac04d8068c22eebc6c39fd2be4256253ebc1dc77b4563cbb33805edd2a6aa72b67a7e36d232963", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012883, "uuid": "f7e19547-1f5b-4938-855d-d34df8cc3e1b", "value": "T1C0A31B705DD3DAEE44969D8BCD171539890EA80A6866A8B1D8CE7F67039E3F33D421C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012883, "uuid": "f5864041-c4e7-4f5e-9f88-c675f74a039d", "value": "3072:GDB7b0tmfWbsegapXSx/Kp5/+uJqpJFCD90evoQ7C9oArOKLsFW3S6jrS9dqNxNY:0OmfWbsegapXSx/Kp5/+uJqpJFCD90Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012883, "uuid": "4eb6553a-d105-4a59-86a1-906a13612b1d", "value": 100656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012883, "uuid": "ddc0904b-dc59-4e2c-8020-afb7204c798f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012883, "uuid": "8b4aa397-d456-44d1-a526-4b8633cc3167", "value": "invoice-1637482117.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cd41da-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017444, "uuid": "fd6624bc-ff7b-4ce7-bc5d-ea314aafe5a3", "comment": "Malware payload (Mirai)", "value": "bbc30c65f60377dcc4f109f6624ed769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017444, "uuid": "7ea1e79d-be7d-468b-ae4d-d2af967dc2c9", "comment": "Malware payload (Mirai)", "value": "47591f33de12f9e6d8b56af6e3c3ff3825d00feec1c45198df91f44e672df254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017444, "uuid": "e0333197-d846-4fa5-adce-8a64db0f0cc9", "comment": "Malware payload (Mirai)", "value": "dbb19d9669a4de253a92d31cf17f61fff3fa4a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017444, "uuid": "74ec9f6e-e471-4d77-af0a-76c8e94fac14", "comment": "Malware payload (Mirai)", "value": "74d4b07467292e4eb6cd52d1e82025cc9091ba24f87a62dc9a5b602c182cb48a31f666cbaa35bc2a4e39b443f174b160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017444, "uuid": "a75ca75e-ee60-455d-a8f4-b142c92dfd63", "value": "T1B1230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017444, "uuid": "09396bbb-15f0-46bf-8801-372257963a12", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THz:5DmKF7Gxyk8cqoHAmWurAufsG50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017444, "uuid": "14a74bee-6242-468a-ac77-5b0063dffc23", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017444, "uuid": "8d70e153-6e32-4480-8439-1c4b17c3508d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017444, "uuid": "1ef53fc6-16b2-4d68-83d2-08c6231683d0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2271f2f-1250-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772027348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027348, "uuid": "5736ab99-014a-495b-bdf8-380d55c950c3", "comment": "Malware payload", "value": "840f8e4eff24158a26417be777b28db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027348, "uuid": "272434f0-2cc0-497c-bd72-d1add48b518e", "comment": "Malware payload", "value": "48c98c3fba0d1896be424d6cf5076fdc7c82b4d5dba3058253cde5b23d815a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027348, "uuid": "e30ba5c3-4481-41fd-ac1a-5e0c74f39008", "comment": "Malware payload", "value": "166f8243d2aea77dc6dbf6415b932ad5fe09ee5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027348, "uuid": "4852e3ea-23aa-4cd2-892d-9cf86bd157a4", "comment": "Malware payload", "value": "ef7e23a851aadfde31284b3bc2a126ab7611f99a3d46a674525c4a5a109bf8f0dfc722dabeb55aa784320b5661f06fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027348, "uuid": "234490a6-0459-4caa-b1d0-678c27e8a74d", "value": "T11F65F36C6B6DCDA845191A06F3387998DCCA0AB5BC560F709441B2B0E672F4BC8FF1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027348, "uuid": "302d9013-72a3-4603-9af9-4cabcf5c7fa1", "value": "3072:d4jTls/oofROPnSmXTPvuoRCHAAw/zQd13XKAWkAS5tIdoveq7v5:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027348, "uuid": "a572a7cc-1ab5-4c4c-a0cf-3f0940389511", "value": 1509125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027348, "uuid": "bb95edba-3ea3-4f42-9de7-ac229286dacb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027348, "uuid": "952c3d54-2987-4347-ab90-6518e8b94952", "value": "HWE.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060a6e86-1251-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772027462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027462, "uuid": "b86f3360-2521-46c5-a18f-2d63ce6e97ae", "comment": "Malware payload (Formbook)", "value": "0087d35fe78efd9110ab644761c3e105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027462, "uuid": "0d992136-a5af-4818-881d-5fef6ecd54e4", "comment": "Malware payload (Formbook)", "value": "48df03b076be5df4b3be0c32f6aaa45f14390f48ff61db0d73af57692360d033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027462, "uuid": "3638fb1a-fbe7-4853-9bc1-4c48fb776363", "comment": "Malware payload (Formbook)", "value": "247d867181dd7fed8f25368f6c55ae6229f78fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027462, "uuid": "7c82a781-4c30-4459-b3a7-e71743bc8f44", "comment": "Malware payload (Formbook)", "value": "8b2ed796d0693d4f1bb6bdced8eec69421e2feef5c2e5212fd5696c1cd4c244efdea742f08169b55e79792266a8ed199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027462, "uuid": "6070aeee-5989-419d-9eb3-99e93da2b9a2", "value": "T166F42341A5D0AAA5C21473328832CC545A3878719E66762AC77DF1BBAC303E3DD77B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027462, "uuid": "02d5ce38-f788-4158-8182-3943e91804fd", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027462, "uuid": "29596e5b-7e7c-40a2-982d-3887a72faaf2", "value": "12288:9z7hU5I5yuNHIgzSFKxWltRohBfSTso93UWROFPrkG2Bu+AcGqpcD89NzlxLHZZ:9f+iN57Gtene3RMPOu5cGqpcDcDLHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027462, "uuid": "0bf55192-123a-490f-8ed5-722afeff1f93", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027462, "uuid": "9bed5907-6fba-446a-a850-2a94912a0ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027462, "uuid": "5db01196-b488-4030-89a8-1344d0692fef", "value": "Quotation invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320d9f6d-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045575, "uuid": "11b31fd9-06f2-425b-bec3-5bcda272e6b0", "comment": "Malware payload (Mirai)", "value": "e32ae11cefd139718c7a967938bacc92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045575, "uuid": "fd995976-633c-4ee2-b9dc-e22296d2a538", "comment": "Malware payload (Mirai)", "value": "4a2a6534e7ddab62f606e618d2e095da4cbabe80899106a09b60343c63073664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045575, "uuid": "86bf6197-e9d3-4cb4-90ec-18e4aa2c9884", "comment": "Malware payload (Mirai)", "value": "96f3f9261c4cd36588f8dc8aa8a6588f3a98be01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045575, "uuid": "e2992f4b-b1c9-4e0b-a36b-85016d6112d5", "comment": "Malware payload (Mirai)", "value": "66b05a59fe75a5de4032d024f2968d378b1ac436c1c92d34cc413967d1d6eb1cec8197ccfef0ea45533771f4dd99939d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045575, "uuid": "f053be6a-3c3c-48b6-8863-1966cc564380", "value": "T1B8E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045575, "uuid": "0454f90d-339b-4262-b23c-01884276d393", "value": "3072:Cv/WwsLgaq353qHiCOvhOp1qkDQHbeskmhxQwoVSUNu:KPLaq351hOp1qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045575, "uuid": "8d0d48b4-f231-4811-8d3a-33ca9ea22dc0", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045575, "uuid": "91873cf6-8972-43a1-9fc7-a0fe215effd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045575, "uuid": "85f97dca-40a5-4b48-b4af-d00a5d82d2f4", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be86a27b-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035932, "uuid": "68c84297-79e6-4dca-9f38-5ae34ddb1a36", "comment": "Malware payload (Mirai)", "value": "a25a3ca96b3643172578b16d8a11fe41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035932, "uuid": "068e7ebf-aa44-49a5-9dc2-79aeca4d7ece", "comment": "Malware payload (Mirai)", "value": "4ad3fd9edd64bf2417309e8edc9104199f6cb62abd80f05ca2ceaf533776ae4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035932, "uuid": "279496bf-a891-48a3-8193-edda81f7b642", "comment": "Malware payload (Mirai)", "value": "7b692f3bdaa25b7f1cafe79c9f59ac2225f46377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035932, "uuid": "74cdaa93-ff5f-445d-a446-0ed2224d8856", "comment": "Malware payload (Mirai)", "value": "61b45a183879d801c9733c9f935dcdcd073d11755042d0978ab9d8b9de6d598e1b4072fad702c00800cb17b7f67cb081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035932, "uuid": "ffbf2996-f0c0-42a3-a2ba-16742e6ac7f8", "value": "T179A53314F2FF9CCAB326F9B924F51389CE23D049A44653D7F6BD0A84CF071A5056B92A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035932, "uuid": "89296b79-e27d-481f-bba5-7ef71e679604", "value": "49152:dx0crz6k79sSSrYj/Wg2xwFK2WiboHjUfDmFPu0FRN:YcrzD5sbg2xwFKvUfS1uERN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035932, "uuid": "7d978fef-7503-41c4-955e-481db44efa96", "value": 2131136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035932, "uuid": "66661be3-ecfc-4762-a0df-b125da285fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035932, "uuid": "a3395e99-715b-427e-a56e-29dfc948efa1", "value": "ARM5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2c880a-1280-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772047771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047771, "uuid": "de90091e-b0e0-4627-acda-f49737221d66", "comment": "Malware payload", "value": "aa80ace0f93aa6fc602bb52611a49776", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047771, "uuid": "422f5d75-e2ad-43ab-b40c-79ca1b9001c5", "comment": "Malware payload", "value": "4b0912013a4f081a3b6e3146df2f55734330aeb645bf585a9490b0057c2804b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047771, "uuid": "fd4abe8c-2131-4bff-81e8-7688559f81a5", "comment": "Malware payload", "value": "1c3f834c7adca8ccbfcf04b7ee6e2a4dff49bc59", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047771, "uuid": "8de395ee-2c9f-40ae-a9a8-9589c54939b6", "comment": "Malware payload", "value": "a67607784b86b80e3eded1af2f61e7acdcf9f5cc913fb330cd5b60abf7e5be72cd929d520a1a52862895805e852a9ee7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047771, "uuid": "0c7d1ecf-9306-4269-aae9-710a6fa01c01", "value": "T1D30184CF2AD4A155885C8D50B16B4A2879488FD430700FCD565DB4B679ECA34F9E5F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047771, "uuid": "ca3fc7b2-f6e1-4741-bef0-0449ba8acd8d", "value": "12:8LqUkjUqNIl5zAUX0LKjUmOsUKCUU/U9SEUQtaKAU+iAUafAy:8L7kgqNI75CKgmiKDU89EQtBl+aE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047771, "uuid": "251510f9-41cd-46dc-b02a-249a7755bcef", "value": 786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047771, "uuid": "cfeae0aa-3cc0-413e-bc74-c61d308d3ab3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047771, "uuid": "a301344a-f5ca-4d93-a69f-742c48feec85", "value": "abc3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ac8ecb-1255-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772029398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029398, "uuid": "5d9ad85a-9498-42ec-baab-380905bfb149", "comment": "Malware payload (SnakeKeylogger)", "value": "8bc5d0081f7c99103331cb408e45601a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029398, "uuid": "e8dcaec3-8bc2-43f0-bcef-881a4f4189bd", "comment": "Malware payload (SnakeKeylogger)", "value": "4b3fccf8e3e8cf25b5b63ba8f397687dd733fd884efe7c78083d154310f272e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029398, "uuid": "2c737d31-5805-435e-a1ac-3a96bd556b4d", "comment": "Malware payload (SnakeKeylogger)", "value": "796ade52d238971ed98543c7b4670f5e746d22b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029398, "uuid": "7135792a-5292-4bbc-b201-e2b8d6e61004", "comment": "Malware payload (SnakeKeylogger)", "value": "450d8f5e4b3a76c286298318d0c9f1974661e1f068207bee249067574cf08a1234031eb159b3e79a50671c990dc60287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029398, "uuid": "fcede6e3-ccb7-41c9-85af-ca9d879634a4", "value": "T16F35AE0273D1D062FFAB92334B5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029398, "uuid": "044ba7cc-a797-4b47-a7d3-853a8f0372d3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029398, "uuid": "d7cd9c62-0c6e-49ed-9153-658266cc55c2", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXda1FbuGkZ:fPVt/LZeJbInQRa1Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029398, "uuid": "d16c0c1f-ede5-49d8-b8f7-a2e113a9bca6", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029398, "uuid": "75dc3adb-4bf7-444a-a1c4-ba6c02738d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029398, "uuid": "37360454-d945-4b5f-ad60-e97e3ddca072", "value": "overdue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0de3bb2-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034648, "uuid": "3d7559e6-8354-4c81-9caf-e2d612bcc190", "comment": "Malware payload (Mirai)", "value": "b32b3da8fe4cdf7554c349a6b89d09ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034648, "uuid": "e5455460-105d-40e8-b3e5-8a4d147a13b2", "comment": "Malware payload (Mirai)", "value": "4b86c581f24729193a63c16fa2b3c165a0d9f1bf15b7761b36d2bf7b5dfb6d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034648, "uuid": "6a8d8c76-90dc-4243-9f21-38313855ef19", "comment": "Malware payload (Mirai)", "value": "ca385d0f6ab3fda4aa271ea0b1172ad146d7d61a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034648, "uuid": "f4d1115d-abfa-4198-9388-f2147edcf932", "comment": "Malware payload (Mirai)", "value": "d88b167d5b90c252b7ff53ace79f21a4f9e3d20cfc790046e317741b21917d0356a7ea14e0b35c2d8a1958cbb1385dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034648, "uuid": "1687bbbf-d50a-4ece-8e98-1b5b14285224", "value": "T15C436DC6D143D8F6E80B0570602BE72BAE71E8EA2219FF47C7689631FC86641A517DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034648, "uuid": "ac94b0b9-166f-4f3b-ad26-36979381dd86", "value": "1536:DIqD1xfYqyDgZtmYX38pJWplcl2jUY5ts0Aj+ISeWYeRu:DIqDXfYqykZ4YX3IJWp++UytzG+MWYes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034648, "uuid": "742697f8-0645-4a8f-a4f5-d4af63be5e20", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034648, "uuid": "d1500829-71e9-420d-a953-7b8485e2297f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034648, "uuid": "fc76bb53-5ef1-436f-8c01-da729ea4d824", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3a8ca8-120e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771999072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999072, "uuid": "fd18805d-16f7-477e-aaa2-82e3893a5cab", "comment": "Malware payload", "value": "057e58ff00be3032fd6e3f5d2cc80905", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999072, "uuid": "59960e68-f2b2-4482-a7d8-87a1bc4381d0", "comment": "Malware payload", "value": "4d2958d93d4650fc4a70f70663fe6943e8c11d61b2824512da296e8fd84e5bb9", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999072, "uuid": "f4949a81-f8a4-4d5b-9db8-189d22b64a1b", "comment": "Malware payload", "value": "56380a652471962387693f4bcc893fd21f0fc324", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999072, "uuid": "c320afcc-8a8a-4de6-ac98-5b74bffa1e9f", "comment": "Malware payload", "value": "7a103e9e783e0fe1e473be0815693075951ebe56934a7170bd0e9d5644c32e9cd9b58f3a11294ae9f23a4ffe6024c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999072, "uuid": "799ed58d-7605-4717-bb8a-9399f9865b0e", "value": "T18C1602A0D55A8B92F063D4BC61D4B9D204353E136AD80CE1E37F2A089FBF8B66655F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999072, "uuid": "a846aac5-3f76-4223-9842-d0ed61bb513c", "value": "49152:ECe8URnPYHY43saSkleDFvCH1pjPh4ScRbI0/JP38Gw4jMXhku8Wx0y+tOonhBWV:ECePRffvlEFJ4ZbIoJADxMFlhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771999072, "uuid": "02b8a0b9-c64b-4c65-8b6b-d0b736ca5ef2", "value": 4042752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771999072, "uuid": "27fa5ec6-6601-418b-97c4-eaffde10ba8c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999072, "uuid": "6cb88cfb-6e60-409e-91e7-5d5aa5aceb6b", "value": "4d2958d93d4650fc4a70f70663fe6943e8c11d61b2824512da296e8fd84e5bb9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e739e1c-11ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771983238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771983238, "uuid": "b13ef13c-cb81-4c35-a4fd-67fafd22c0fa", "comment": "Malware payload (Mirai)", "value": "d2d9876e5fc4e14fb6767bb7e9e00521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771983238, "uuid": "816a971d-4d4d-4957-ae77-84f7c54130f8", "comment": "Malware payload (Mirai)", "value": "4ef0202d0b3b7cc2e39f47074faf010eb831198cd9588f7ce702722d8e24323b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771983238, "uuid": "747f9c7d-3fc9-4f49-8541-1aa383855f01", "comment": "Malware payload (Mirai)", "value": "958eefeff9afa4cba33397fc766b75b8d045ba58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771983238, "uuid": "962f89f5-88a1-4cb8-8f0c-194e75f2340a", "comment": "Malware payload (Mirai)", "value": "52476523f4ea2ef2629997495e75a5c8820f06852f061e7705c5524e2c6ed9ef9aef6f4e6aca4e1baa98206df823d7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771983238, "uuid": "38f1402b-c75b-40ff-b5fc-e0452380c790", "value": "T169A36C2BA641C9BAC08752F627DBA6516923B83E0B33714773D5BCA53F218C94E5E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771983238, "uuid": "645abf34-84db-4d23-ae7f-b0e6a3ca87c1", "value": "1536:rHL8u2nHRpTjxe2oeLOOtyrEOLywA7irlD3rZ/G3rlphai6wh7pTmZhm:Pd2nDFe2oeLOOtJYyhAD3rZSrlphai6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771983238, "uuid": "fe403efc-1f9f-4be3-83c1-0e4d9a6868b0", "value": 98102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771983238, "uuid": "0b0a99e5-cf92-45db-96d8-2c71035858f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771983238, "uuid": "f2bc4c79-228c-4770-8851-503bcd874f63", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e84c827-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003076, "uuid": "cd37a4b0-a355-41e2-b453-b6de93a6b8ea", "comment": "Malware payload (Mirai)", "value": "4af8bec7f64d73fe459a2b17ab0c6662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003076, "uuid": "fbf8b999-f880-4acb-b8d7-a91a6052b8db", "comment": "Malware payload (Mirai)", "value": "4f55702afbddc308c85dea9fa471e6940a4f75419a970dcc0aee8c18eb69589f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003076, "uuid": "d2c91236-da71-491f-a61a-259fe627961f", "comment": "Malware payload (Mirai)", "value": "0f53e22e2ef622902b36126099c08adfd1c8a84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003076, "uuid": "927bdde3-7261-425d-ad68-c60e2c6da091", "comment": "Malware payload (Mirai)", "value": "65f1aa316dfb04edf77b5f699090674732c2ca48743cf3fae5ce0b4278e3430098e89037af9203384fcba9a7c247c5c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003076, "uuid": "f3710e2c-98ef-4063-9619-f333d17b9312", "value": "T121B3C609EF614FFBE86FDD3746B8074525CCA51622A93B3A3574D828F24A64B09E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003076, "uuid": "47777de6-7cc3-4a2f-b09b-57238549aba1", "value": "1536:w4Ij5gpB2UJ5bTuoK7RMG6+FnFn+93c1Z/TWqJcZZsI+I/8NWqS:wm1+1F+9s10E+8NWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003076, "uuid": "e92c3577-f760-4adb-a419-6a4327195256", "value": 110272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003076, "uuid": "7798a9cb-6d4f-4566-9ce0-3c2ce31e297b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003076, "uuid": "db92d829-4c59-4ed1-95ef-c93263a423e3", "value": "ez_nigger.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de91c83-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012899, "uuid": "8ca7ded5-c862-4eea-b8e9-b2ed7c5a8e04", "comment": "Malware payload (Rhadamanthys)", "value": "8f6559baf444282772c911d4b5a884d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012899, "uuid": "16a679c4-913c-41bc-8739-3ca038f8ba1c", "comment": "Malware payload (Rhadamanthys)", "value": "4fdb8bea405a4d6a9be6856fe3d083ea91159a31736940038350636a247e8ad4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012899, "uuid": "f235d317-09d4-4257-bba2-d611515e9d32", "comment": "Malware payload (Rhadamanthys)", "value": "8e7a7bb58d75f4a6fc0ad81f34c592e8f3dcf2b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012899, "uuid": "6ddd53e8-ca4a-46a2-b00c-1e5ff088da6a", "comment": "Malware payload (Rhadamanthys)", "value": "9cb28ec8951a1de5bd42423a0afd9770bba8e851f632894937dc413b6a9981a44ec6dc9ea8aa07c722b18d01835d8941", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012899, "uuid": "334ffae8-c61b-4b6e-ad7a-ca18c54f7eee", "value": "T1919329AD4C328EA2250035B72F848A7CAC6728D795570E9D4243FB856F92E9E3DD14CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012899, "uuid": "96d0dbaa-6717-424b-a11b-79a14f67cc27", "value": "1536:GDB7eKg20mo4jr7ri4Z+h9i17DARytsQm6BkQWJ+aY:GDB7b0iHTEJQm6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012899, "uuid": "5fb2828f-34fa-4555-9c3e-fc4c29912c5a", "value": 96753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012899, "uuid": "f7f660f3-4d77-4d67-8f14-191bf903652d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012899, "uuid": "de6b1645-aa39-4f23-b925-9eb90c9787db", "value": "invoice-1637482117.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47072a0f-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045610, "uuid": "8cfe8ede-97d5-4a28-9361-90c938d285d2", "comment": "Malware payload (Mirai)", "value": "3f14f70fb436d9e653f67155a2ab286c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045610, "uuid": "c8ca2d01-d36b-4693-a366-d54d5513d244", "comment": "Malware payload (Mirai)", "value": "519fd8d2deaa7fe789bdaf93961364ef34d499a2bb85577bc5e2de36244afa00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045610, "uuid": "377fb063-13ad-4d9d-b69b-692a022023fd", "comment": "Malware payload (Mirai)", "value": "5ff785a888199f21c5feba1d32a5b04d2511303d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045610, "uuid": "186c804f-01c9-4ca9-8fb5-2ec1ae955abd", "comment": "Malware payload (Mirai)", "value": "56849b1dca4b28fc09873de0dccf78b93dfbefdc985d17c8b3fb203bf34fa77d436b47af77af8a0b5206f38ded7ad641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045610, "uuid": "ebee989e-3589-4964-8eab-35d64c4b426c", "value": "T1D304961E6E228F7EF668873547B74E24975833D627E1D684E1ACC1106E6038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045610, "uuid": "2cc43fd8-bbd7-4b20-bf9f-005ae1af453b", "value": "3072:NkZ4LL6auDHYeqrJAefp70uxy9PSfJy7tsqzk+dAKRDDQWTIJzk1l2Z:6ZcLDuDHY9JAefp7dxy9A8ZBRdtDNIJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045610, "uuid": "7575774f-c2cf-4dd6-a003-2050d82a8500", "value": 185848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045610, "uuid": "ffa5acfa-1460-4e45-95b8-cb3248b94a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045610, "uuid": "71dc7c0d-54d6-432c-866d-c77d9c0a55e4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d525eb9-129f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772061029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061029, "uuid": "f8a660b6-1089-4a3c-85f4-140ede695742", "comment": "Malware payload", "value": "db4a902b422c779ebec8ee61eac1d0b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061029, "uuid": "2d787a6a-5d4b-4a90-b569-e2264c365cda", "comment": "Malware payload", "value": "52311615bc66fccac18e52486cce1a1705bb9a2715da73cfbeb86d2de5ce7a38", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061029, "uuid": "559af2d9-a126-4fda-a54e-b52cc2bbc519", "comment": "Malware payload", "value": "04ca6d02db9be5d5cfc722d0043c89c1ac9c39d1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061029, "uuid": "b644b511-41a9-40c6-bb8b-17e62d41fb35", "comment": "Malware payload", "value": "1c05033fe0cb67f57504f31fc1b1174a66e0bd46de5fceae3a978f1eda651b575ace59bd2865da1a2481192d1ac9e4ae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061029, "uuid": "7aff2ef3-e9de-4aa7-b8ee-bb8321671451", "value": "T1C9518706E2F2316527529C2412B72E3F9AA89817DE07CD50356D1EE8BF75874FC07E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061029, "uuid": "7fe71967-db05-44e3-9cf6-7e4055bc55d1", "value": "96:hYPYSyiXfUJMPqUpIHHHHHP9naHHHHH/17xe7:hYP38JTWIHHHHHFaHHHHH/pxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772061029, "uuid": "93576064-0523-490a-b282-849f058b1b4d", "value": 3162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772061029, "uuid": "f9ffcf06-ea96-42bb-b793-150eb702a1bb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061029, "uuid": "d919920f-0865-4d96-b5f6-ca6b51564d47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dac90ac-120c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997867, "uuid": "41223576-0195-49af-9335-9e0c86d885c8", "comment": "Malware payload", "value": "88968411e436419f7a772a92aa0b5b33", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997867, "uuid": "60c99f44-47bf-48ef-811a-cf4829c15f78", "comment": "Malware payload", "value": "524c09686aa7bef3299f4772caff5627dda772ad8bf460c0f10b600da8e11f97", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997867, "uuid": "5f8a6d54-5cc0-454b-9ddc-8b9eaf7dcd0e", "comment": "Malware payload", "value": "777040bed9d26f5da97e8977c6efc0586beae064", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997867, "uuid": "7a63139f-076e-42ac-8977-686a50ad3523", "comment": "Malware payload", "value": "ab5546a62016c6724480e545e55b0e5bcbf9a2329ed685ed6579d8c9c07d237efea2dd3604da40b98ab62781b35b101c", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997867, "uuid": "19ac7610-95a1-4dcf-9a61-c9e419cf9667", "value": "T15C1602A0D55A8B92F063D4BC61D4B9D204353E136AD80CE1E37F2A089FBF8B66655F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997867, "uuid": "9bc5b209-feee-4631-9625-917184239f1a", "value": "49152:WCe8URnPYHY43saSkleDFvCH1pjPh4ScRbI0/JP38Gw4jMXhku8Wx0y+tOonhBWV:WCePRffvlEFJ4ZbIoJADxMFlhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997867, "uuid": "4ec75190-6eff-4425-aad1-7f8e9e6067a5", "value": 4042752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997867, "uuid": "bb4e50a0-6770-46ba-82fd-56f4b8c7d8f9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997867, "uuid": "a7ff3ea8-b7e2-41cc-a518-60d535aab09c", "value": "524c09686aa7bef3299f4772caff5627dda772ad8bf460c0f10b600da8e11f97.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ebfde3-1245-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772022657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022657, "uuid": "2cfb65c4-b32b-4a09-bf4c-d9d6a828d115", "comment": "Malware payload", "value": "ad95013744e867222b63b76b99161dbc", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022657, "uuid": "1839a1f7-1a8c-4408-8128-f588e32e803d", "comment": "Malware payload", "value": "55294a53d08d13627c9f41494401c1b784f977aefac4bb1a05bae129d83b9e3a", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022657, "uuid": "50265672-c34e-418e-b581-a73bb0bd5fb0", "comment": "Malware payload", "value": "267b6f9e3084903415efca23eb49285368683261", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022657, "uuid": "d21ffce5-636a-4819-a821-f5027da2ac86", "comment": "Malware payload", "value": "3e66b0ca05f0ac1eb35d2098e7f50b66e75250e7c50a9d9250facff1c602538951183a6ab23512540b1396848bb2767d", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022657, "uuid": "03d2ece5-239c-4fcc-be5c-8bafe5a37b69", "value": "T1D292967438D778811EAFF41E3BABA404262A9507401CCE42BD6C16D85FD817CE6F5EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022657, "uuid": "3312b0fd-f5aa-4958-96ac-e25f06a08e04", "value": "192:fu8o1ifQiARiTXGZSbaIzgqEa2CD3w4xyd7KuINI40G5n7QV7pMQC+pqavEyaQ38:G+2r5CDCdtpmkw160R/5WVbdFCpc0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772022657, "uuid": "c92df7dd-becd-4481-923d-57e006b7043a", "value": 20718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772022657, "uuid": "6cbca9fc-836f-415d-9262-38e4c22816c3", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022657, "uuid": "1b64dcf1-76c0-4ffc-939d-2ca0a0ad4d55", "value": "hseo.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733de2a0-1209-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771996722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996722, "uuid": "df688496-7415-4a80-a62d-7733e362a7b0", "comment": "Malware payload", "value": "dc706b45a9e6770ae327adff4ccd1a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996722, "uuid": "398e1d56-9180-4ab8-bc89-4af786c3cca4", "comment": "Malware payload", "value": "556e86667fcaee82976e83a653acb73a3e953f3560a5ba5aa7fc75a6d1a2c399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996722, "uuid": "f4dd5c94-1868-40eb-b8a9-4db3b9e4e874", "comment": "Malware payload", "value": "ceb9b7dfb8a36ee8fe223063a6e3f730f2dcefd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996722, "uuid": "afa483ae-1fd6-4699-bddb-479448e83b23", "comment": "Malware payload", "value": "63ea94db8a8ce97da22653d69f7fd7608f3e7d1e62ca7ab31ca7b46686e19de1772fe244c71cacf60d182bcf9272a10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996722, "uuid": "26ce9c1b-ff56-4c63-a909-1f7e988e6de4", "value": "T198863843EDA555E9C4A9D1328E229112BB317C8C5B3123D73BA4F7282F77BD06AB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996722, "uuid": "e41c1db4-dab6-47c3-95db-dde2bd0bd873", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996722, "uuid": "df6ac51c-f63f-4f13-a8e0-7c727418da7b", "value": "49152:nm+XsQQoCADKrLmgBzcKtpsaUF76pKQamp0V4+Cvlvz8UdE69nuVVHv77GVst3v3:nbhtc+G+VaxdExj7DEQV51xlykb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771996722, "uuid": "b1c242b8-2672-4d5c-a170-99a847fd1dbf", "value": 8071680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771996722, "uuid": "a024c06f-c550-444d-b423-62b902ac810a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996722, "uuid": "b7ecdcbd-e116-474c-8b86-796059083887", "value": "556e86667fcaee82976e83a653acb73a3e953f3560a5ba5aa7fc75a6d1a2c399.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5699811-1209-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771996806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996806, "uuid": "b4f7a429-5a6b-45d4-b6b6-da4571f629fb", "comment": "Malware payload", "value": "9c6d6235761e7a2631eb38b9e16a0aa4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996806, "uuid": "408edb2f-e844-4830-8ff3-4cc6f6f17681", "comment": "Malware payload", "value": "55f3a404a01ad2a4f3ee62d447693b143b6163b996d3cddc80b8dd820217bff5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996806, "uuid": "c393731a-0a48-4f66-9a09-628684c59bd8", "comment": "Malware payload", "value": "780739ca7113d3ca72d6f77d115218829e81f279", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996806, "uuid": "4f7471e1-2753-4eaa-825e-04afff32f473", "comment": "Malware payload", "value": "c91f15927c2dfe89deb483e74b7426beecd1f3bf684149a512dfc6e020e6633dd0a76765aecd7214097c5fdbd1f8a2d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996806, "uuid": "ba62605a-ca26-4f70-8ad6-145fc3fddce4", "value": "T17A924BB506496CB9BBC0CE7D9F3C7F0CAEE582C42129E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996806, "uuid": "74f5277d-76da-4151-8ca1-802624ab59c2", "value": "384:nKfncuxOLnVYMSMzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:nKkuQL+MzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771996806, "uuid": "8e56892d-145b-49ad-8135-c6a802a3d946", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771996806, "uuid": "49062b0f-be28-4816-8c23-a2780e8ce090", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996806, "uuid": "3809163d-abe4-4681-9e3e-8ea5256cc686", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee06e8c-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772036013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036013, "uuid": "6d536c65-f599-4e61-962b-9fbe27ca8c28", "comment": "Malware payload (Mirai)", "value": "802ea96078b09cf30451c57fb7553ff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036013, "uuid": "eaa316bc-1085-4f63-b32c-c70421b37ded", "comment": "Malware payload (Mirai)", "value": "56b57f5d1c1c0650ec97cd8c6e6acb80462deee5c0ae8250ebb4d3bbf9a2fbb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036013, "uuid": "3c6abc69-f32a-4ee3-b456-08062d210b75", "comment": "Malware payload (Mirai)", "value": "eb65309a2cbb238afde6a84f6ecd54462f4d7bb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036013, "uuid": "6680d2d3-dd99-416d-9b88-805cf3d4ab4d", "comment": "Malware payload (Mirai)", "value": "2e9f00f34076246b3152b97024cc56894cc882d1543c8177db4ebce6dab39fc71d27d7d378e08587be2ac44a7da39aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036013, "uuid": "013ec179-0a7b-40a1-9ab5-3c8febbfd7d2", "value": "T1E9962B176A1CEB0FC66861345DB1EA98273A1C4645DB9417B381F309F9F20BC9A6EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036013, "uuid": "0fb3b5f1-0ca1-48e8-b192-551f87ed4860", "value": "49152:LevyeP8ycJkpnoPo8C36PUGtySDWwYPuhW1n9YF1Cs40Sue7oWKPYy1Owb1gdNgy:K37w+RH8ZgLgRfjE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772036013, "uuid": "24d663da-1331-414e-9d0c-a4add979627b", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772036013, "uuid": "dfc86bcd-1bb7-45ca-8ec6-20727a7b588e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036013, "uuid": "b736c05b-aa6e-419e-8502-f5d1bedb02e8", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14d0a88-1285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772050110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050110, "uuid": "8f0a191e-0102-4b7f-9f64-1ec26d40471a", "comment": "Malware payload (Mirai)", "value": "ebe2ab895ed6573b4e47f4c3a9b1f83f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050110, "uuid": "5dc65c47-8e9a-47dd-9f34-cf815137114e", "comment": "Malware payload (Mirai)", "value": "574a161f66153b766356d3adf8c310af6daad0a48db743dc53b3f5000eb620e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050110, "uuid": "1b842494-2779-4ff8-a98a-0b46a0d0371d", "comment": "Malware payload (Mirai)", "value": "17e34101fe1097a2926403d60f58caaa421e976c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050110, "uuid": "38f448d0-300b-44b1-8617-139a52fc4d17", "comment": "Malware payload (Mirai)", "value": "cf56e78d56ecb1bafd249694e7e232141b3d0ab87c3423fb9728038cc21b28bfa1ea6defab2f8a99a3100de4861a16da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050110, "uuid": "2444e9d8-a1e7-459a-9da6-049a92366310", "value": "T1A5E2F2419DD00E1FCD4B33F1D35F91A688B848979F822FFF79182AD90AC6124A233755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050110, "uuid": "19fc7ce4-cf3e-4eb5-9528-6c1f5e448822", "value": "768:hDwnFk7Eqbo5vYG9rA0/qlFp34baBv9Fq:h0ncEJh9ylz3CwVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772050110, "uuid": "87e097b9-2e27-432f-8e07-8205df757e83", "value": 32148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772050110, "uuid": "5a9b8de3-1a9c-403c-86fd-4962a7c27ab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050110, "uuid": "beeef286-81ac-4fdf-8008-dc5d872bd139", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bab71ba-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001058, "uuid": "012702b7-be6d-4c3c-b15f-6f645740c673", "comment": "Malware payload (Mirai)", "value": "ca35feb5687377d33f3b0672aff1822b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001058, "uuid": "5440d816-a0bd-44d4-9efe-a2f66534895f", "comment": "Malware payload (Mirai)", "value": "57a20a038a9dffe4a120cfb2c7bbc871d241c7121752208d9f07d889742d6bcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001058, "uuid": "9ce80184-4715-462c-a0f5-87c7437e478b", "comment": "Malware payload (Mirai)", "value": "aee9f5b3985ad7a907fca51803e8d4aac4d313ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001058, "uuid": "5279a88a-b614-4626-8a06-4e0ca52bd80f", "comment": "Malware payload (Mirai)", "value": "531d8b08f7e5a0d1116456aac2fc27acdbae46080a9a91d845637ceea440c111bc4c73075bbbded490e05fecf1cbfa7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001058, "uuid": "b2a071cf-6d4d-4469-af9f-2c320bb46da2", "value": "T188930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001058, "uuid": "dc52eb9b-6e4f-4ec5-9883-30257bacf9b3", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yen:68NUv5nTacgzafVAwe4BNRIbT2gXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001058, "uuid": "35cd892b-f729-4f6e-9072-2d48d9cc5d52", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001058, "uuid": "55ae189f-6617-4df6-aa47-6887d1000687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001058, "uuid": "ba8c91fc-c774-4892-acc3-a3c8df7d8a02", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89c7c83-125c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772032567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032567, "uuid": "e959301e-8057-440a-ade5-b63295ffc986", "comment": "Malware payload (Mirai)", "value": "0e589742ddd2770af9d0bbc43e7810b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032567, "uuid": "13f65512-3d6e-4092-b4b9-35581c40e5b7", "comment": "Malware payload (Mirai)", "value": "58e129292be4cf3fdafbc18e098b489fa88a517b557a6a78373a0802d0f44274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032567, "uuid": "36188835-ab86-4307-95fe-41799ccb7258", "comment": "Malware payload (Mirai)", "value": "ef3eb5f53dc149d1cf657d2d3b4a24627392dfee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772032567, "uuid": "36c05ceb-f78c-4517-a4a8-0d7f60ec7ded", "comment": "Malware payload (Mirai)", "value": "2f16fb4d4b4419b6037c495d03371c5a121d5b23e68d36689e817e20837f1cdf5081d09b89cec6685188fdb4e4627c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032567, "uuid": "0f4cc3ab-d611-41d1-bc92-8b7588981fb7", "value": "T187D3E1DAE8C0DB62C7D12A7BFA4D044973170769E2E9331389149F2927EB52F0E36945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032567, "uuid": "cb56a5e4-751e-4277-afaf-143867018ef6", "value": "3072:foTTImvmBwUAySsK9oXTmZ/wxb/xQaJVDjQpfr4WkSk1pIKJ2hN8:fgIwWwUfooT9ZFNSTjYW42Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772032567, "uuid": "3608b051-2754-454a-b347-2444f692983f", "value": 142204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772032567, "uuid": "3be610c5-c594-4a6d-95f6-cd7c2035d7e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772032567, "uuid": "07ab9eba-91a4-4782-86c7-967dffe6f471", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90816e1-120c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998181, "uuid": "7d6f23da-722f-4f9a-be55-ca1aac8a5c1d", "comment": "Malware payload", "value": "23366ac08fa76f237ba90b3373e6cf91", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998181, "uuid": "26a07dd3-efae-4e10-9941-9006416e1e03", "comment": "Malware payload", "value": "590dc2abf6ed3bedb69b268c3f13b2b09e38aeb771846d21250364c185574d52", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998181, "uuid": "941ead2a-71f1-4989-9e6a-5536599ab411", "comment": "Malware payload", "value": "f77499a8fc6e615e21bf111a88c658ba3d5f0f81", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998181, "uuid": "827c461d-368e-401f-b814-386046df10b5", "comment": "Malware payload", "value": "d3ff243c4d68229edd393043c8354dd36d91d18d4e97eee967e4d0e8b9f22ed3db3e095be4c28c91f1013d206776eca6", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998181, "uuid": "cfdcb2d3-9e39-472b-8491-164fffa0c927", "value": "T1531602A0D55A8B92F063D4BC51D4B9D204363E136AD80CE1E37F2A089FBF8B66655F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998181, "uuid": "e5429502-b2e4-4733-a814-d43b177b12fc", "value": "49152:OGuQkxX/sbI4PcKKQ5GrRfFN1Rx/RUqTK/osLhjXEKg4DUL1Eu4mJEKeF2onwcp8:OGuLx/fXNHjJU9/oshY7ZgNFwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998181, "uuid": "e71ca69e-9251-415b-be87-8cff8b07a83a", "value": 4046848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998181, "uuid": "90b136d3-0378-44ec-8856-bab110f8a6fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998181, "uuid": "f9ffaaa6-44b5-47e3-b5a5-566f2ac0c210", "value": "590dc2abf6ed3bedb69b268c3f13b2b09e38aeb771846d21250364c185574d52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce41f53-1282-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772048761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048761, "uuid": "e6ef068d-7ea7-47e3-bf22-887be46d365d", "comment": "Malware payload (Mirai)", "value": "6c21086b3ce157d1265f2256ebcac73d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048761, "uuid": "89f03d71-895a-4eb9-b602-cf23f96c310a", "comment": "Malware payload (Mirai)", "value": "594a5a7ca7627522f05dbddbaffc28983a3de9663778f5dadb57fb4572b270af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048761, "uuid": "98c8751f-e968-42d1-bf99-386f6068d763", "comment": "Malware payload (Mirai)", "value": "87049ec4d7e9fbcb32fb18b839c58428c9c892ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048761, "uuid": "22498781-ab81-46dd-9216-05594e84bba0", "comment": "Malware payload (Mirai)", "value": "aac6fcf0887a50ac6f87804667464654c3afdd5b1c829a24d6663418e40fb6c3425d9e79ca3a756d27b187dcfad80d47", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048761, "uuid": "996dcaed-4913-4207-b5cd-474ce1bdd784", "value": "T104011E8D2BE5B1879A2C8E18F26B825C794086C870700D55F23AB87568ED2107CE4FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048761, "uuid": "efde7b1a-6ba6-400d-90e3-1125fb922221", "value": "12:3J3NLqQHjQbNIl5zAQI0LKjQvOsQjCQN/QuSEQntaKAQhiAQrfAn:3J3NLBuNI7nKq4rtYtBReA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772048761, "uuid": "2e7a152c-ead5-498d-9525-d162ff4d1f40", "value": 696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772048761, "uuid": "0c5080d4-cbab-474a-bb82-8e71aac31297", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048761, "uuid": "feb98889-15f0-42c5-8985-0850a1cd5f23", "value": "abc1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ba7415-123d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772019078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772019078, "uuid": "f236699d-397f-46a1-bd44-417e4290ba55", "comment": "Malware payload (RemcosRAT)", "value": "420033d2a5d35d52d7729d49f5933d0b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772019078, "uuid": "50cd54ed-e2cc-49b9-9133-d49af2cde911", "comment": "Malware payload (RemcosRAT)", "value": "5a2ec2eba92c9ccbfba162ff3d8b7e09b14f93903d8da795380aa4cb3adf2e17", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772019078, "uuid": "031e3896-7195-4610-bccf-8aaa3f25e1ae", "comment": "Malware payload (RemcosRAT)", "value": "e4531b19f74a561086a1ead90d60cf853c90b4a4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772019078, "uuid": "1a16d5f3-764a-4a19-b81c-30585c11ca78", "comment": "Malware payload (RemcosRAT)", "value": "6ba8bcf7905d3c339ad40d154e07b73d4e17cedd005e2fc6d663510b64cac6a63f1d90f1e9767d80a13139ecb3110fc0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772019078, "uuid": "bae3737c-19f5-4225-af60-ee662d4b7aa2", "value": "T10DB20A6A859A0FF48E1B33BC5F540521673A46216936635BB3C91A4D2F024ACDAFC3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772019078, "uuid": "7ff7ba50-fffd-4b6f-a5fc-4ae813952a47", "value": "384:kbLb9HQXMLqcSvVazOyrdbKtnzctYNII0L8c15/G4iwWUhPPNasxMbuZ7vstXcps:EdHQcqVazOypTIu8ocUPz7EtXcfyy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772019078, "uuid": "4405886d-4ba5-4152-926d-d1b98f650abe", "value": 23567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772019078, "uuid": "b4acef15-86b9-4c94-9777-32c8825f09a3", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772019078, "uuid": "0d18f235-dea2-487b-b8e9-c73564da7517", "value": "rAWB880081422741.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff37020c-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012848, "uuid": "82bb5cb2-6ebf-4c42-b279-a9cb486da60b", "comment": "Malware payload (Rhadamanthys)", "value": "7b96731f6a823caea2be56442d208d82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012848, "uuid": "12992c3a-d63f-4552-8196-e0c52a65d2a5", "comment": "Malware payload (Rhadamanthys)", "value": "5b09f16d390daf461ceec84c95f33d1bd7bfc63a329fdf8e3525af929b49696e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012848, "uuid": "9ae2c757-fcb2-49dc-8ea6-ce83e0f9de4c", "comment": "Malware payload (Rhadamanthys)", "value": "b4d32f79469d8648f15a8c12aebbfc9d6341e116", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012848, "uuid": "2294850b-b742-4ec6-9823-53395928f523", "comment": "Malware payload (Rhadamanthys)", "value": "c19ef36e3cf7f5c258cf30aaad63efea7a4f82f1c612bac1f5889fb3b809914aa281b0cae72f3980e5f41c7d335e294f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012848, "uuid": "a0cd5e76-a47c-49a6-9502-545bc4dcd6f7", "value": "T1DBA33CAA4C73B6F2F4436791AEFE4138884E76C459A721CDD506FB148178B7C68903BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012848, "uuid": "b05b20ef-d9a7-4c61-bfb0-02e8b08f35bc", "value": "768:GDhd0i7J4sYKgY/CMNfWdnPtvZ4DrXWNrr96XccH1Tf7KAiAvKmOrSLAuAAroQWK:GDB7eKg20arSrr9ipSAefr6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012848, "uuid": "62a86d11-1c8c-40ef-9a87-0f01e19bd596", "value": 98129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012848, "uuid": "d8071e67-2d24-467b-a04d-e38a0db5d3e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012848, "uuid": "49dd4841-eb0d-48d9-85bb-fb2170f72a3b", "value": "invoice-1637482117.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f42224-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012827, "uuid": "fd327b68-6a3e-4150-a90b-5313c9bfa0a2", "comment": "Malware payload (Rhadamanthys)", "value": "511d4a92d119c8a0003e58d49f418044", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012827, "uuid": "32b6923d-ab02-4251-a9d2-9fb714fe0d52", "comment": "Malware payload (Rhadamanthys)", "value": "5b207d7fab847db482382a8c541fd798ba502024dfbada3521f7fdf8c2713f3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012827, "uuid": "10d91fe0-ec6f-420b-b035-d48e6481a74f", "comment": "Malware payload (Rhadamanthys)", "value": "cddd524ef4dad0e7be267eec0591f2e7e9c58a86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012827, "uuid": "db01abcd-25f3-4de1-9b1b-cbb5008d189d", "comment": "Malware payload (Rhadamanthys)", "value": "0e58c6fbd685f2f802bb2c5a57b420e8dade6ac2b69a40cf9863d0b6673c52e931a57c5032a488fe76be609d28c8ebcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012827, "uuid": "888dcfbc-a6ca-48fb-8af7-74fc37973fd2", "value": "T133A3E9580D83BDC9144E1F21EFD111F0DA2B24EE6F04A1D9C631BB92EB9D71A498DE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012827, "uuid": "847f4132-56e4-41f6-8dcb-19f74e8da2fa", "value": "3072:GDB7b06GRStMy7XKx17WKRsuYmdluUq2Lm6Osk/uqwJl0FcIFxC4xkg5AQJefXXg:0NGRStMy7XKx17WKRsuYmdluUq2Lm6OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012827, "uuid": "bf6bcf9e-3baf-4d36-844d-4abb15b75295", "value": 99425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012827, "uuid": "0280c0fb-5a4b-4615-a23d-1c5da848b5e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012827, "uuid": "311568e5-f651-4b69-b54b-56b88883c53f", "value": "invoice-1637482117.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952d3576-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001074, "uuid": "cf930e8f-d4aa-472c-822d-b0aafff2cf63", "comment": "Malware payload (Mirai)", "value": "fe89b23c92efe23081cb940c124e7b99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001074, "uuid": "b5ec8dc4-0a37-4f46-a5f7-dadfeba8c58d", "comment": "Malware payload (Mirai)", "value": "5b3dce5e66f16d232532c34188f6cebebc0fc5b987bb1d2a426d92d148a706f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001074, "uuid": "0916ff30-a5a1-433f-b2e0-f55cb8ada4c3", "comment": "Malware payload (Mirai)", "value": "a7fdbbada02e2ee7b8e2fae4618007cc0f97f2dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001074, "uuid": "41a18f52-38ce-403d-8a61-149dc8befbdc", "comment": "Malware payload (Mirai)", "value": "9bd75784c224d0692828514882a83af6d4f0e5059a1379aafb645446bc7c6d892b429a61e56adddbf1970d0c976aa5df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001074, "uuid": "37b58372-168a-4288-ac7a-438a335c6d81", "value": "T11AC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001074, "uuid": "58917851-1d87-49e7-96af-69ddd9e77335", "value": "1536:6cB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dIJ:6+B4exMF7oZKJnCNYaaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001074, "uuid": "cb781201-2710-4c47-b14c-a271e575d536", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001074, "uuid": "fcfaa373-7fdf-450f-a672-e4fa427212af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001074, "uuid": "caa10371-89ae-437b-9c02-c39262cb84e6", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130ee472-11e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771981958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771981958, "uuid": "e2d49341-8c96-475d-8037-0c0ed2a229e2", "comment": "Malware payload", "value": "381701c19bf9be7873e8a0196049a376", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771981958, "uuid": "8a4588a5-7403-48db-91fd-1a5ee5967081", "comment": "Malware payload", "value": "5b7fc8c557e347bb25266f804c45065e795d60f5c0e8f313171bb333485bb0e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771981958, "uuid": "23552713-db5e-43b8-8993-91eb746ad301", "comment": "Malware payload", "value": "4026d50bef1ce61e7cf0f8e522963afb9e200ec8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771981958, "uuid": "8147d2d8-3aa6-4ffa-9432-bd89bac6d916", "comment": "Malware payload", "value": "f9dbd7a20a93587e077ff5477fba19cf319453884bd04fa7712d48f492aedcad50fa993861b50931642e8f3429174025", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771981958, "uuid": "257e7e73-101c-4cec-a19f-25e44549db7f", "value": "T104925BB906497C79BBC1CE799F3C7F0CAEE482C42128E39DBA1F39705A2165DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771981958, "uuid": "1e9a3463-b180-410d-8fe7-c6dc3ed39861", "value": "384:w0OKncuxOLnVYMS0pzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:vuuQL+2zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771981958, "uuid": "0be8e338-b258-4ff7-a2f4-698501047dd7", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771981958, "uuid": "be6c6a5d-f89c-498f-b0a4-4f7856cf62e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771981958, "uuid": "e55a126e-7fb3-4f99-9290-74bec3ed9a9b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6682ddd-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034630, "uuid": "82670e6d-9a3b-4f0a-b180-10303574ee31", "comment": "Malware payload (Mirai)", "value": "f0c2ab1b15d93681e596e29a70d5e76a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034630, "uuid": "3dec73ce-903e-497a-b5bd-2f73c87a15b7", "comment": "Malware payload (Mirai)", "value": "5be1f5f771b224e2683f3eb044f74dab4b32e352f8243903ef4c06d25af81979", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034630, "uuid": "048cd509-3bba-4374-8e73-6b6d755ece29", "comment": "Malware payload (Mirai)", "value": "408bb71817642a436ac96f8e1fe5c6a8ba016110", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034630, "uuid": "2041d5c3-1aad-41fc-84b7-83047268d457", "comment": "Malware payload (Mirai)", "value": "ab7ca95d4bcb0c45b9a349ae9e6ac9b9c093600afa3632360bbb63a2214359285ce24219a88512f83f5b7759dbe5abfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034630, "uuid": "4d6018ca-dbec-4a35-8d90-a95806caa075", "value": "T14331F74F03628EB1D76C48A5A79B9695DA034153101CCE09F79DAB8CBF74158F88D387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034630, "uuid": "c5583e05-81e4-41b8-af10-510b9bf299e3", "value": "48:ceSLRCBMdQb9AAXNq4mLJL8LrLzpYlcDs79szNuU4wh:6LRvaDXNqLLJL8LrLlYlSsyzFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034630, "uuid": "a848e4cd-ded7-47eb-ae50-29901dd614fb", "value": 1669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034630, "uuid": "b4c732ee-5060-458f-b341-5244acac6f8d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034630, "uuid": "21cf2dbc-d9e2-46dd-a3f8-9d8be9e670a6", "value": "bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ef41cc-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051516, "uuid": "a42faa06-b874-4f1b-ac49-d414287d071e", "comment": "Malware payload (Kaiji)", "value": "2cc2199732190882f9e0c5917e6aea49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051516, "uuid": "971e2e7f-b616-44b0-bbfb-a061e015e88c", "comment": "Malware payload (Kaiji)", "value": "5ccf94bbe46f8223dad2756f9dff11086c841de9c423977e3a1b65f1fc1d4c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051516, "uuid": "13caf274-8759-40b9-9b0b-b6147ccd97fb", "comment": "Malware payload (Kaiji)", "value": "9b091c2c062dc88393d14090ace778400821acbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051516, "uuid": "ad46d36a-916f-4c50-968d-8f733d9a5865", "comment": "Malware payload (Kaiji)", "value": "9ab8fa866dd29e8e02e44b06a7e398a5adec4ad053c633f26ebbd901a5fe6b09a2162b1053cc84e4083f9471258248c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051516, "uuid": "9ff390ec-5c96-4a97-925a-50d02f9ef029", "value": "T16556E704ADC56BA6C06C9B7584EBCE9523B06D044AF12B271664FEDAB8762747F07CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051516, "uuid": "cb7b84a0-5600-45d5-8e38-cd59ff021901", "value": "98304:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iW5ay5mIOX+aaNcc8pNkxXkz8xBs3K4HUo:yC91hAFxvW6WGVqq7g3JDCg76dAuE8ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051516, "uuid": "e6e46096-f388-4a39-b61f-c2e86ebab1d8", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051516, "uuid": "c90c565a-e7e8-488d-a216-b327994a1912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051516, "uuid": "5db54a1c-eb51-47e0-a249-641b24a6bce0", "value": "linux_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f6ed14-1235-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015537, "uuid": "2540f4a1-00b4-458a-9d80-aaceb84ae385", "comment": "Malware payload", "value": "7ce4ffb69acf20128404e0d1e925c2d2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015537, "uuid": "e5608d2a-aa35-452d-9c8e-4d69e0def221", "comment": "Malware payload", "value": "5ce46adece7af0b1c8adb80ab0c14850e095318d0550a795b820fd4219692303", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015537, "uuid": "b172f0c8-8bda-40a6-a482-ce5ef439d32a", "comment": "Malware payload", "value": "55db82eba283ee206326b96ed78c67aaabf8b892", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015537, "uuid": "74c0f94e-0cf3-4db1-aa1e-a39471c69388", "comment": "Malware payload", "value": "495b383b13a02789dbeadc2568d85aa4e98c299d4b24b1ca95bd700a047b6f2d88908103c8b4138eb6dbd60cfdab6783", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015537, "uuid": "f440f1df-2814-444c-b4b4-d18591e9ded7", "value": "T170D0973B02914778CF74C04229BA03CBE4DD206F40AB7A150CB04518BA60AA22FB0837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015537, "uuid": "578a8bf5-c4a1-4793-8d87-ea6f38f7cf64", "value": "6:IPeGgdEYxDOrbPyMGixkRIMUsaAUfwDOrPr0zcMhW6MF+:ISu2OiMGiexUNbcODrK9hNMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015537, "uuid": "5204ff67-fb6f-4161-b430-cfd49b683537", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015537, "uuid": "908cef17-1fd5-4519-83e0-4d8ef325d9a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015537, "uuid": "649b0a5b-8a6d-4b9b-9382-b501bdf2e5c1", "value": "exact_bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd70d875-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017462, "uuid": "7d51426e-304c-4093-9a73-1f66a936d48a", "comment": "Malware payload (Mirai)", "value": "a1996cb2483754333e4ace3ebefd7ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017462, "uuid": "21641df8-363a-4ae6-bfaa-a1608ed05d6e", "comment": "Malware payload (Mirai)", "value": "5dc8e69dab8a17a4b30919c39b866412f8cd13a531bcbb20add33fb288387088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017462, "uuid": "0aa7cef5-dca6-49a5-a0b1-d127e17a7484", "comment": "Malware payload (Mirai)", "value": "b01f1cb54a4260c2a126c66e8f1e183e9bdee509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017462, "uuid": "41ee545e-0b96-4892-bdb8-c631afbc13e3", "comment": "Malware payload (Mirai)", "value": "e56ca4604ccb2992f6a79e806e7a34a0a7c4c4a007945bee0c827ac4fe6b8f2b6626c085dafd588909e70a5982c0d1fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017462, "uuid": "3e292e9a-0926-4e11-9b88-dbd8076bcca1", "value": "T14B63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017462, "uuid": "75c2f2aa-7052-42e5-8a65-93d7860cb312", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAC:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz5L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017462, "uuid": "dae9fec6-00fa-4fbd-8d70-dc5b4683845e", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017462, "uuid": "6abf8935-fd4d-44a7-b769-8796ce8fa9af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017462, "uuid": "71e8fb54-1714-4aac-a3cf-5b036eff8c6f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2563d720-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051567, "uuid": "7ad3a21b-f5f6-4ed6-a8e0-014d7f2d10d8", "comment": "Malware payload (Kaiji)", "value": "289ff2bf6362309b5d2fb048d72250b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051567, "uuid": "2e9d2d95-4800-4b45-8a63-18cff07fe489", "comment": "Malware payload (Kaiji)", "value": "5e822c77ae8d818d84e5281cd0d50b3fc26965f99efec9e058b8721018816059", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051567, "uuid": "f1d4448b-9167-452f-bf9e-ff471bea662c", "comment": "Malware payload (Kaiji)", "value": "9ad60686ebb703e69fd64036c63d7d1c0ef376c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051567, "uuid": "d2712de2-84d1-460e-b4d6-691b998136ff", "comment": "Malware payload (Kaiji)", "value": "7e8b9e4156f651432a508d0ff82e75ec96a179a0395274f2595dcb2f70966f74bc00959d5c7ae89802dad75fa597c65d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051567, "uuid": "585ada62-3860-4beb-999e-44d57f9d1b23", "value": "T16D5627037E18D71EC62922305DB2CAD4672A3C8546DB9613B391F31EB8F11AC696EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051567, "uuid": "3c49394b-5f26-40b4-9a1e-1a05693bbb9a", "value": "49152:H2EpH9kX4nazMqH5Erob6XMv7fn3FuL9idt42uXYfTYetBDa9zrHAMnlHsLFnoeF:WEiAQcMZudhDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051567, "uuid": "7974101e-4a9c-4ff6-b6e8-ebf0aaafe9bc", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051567, "uuid": "4bf55555-9866-4698-9fcd-8197be4fcb65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051567, "uuid": "e971a929-0c69-4630-b2bb-62f54cbd811d", "value": "linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a6a2af-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051539, "uuid": "ceca4908-3b67-4588-b790-e86eb7e2e7c5", "comment": "Malware payload (Kaiji)", "value": "29824bf5cdfbcb114a68c5e38717f58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051539, "uuid": "9a001c62-a6d0-49d8-be19-1465e0ed277e", "comment": "Malware payload (Kaiji)", "value": "5f1f98503fc0534321f0a96e7c51ff977d3ccd1af0653eb83707c427dc08ab5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051539, "uuid": "b554317c-9e36-4804-8694-73500ae3776a", "comment": "Malware payload (Kaiji)", "value": "18c4dd1701080b7e86953b98e2fb658c043edf00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051539, "uuid": "136d86df-58f7-4782-a5e4-84e1413151be", "comment": "Malware payload (Kaiji)", "value": "02ca774ff6fafb5946aa0821639a4d73649721de36cff02fd578f6d91938a628169091fee6927f8a30a4b6f9ec0cce5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051539, "uuid": "9a52b599-a01a-4117-9c1e-69075a5e1387", "value": "T1C9560912BF58ED2FD25421308BB7C23433D53D1482E16533AA56F71E2EBA2B5991BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051539, "uuid": "70169a47-1914-4c75-970d-6d4afdb7041e", "value": "49152:XralYsYZ/MjJ7fhP2pCQLg1xbnZdY3MniUj0E/GiV:Xr9lMjJ7fYjWjV/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051539, "uuid": "4df507ea-0e1b-4d39-81d1-2cd23a7ef940", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051539, "uuid": "20cb2bdb-fe97-46b1-8f28-1c68a5dfb0bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051539, "uuid": "7717fa8a-2496-4106-a7df-c59274b285c7", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab10cc1-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034611, "uuid": "0c3c3437-c737-4f84-b2b5-f73d787cc045", "comment": "Malware payload (Mirai)", "value": "1d7573d8d0902a180580592a742791d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034611, "uuid": "43ff5abc-7527-4d5c-929b-0cfab37a27ab", "comment": "Malware payload (Mirai)", "value": "5f4f937cfaab23ad7bf56c75782ddc21d1fca4397cef230c526186b461a160cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034611, "uuid": "f9e4025d-37dc-46fa-9904-a2c8e2eb28ac", "comment": "Malware payload (Mirai)", "value": "5014a5f70f89802036134b48783a91d92b1363ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034611, "uuid": "8db729b7-915d-4393-a1fb-7807ba1c81a7", "comment": "Malware payload (Mirai)", "value": "8799692116765263f5aa97953a7869470d0111154b06c5b04c48b7ed2e20828aa573a50ac9b0c4d439adf3afe680f9c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034611, "uuid": "e9ee8ea0-4189-4523-914a-c881bbe42974", "value": "T14FF2E851B8854727C2E4137AB6AE5A8E377077EC92CBB627D8224B203BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034611, "uuid": "ed509af5-c0d6-442c-80e7-3c1a0774f266", "value": "768:NxEOIXqioG5M1IuBHGapwm3ipteV5La9hKFvl3RyzXpocntqwn:NaqpG5MJxGaWt6aUtBOX7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034611, "uuid": "8a467b53-fe24-4d91-95d2-803a701c8cf3", "value": 34872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034611, "uuid": "5ac95929-5032-4f2b-96f0-7f85984c770f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034611, "uuid": "6a8590b6-1e71-448b-89a5-7da9aef65232", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b714ba-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772029957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029957, "uuid": "7ab7a6fe-b06e-4dd7-9878-a4a2b945c937", "comment": "Malware payload (GuLoader)", "value": "e44d835c097c09d0d125717074a57d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029957, "uuid": "f4123e24-2c63-44d3-a3af-a702565d0654", "comment": "Malware payload (GuLoader)", "value": "5ff84b7c231f6c4cb4a2377ae60e07cc6f6062a32c5a7a7c7b0396d599b7e1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029957, "uuid": "cde06283-f5a7-4ce3-af23-fb08eb880082", "comment": "Malware payload (GuLoader)", "value": "2a78fef5c9088b2fb424d1ecf82826c54accad1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029957, "uuid": "2110db90-d404-4606-9104-4bde355608d1", "comment": "Malware payload (GuLoader)", "value": "92609d2f64f24f1790887ce0e07aaab69a85acf8db8125b3efaa4972760573c288d2585a916d0c28b34020a500fee214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029957, "uuid": "9a52af9f-6aac-4ec8-989b-be95ba400cbd", "value": "T1031522006AA8E4A2EB1012B65C77DEF92B863C1844F0A55713F93F5F3DB6793513A62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029957, "uuid": "6ce9b497-7ade-4b97-bb81-3456740d0fc3", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029957, "uuid": "5ce50a80-d3a8-448a-b0c1-609c9da5450d", "value": "24576:dadWcJwzsRot9/fUzpNVIDN4PrUhp49ZUdhP3gTeye6rP:AWcJwzsRahfUvVMaL9ZUzoimr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029957, "uuid": "8a8a0061-acd2-4cc8-af3a-03cf4ff08b95", "value": 899336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029957, "uuid": "4bf3aa99-67a8-42f3-9fcb-306cbb9f8c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029957, "uuid": "ae72b782-ba99-46b0-8187-3cd4609fff12", "value": "PO 8940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc909f62-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012790, "uuid": "2e25302c-8e28-418d-aade-d6ae8b3eb8d1", "comment": "Malware payload (Rhadamanthys)", "value": "06b617d8d6e15e09828f67bd08d89b46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012790, "uuid": "d750a09a-654a-4496-8ca9-23ba9f032cfd", "comment": "Malware payload (Rhadamanthys)", "value": "6022af10a310e0b14180998aea1672b116e4e34e175cfccc64d7e7e5ab9cea86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012790, "uuid": "59f3b421-08e8-4658-bda1-9b0c69b6a80a", "comment": "Malware payload (Rhadamanthys)", "value": "274a79335badfdae7138756b79be968d7c835c84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012790, "uuid": "5c8a2a48-81af-478a-a08b-947aedb695fc", "comment": "Malware payload (Rhadamanthys)", "value": "c0b2af6947ebc59ffed49f330eb26949c61cec3122349d932577200cc2dea26e5c655ecb9174cc23530348a1d27efe07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012790, "uuid": "e8c5f62e-9918-4c9a-9b06-1bd31d2f5a6e", "value": "T188932A803C07FEF8A089F3A25B4949F24E669D25D3D8114A9A0FF7F96239F5E440A1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012790, "uuid": "90425e36-e422-4e23-b607-6d3f3b82f8cc", "value": "768:GDhd0i7J4sYKgY/CMNfWdlXTC5TGwgErWtZ+R3lOoV4mGg+sl/c5gwTCp+KpN7kq:GDB7eKg20rrsrHT0ThA3U76BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012790, "uuid": "7a953b71-5c36-4ee3-984a-f2b880635b49", "value": 95513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012790, "uuid": "3fda7f38-5f89-43f6-8275-4d0969b652dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012790, "uuid": "4cff6da0-07cb-4b16-8717-6ed6ac815232", "value": "invoice-1637482117.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2423e351-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012910, "uuid": "b20bc313-fe1f-41f2-9fdc-66324852c749", "comment": "Malware payload (Rhadamanthys)", "value": "b9d74c61bac53bc80afa5984fbb41b2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012910, "uuid": "88e3429b-743f-4c5b-8aa4-04923b183228", "comment": "Malware payload (Rhadamanthys)", "value": "60bbc3d9962cbb0736e35bf7b103f5f5c7d1592bd55b19ab91868fd0fa1a1969", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012910, "uuid": "3a4af04b-55b6-4f13-818b-1429c7359f34", "comment": "Malware payload (Rhadamanthys)", "value": "5b70e16f02190a3b6c6d768a427feed9059cf6af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012910, "uuid": "a41a446d-5f78-46c8-b559-15d62795c860", "comment": "Malware payload (Rhadamanthys)", "value": "93f0d7b647641ace778ebdac7659ddfd1878f0b679133eb8e73ded9d17721f35b4fffdcb627082396d25fa8ed86c8a58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012910, "uuid": "5e73f621-aa20-4ae0-b0ed-6617abe9c8cc", "value": "T11EA30A611CD3DCC94FEAFC343AA50EF9D44DC09440B92659AB2AF7A024791BD346E2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012910, "uuid": "1dddf967-0ada-4921-8003-275474bdf1c2", "value": "3072:GDB7b09IMhN7G38PsBaYbutcM2u68wzqbu41gf1RMNe+TFQhSq0c8ONnkOyTDA5h:0YIMhN7G38PsBaYbutcM2u68wzqbu41W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012910, "uuid": "c4b87fe2-684a-4142-b7f5-11bd01620d16", "value": 103417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012910, "uuid": "2252c352-4934-4319-a499-b2720a3c1d0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012910, "uuid": "6ab9fbdc-0f32-4258-a27c-5ba8262c1d8d", "value": "invoice-1637482117.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33407453-1288-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772051160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051160, "uuid": "d8839181-871e-4dad-a146-e9d94d85e01c", "comment": "Malware payload", "value": "5a54dd8cb5b26d89775642a7359aa2a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051160, "uuid": "ef7c7a53-1038-486b-9aaf-e76adca83caf", "comment": "Malware payload", "value": "60d47512e0f10a98af2d01362cbc267bbf5d9f69e59fa688cb4bc87d5f865c69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051160, "uuid": "07f6b020-cd2d-48f6-bc80-3104470e47d1", "comment": "Malware payload", "value": "cd4962d86e5c90a090c6dd5291e75cd05d017d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051160, "uuid": "295492b8-be38-4cc6-9423-9c89fc8c1105", "comment": "Malware payload", "value": "951c024a7655686bd68573f47fd31867819a331337b5444a076917b10fa5ceaf87027fa117022df3035384b90fde77fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051160, "uuid": "a2d8214b-098c-41df-8efa-af5ed3495e30", "value": "T1B8D3E169F480DA73C6E0117EFB5E124C732207A8D3D933559D148D2873EB96A8F3B986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051160, "uuid": "7112d4c9-7ee9-4cef-9498-b3ab5770ffb1", "value": "3072:rponhnSMawenirHi8BV6czGbUGe9fiVIwbazsFCJ3tCR62+6KpWY:rUhSjwenip6kGYV9KV7esFCJ3QRTuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051160, "uuid": "db08c7a9-bc4c-4322-bfe3-d5e3f79d60df", "value": 141446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051160, "uuid": "bd229200-e750-4159-b227-326c42a30075", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051160, "uuid": "83a44183-faf5-4d65-b7d5-6bc9cbe35602", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e9b2e7-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772051811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051811, "uuid": "90108440-4545-43c0-be6b-5abce35cc4ed", "comment": "Malware payload (Mirai)", "value": "b852653ff11bf109654db48494bd7774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051811, "uuid": "adceaf0d-fb1c-487b-b5da-1961be07d8c3", "comment": "Malware payload (Mirai)", "value": "60e246f7766e7a1cd0d9dd64af84c5510fdbd978377bb860909ee272f5a904cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051811, "uuid": "d630a055-7221-410e-9858-e6a44c94a839", "comment": "Malware payload (Mirai)", "value": "4d3bb66b4ee67b68ee4587c02c5eb23f13be073b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051811, "uuid": "e9a0d789-077e-497c-93d6-630fb04b8964", "comment": "Malware payload (Mirai)", "value": "5dc2720462f30c9ff95a9aace911c5e7b859fb7a5a2e3c34c5e7d28bc23581f225ab7f8dfd924bbed89731ba5196a205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051811, "uuid": "81cf7b32-2231-43ac-a12e-5493453f0efd", "value": "T1C7730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051811, "uuid": "dd2e00e1-491e-419c-b8c9-67b39298cca0", "value": "1536:2ln25xPBXk1wnnkL7+KE007I0RMqai90DIyiUNbsvHTGcV5GYIW2:7xpXCMkM/TTaFNbsvHqcVERD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051811, "uuid": "6034dc75-ba82-4c1a-8fbd-54645ceccea6", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051811, "uuid": "84274234-da0c-4512-9f2b-b341f061effb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051811, "uuid": "fd0959ed-9edb-4ed9-b5c6-452fe125e43d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2dd8ae-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991990, "uuid": "0db80c05-c349-4b22-be7b-a809fa90d47d", "comment": "Malware payload (Mirai)", "value": "d485bc880b41303684119560b949ef72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991990, "uuid": "663f188d-5151-45fb-bb9c-89a604cbda47", "comment": "Malware payload (Mirai)", "value": "612ab7893f37c222f1c10ffa8139b0eb6a8e5dc156e699752f8c7a41d29d1f3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991990, "uuid": "f70fd019-5f94-4bae-a843-19f6747f0a2a", "comment": "Malware payload (Mirai)", "value": "7926c3c3eadc7ce8ae46621994c6fd295aa928e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991990, "uuid": "eb505b43-9afc-4c1d-b2a1-bf8c09fe8c62", "comment": "Malware payload (Mirai)", "value": "1cc00c5c10d1031d4ac0b3d4605546ff631f230cbf7fdde5a78de2afbba733ca6cefc03a5ac73686869d5ae7e5298931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991990, "uuid": "91194619-7a73-4eaa-9def-65e0e7756f81", "value": "T1B7E38536A7215EB7D81ECD7301A585121C8C998712E92B6FB274E61CEB7BC4F08E3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991990, "uuid": "b9de5b0c-a304-4da2-bddb-31bea8cbe3d0", "value": "1536:a3ZG4ejPnS3c+oT/rrVFwvmwpLBMdH4p4NHAg8L59/Kq0KLIRtCDv:rl0bpR4HCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991990, "uuid": "860fa7ba-fe17-4532-8798-139ae36898c7", "value": 147728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991990, "uuid": "dbe04403-9be8-4d85-ae43-3bae53d7301c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991990, "uuid": "ec5b22d2-455f-42bf-a7f8-c66ee5ce26e6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf80777-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012814, "uuid": "d0682faf-4d90-4f8b-aaeb-160609c9c121", "comment": "Malware payload", "value": "4e1030a4330b63772b52cbbd8588a6d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012814, "uuid": "5242b221-0647-420f-9ff8-b948a81a6c7f", "comment": "Malware payload", "value": "6188c677f790327d0c49e987bc91ff8f5bf6e5fd3588e8a55e5e2180e2681217", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012814, "uuid": "91df1bd5-9801-4e57-b1d4-10491fb53b22", "comment": "Malware payload", "value": "a865c77cf5ddd8f69b6aa3657ead94b84d628aa9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012814, "uuid": "45fe015a-d078-4f04-99f5-9ad13ee9f16c", "comment": "Malware payload", "value": "ef546a61848ddc5e09f89e6e6f12bab26e72f024f17536875d077fdabb4240c84daf5baecd147f5d51ea5039ef14e4ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012814, "uuid": "052216a0-4e13-4560-bc12-d7d942e07280", "value": "T1EDA32A187A93BC90125860F27F98346DEE5D81B9D46F20504CAF7BB0A458F1FCE5C6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012814, "uuid": "4c51021c-4263-4e8c-adb8-9347f4e323e7", "value": "768:GDhd0i7J4sYKgY/CMNfWdtEMftZkXXmr+fJHoeRwiECplAizjijsJ12H1x/aokSC:GDB7eKg20rr/rnz4K0AzZd6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012814, "uuid": "b388b394-0c3b-47de-a29b-586901e91298", "value": 100595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012814, "uuid": "ae87e3ab-4ff7-4f31-864d-9e2112a07f6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012814, "uuid": "5679a270-241e-45ea-a22d-3f81ae8095a2", "value": "invoice-1637482117.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d90c2ee-1265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772036253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036253, "uuid": "703c678e-bce9-483e-8ffb-1cc89d2ba74d", "comment": "Malware payload (Mirai)", "value": "998c7e271432a9405051ddd1d778cac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036253, "uuid": "09166303-a78b-4b7e-82b2-3a879ea987d0", "comment": "Malware payload (Mirai)", "value": "61a093eba0b6f69662b6c385ebbb3566f483d90a1000f27cc62674fa1cb67bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036253, "uuid": "a74959df-01b7-4a6f-a779-2b16b4b1d89a", "comment": "Malware payload (Mirai)", "value": "bb4ebb5a94e15c1840e6305bdeb156b2f947e02f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036253, "uuid": "5d56559c-7437-4a93-9b86-8a1b0f2a3278", "comment": "Malware payload (Mirai)", "value": "09fcdeb9a7035564cbee14f48783126c7efcfd0aec897d0e39925f1d7b92cb073be40204e5bfcc6e170e18ad5ab1e073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036253, "uuid": "329fade2-c18b-4824-8ced-5628f5716c12", "value": "T144534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036253, "uuid": "cefd4498-613f-4a88-97ec-ae145a431a81", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQNLiKimfFoktCe3fYRMY:WShU3q7cEDlCK/0DV9i8Fok06fYRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772036253, "uuid": "5b66eab0-078a-4d50-90d1-b9314cf45d95", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772036253, "uuid": "f9a68f63-dedf-4e62-8df7-59cd133a1204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036253, "uuid": "55f86e5d-85d2-42ae-a2ea-4ae8120f3d45", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ba1068-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045603, "uuid": "70fd70c4-aedc-4b14-b6c8-a6f71614371b", "comment": "Malware payload (Mirai)", "value": "ff18cc44d8ec72d8010d3b9af7208690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045603, "uuid": "9b5aeb82-138d-446b-be45-eb0687c2c4fe", "comment": "Malware payload (Mirai)", "value": "61b15f7287c7569bd3da8a7d7da1a27a39637b7001e3af91045b7566d50c59b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045603, "uuid": "8ebdc5e2-3f3e-4337-851b-13da5298c5ae", "comment": "Malware payload (Mirai)", "value": "7b95d273db9b087df9e86a07259b01b652cc7ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045603, "uuid": "b09cb66b-05b8-4fd6-a772-a7f74d7451e1", "comment": "Malware payload (Mirai)", "value": "8a23fe177dda8ac3b3ec728c7d08429e5ead6974c6e41044876d1ebb82596e10e4878f5c62d6aea2fe563d471a80a07f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045603, "uuid": "cf75509c-340b-4dfe-a9b0-91ffd73fd173", "value": "T1B113F751F842463BC2E0177AB6AF5A8D336563E9C2DBB21BD9218B103F8651F0D67F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045603, "uuid": "5ab21778-d1c8-474a-b3df-5fe1cc98030b", "value": "768:dCW2LfdqM45LVBA0G5J2CPH3zyLrKJCc5Bol9AURmfZZKg8VBoGeuyw1K:4v9413G5JtPX4GT8FSwXVeuL1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045603, "uuid": "4d45ff99-b7ef-499b-b9cd-d5f50e4b6954", "value": 44824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045603, "uuid": "d171301d-6cca-4b93-bbb3-b0c24d471c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045603, "uuid": "0cfa4685-7233-4f98-bc60-051ae090e8f1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9b7a95-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035583, "uuid": "9374d5ae-3655-4636-a922-30c3eb1a9698", "comment": "Malware payload (Mirai)", "value": "3b9e26bec950448642b93d70d555deb7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035583, "uuid": "f70faa00-d47f-4bed-97c3-59ce1bba021d", "comment": "Malware payload (Mirai)", "value": "629f25fb0e7eb5886ec05675a283d9aab3b397bc841ce2b363fcf57b7f99a6cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035583, "uuid": "b19c302d-bf03-4757-89f7-d58b06d94737", "comment": "Malware payload (Mirai)", "value": "bec7f4f33be6dc18de5175f13b22a60fad0ba613", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035583, "uuid": "1a57c862-7165-48be-a000-e751376dc98e", "comment": "Malware payload (Mirai)", "value": "ab93eebb99154a1c3f349a1690fe3676018335b6469b5ea8d39ba68a9b1d800f35781eefb530a3af019278030b6237f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035583, "uuid": "b6e6b8ea-79be-4c4a-9a79-9c44f20b7ddd", "value": "T17A415C8613610E302FE29E2A35AAD498F1D8B4CBEDE19F0584DE3CFDA54DF082545E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035583, "uuid": "7977e8f1-bad8-47bf-bce7-f695eb15a8f2", "value": "24:vHROSbwOSOOSkOS6GOSrOSuOSTjOSzPAOSrHOSGOST6Ol:vxR8RORkR6GRrRuRTjRzoRrRGRT6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035583, "uuid": "3d52fc82-0111-4cde-99f1-464e90c9a88e", "value": 2136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035583, "uuid": "ada66d29-27d9-4173-a468-0f76b8caa0f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035583, "uuid": "94e3a6c2-94a6-4c3a-9b53-413109f20fb6", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d6b7fd-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012933, "uuid": "6c77f82d-58ba-4d0b-9c02-93aaaa7ef5e7", "comment": "Malware payload (Rhadamanthys)", "value": "5d90b0405d4cf40388ba889cba0075cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012933, "uuid": "27deeba9-9586-4fbd-9eeb-b7b9ce6a7744", "comment": "Malware payload (Rhadamanthys)", "value": "63464bdc3634c63a61bbe730e5bddb40b39a98eb13c5e9616f8bad25580570c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012933, "uuid": "22817c6f-ae13-4f2d-9d7e-5b81baea11be", "comment": "Malware payload (Rhadamanthys)", "value": "c17e3ed1de1798519c58f8627f0010e651298e7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012933, "uuid": "6e430cee-dfbb-42ad-94ce-bc0e10e31593", "comment": "Malware payload (Rhadamanthys)", "value": "8ff288ad05321d2c861e55e1cb39db8e14d6e2f34e03acae84f584ddfc0aed198ab06a6538617409d1b840225ac165e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012933, "uuid": "0c09a081-24ab-4984-9534-f18997979de6", "value": "T180A3D8910F365F532E813ABABAC55BEDCF16801D1CED9198AC0D77700C8DE4DAE069A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012933, "uuid": "30e73a4e-5bf6-4b86-9634-b28aa6ebed12", "value": "768:GDhd0i7J4sYKgY/CMNfWd7l0qVrjuOjNpptma4YlC5ytwGtZmpzVWQ4rX5EdKldX:GDB7eKg20/rrrq5NSb4AJFS6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012933, "uuid": "ced80247-a70a-4571-bd73-55c8b5d3b670", "value": 104002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012933, "uuid": "b6a4d30a-e6a2-4f3b-8cc9-a3a26a23e155", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012933, "uuid": "03fd3efc-61c7-434b-ab29-10ad057a191b", "value": "invoice-1637482117.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c6f254-120a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997375, "uuid": "4c5dcfd9-f8db-40c8-9fdb-e63476cbda64", "comment": "Malware payload", "value": "b8caf4bf0ff4b06f1f2bfd687b7d0bab", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997375, "uuid": "b98f9228-a2c8-46b4-9091-9211f74defa5", "comment": "Malware payload", "value": "637db53b0766e4c21ef2e06f3bc3ea11b0164efde815e5aa61d0fd33da06aa0b", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997375, "uuid": "2fbc548c-6b29-4778-b93e-64da048be64c", "comment": "Malware payload", "value": "e21564fd0fc3103c1d18b1e1525a0b40e9077d40", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997375, "uuid": "b1aff4a2-bbd6-405f-937f-4cc702898c65", "comment": "Malware payload", "value": "88e2fb1fa55241d9da77e78b27314b42d7e8a0af8a9bfa6db3eb1d54a93aa8e86499b603de51ed91a89ab718ca2c5d79", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997375, "uuid": "5e1e004d-812f-4629-b066-04036da8b704", "value": "T1D06101AD7D5B4272897E6B505D432CB7EA902017332B66B8F58DA2C90FB45CCC1F468C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997375, "uuid": "118dfba0-e160-489c-87f9-06af4c54b7eb", "value": "48:lF/kK6K7lLgKKRMRj1fKuKQKIxRdACgTK0Ra0zV3y2K7YcRLg9B/Xx/K6q7RFNcX:lFpLlFJjwX1iPYacdg7gXxiF79SGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997375, "uuid": "5ab90222-3f27-4c6a-a43d-192297081aef", "value": 3274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997375, "uuid": "206c8d52-df17-495a-a245-151976f05432", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997375, "uuid": "9b4e1269-4094-4faf-95a0-801de2c19f06", "value": "637db53b0766e4c21ef2e06f3bc3ea11b0164efde815e5aa61d0fd33da06aa0b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65c6ef2-1224-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772008511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008511, "uuid": "0fa5df58-332e-4fda-b7b4-c7884ce8be88", "comment": "Malware payload", "value": "f2901b1864af74c94961bf2ad619a261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008511, "uuid": "a20fd8f7-9f58-4285-8b6e-1859cac968ec", "comment": "Malware payload", "value": "63c1ed49e2c227ca560b024f7bd51ce3e27d27c99468ff8c33b49c88286ba913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008511, "uuid": "2671c90f-97e3-444b-b52e-158222e19c63", "comment": "Malware payload", "value": "12ce447f53a7255cd1ad99cb736e14e48d9a814c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008511, "uuid": "8902e780-6a3f-436d-be64-f4de69865676", "comment": "Malware payload", "value": "bff39cd070b93545219140a2363db4ba95e7ccd725b48002d5a9eae882c582cec165cfdebecef5a0e6f0afdd187629c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008511, "uuid": "19f40b72-73d2-4e4b-a2ed-f7ba974e7634", "value": "T1DBA4D516E620B52AF99749703E79A257782C3C352581ED0BFB899F5A3A7158371F030F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008511, "uuid": "eddf2b42-6900-48c1-b3f4-96e956a32d15", "value": "51563632c6b40e8ecabc4cc343ecb385", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008511, "uuid": "2a65f2bc-c88f-467e-996f-8c730bab0343", "value": "12288:t9Grt+bLN0hIIDRHTpHvKbN7hy4QYMJQe:TbmHvW7hy4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772008511, "uuid": "db0d7586-bfc4-4b2d-81d0-dee041abd61c", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772008511, "uuid": "0ad5b692-5b81-4d39-b9dc-be112d4479aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008511, "uuid": "5fbffd34-49df-47cd-b01e-af64b6f92bc7", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c56f85c-1249-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772024144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772024144, "uuid": "261eb27d-c448-489f-a027-71cba4408b68", "comment": "Malware payload", "value": "521a7dd4ee5dfdf3df384f1b1f8deddc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772024144, "uuid": "60454ce8-17fe-4bc9-9d76-e4a615d544a0", "comment": "Malware payload", "value": "63fc8d5144cca9c9454987530e45d627a411e4b5b0e3dddef3e850a8a33cc7f6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772024144, "uuid": "aded358d-6335-4b17-a0c8-21d10849d4d3", "comment": "Malware payload", "value": "d2cf5b70b25ba7fb3654cfd2b67e318c67343bb1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772024144, "uuid": "f0283756-5b5f-47d2-86e1-a7de5a958a54", "comment": "Malware payload", "value": "e88bce4781629e55efe9e5f8f23fd7333e2b72fb5d56b0307e2b3b5f40a9c1d17420a8be084b6914352845defd9a73b2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772024144, "uuid": "1bf73c73-9c12-4758-aaf9-8b9306c3eaf3", "value": "T195A21987B640D332C8815B314A1FD7E48F76AC599F63210A769AB34C2E72A9116F7DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772024144, "uuid": "e504196e-f4ca-464d-b5e2-69f3bff76577", "value": "384:b5+SzrzTtZ6Q9KJWMey3M5UC0qEXdxSo1Hp+N8Xlagd/aL:bUEzhZ6Q9meWMmCaXd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772024144, "uuid": "4e90a18a-cb4e-4a20-94a9-a626ec5656d2", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772024144, "uuid": "8b7c3207-a57d-4433-92bb-5e82c733ce49", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772024144, "uuid": "9b5b05e2-7c78-41b0-a81a-cdf23bf0f5ac", "value": "85de453aa59d4458.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c4e4a-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034651, "uuid": "8af41820-b696-4608-bcb8-566a0c8cbe2d", "comment": "Malware payload (Mirai)", "value": "fa81c7459645d7cf4c9e577a18e38da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034651, "uuid": "307bd52f-16fd-48ee-8fed-d2c42e53fc08", "comment": "Malware payload (Mirai)", "value": "654d0c2b2beaafc4d3a30337aed412fbf6cb5e7fba0b42898b2923a58b95415a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034651, "uuid": "46216e78-4dc0-4659-b32c-0ef6caf906e4", "comment": "Malware payload (Mirai)", "value": "dbd193fd6e66e1b7e01f066bc16483e126f8e17d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034651, "uuid": "3dbd1220-3d5a-41d3-8fb1-c3ed0cef9094", "comment": "Malware payload (Mirai)", "value": "54db4d63e54da8fee8b38cc7d4cba87c350bfb9d86669cf842d2d1859a98ea4128fb1a50f6ead54cd4c0d2a83811a595", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034651, "uuid": "1c269f1b-c782-497f-9b63-b700ec907d30", "value": "T159434A02B31C0E47C0A31A74263F5BD1D7BEE5D022E4F688252E9B9A9671E375486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034651, "uuid": "a2aee7e8-05e5-4de9-8823-5e991893a42c", "value": "768:4KbHwx7Ehfi0CRZ+RlQQ0sqFewDLHZdUUF9mmSuWn9jRlwQgp2sFRxtQSewn/Iq:fHuSDqbDL522mi6PlwQgcQxq2n/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034651, "uuid": "442a5546-cf3b-40c0-89bb-a36fee60a1bf", "value": 55168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034651, "uuid": "f6cc8eff-e3be-4432-9a61-224526e6d5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034651, "uuid": "70e2006c-3fe8-4450-a124-b1d25e57004e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6162a1eb-1239-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772017308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017308, "uuid": "e0663c31-e1c0-47c9-bbd4-2277311d0865", "comment": "Malware payload", "value": "e4933f8320bfb288d8d458892f30a39e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017308, "uuid": "1e51aca7-65aa-4acb-a68b-4b82a555799c", "comment": "Malware payload", "value": "67dee27179a597a2a5d050276c5ee7b27c3dcbb8c139510fccc971634347975d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017308, "uuid": "54f754ca-7342-4e71-a969-a2dbd5379d4f", "comment": "Malware payload", "value": "f1bc187b557080566981e583509900f428ecf7eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017308, "uuid": "d8c10ff3-526f-42f0-8dc4-54b01cf84b0c", "comment": "Malware payload", "value": "46700c2b149742300785af888f7c7c63767d8851ac9b514b15699e26e82aba6df2b8281467c034357a9c9a8dab6a9320", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017308, "uuid": "8e283dd2-b17e-425a-bf9d-d36075877a28", "value": "T11B11C801E6B44FF4C5ED76753572134A5864D0E52A6E6C93192988826F071F30509CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017308, "uuid": "1e71a7b4-b890-4374-92e2-b2105a2b5b8d", "value": "24:9sif4tRDokpR8Cb15Ap6GC7+cPeBEcGj+NK7NDkxsnE6Is2Cib9S+:9rfYaCb1qzC7oEcxMKsnEbsKbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017308, "uuid": "afa7dad0-678d-4b5e-b886-a09edd22000c", "value": 1028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017308, "uuid": "ad4ab942-baab-4218-a901-493a8dd5964e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017308, "uuid": "d91e5ab9-99ae-425d-91c3-f81d2b016aba", "value": "Important_Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204d961-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012772, "uuid": "5a4018c6-921c-478c-8965-dcb8589717b9", "comment": "Malware payload (Rhadamanthys)", "value": "3ee23cf126eda68d322e2a955d8374ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012772, "uuid": "6a36972f-0d9b-458d-adf0-2bdf77f29b54", "comment": "Malware payload (Rhadamanthys)", "value": "67f9fa40efb2336776f7cf92e5fdeec70930416cf76662f751c3076388ec8b9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012772, "uuid": "b8be4244-bfee-4929-ac73-d65a58ad33cb", "comment": "Malware payload (Rhadamanthys)", "value": "488b4f3992db9bf8879539201ee308e93daf35c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012772, "uuid": "55c0301e-dd80-431a-878f-685225763708", "comment": "Malware payload (Rhadamanthys)", "value": "d6b89cff023e816cb33c7ef0f5366d034a3d93377e9d970efa4d0cd39120f3b9601ba195ffdbbee7ae1818a52287b4a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012772, "uuid": "932beb3e-1ad2-4b39-b5db-33279b24ff94", "value": "T102A31A58FC72F478C466E3F36CE528F1824146D746A9B2A6A00EF71125F971298B0DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012772, "uuid": "4bb9edc0-4f69-45ce-aabe-df13f8b38a19", "value": "3072:GDB7b0tBkBDBGBNByB7BFBSBEB2BWBkBDBIBLBLBdBMBcBfBLBPBzBQBcBEBjBmD:0uBkBDBGBNByB7BFBSBEB2BWBkBDBIBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012772, "uuid": "00bca3e8-6154-42f5-a4d8-a2ed5a00c181", "value": 102062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012772, "uuid": "0f0814d4-00ff-447a-af9a-b2c07b746200", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012772, "uuid": "eea2daed-2a22-4101-b661-a2c79e3c04dc", "value": "invoice-1637482117.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a82545-1283-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049265, "uuid": "6f4eb58d-1012-4997-8a5d-94c2e053bfc7", "comment": "Malware payload (Mirai)", "value": "6b0c3030c6c7a9dbb7c94f5099e90f25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049265, "uuid": "0bdea605-a895-4c00-a4e6-5c4579981cbd", "comment": "Malware payload (Mirai)", "value": "686943e7517e8765df8ac61357695d857d9efcd7c02345f650550d1f67ba5871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049265, "uuid": "a28b2689-61c2-4f18-9e5a-97c1d8e82221", "comment": "Malware payload (Mirai)", "value": "8cbe12b3de788a7f2f7f71907404d026fe039547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049265, "uuid": "25fad077-8159-4139-8b28-d72ff9836c88", "comment": "Malware payload (Mirai)", "value": "2cf279a0af92cdc47ba84b3bc4c7a7b5414302bf481707f9e0f28713e282f07f311e9541c7c8fc56233fdbd2ef59e719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049265, "uuid": "4a074dd7-00c0-4626-9975-0f5b9c1d2fe6", "value": "T17F634A02B31C0A47D0A319B0363F2BD087BFA5D221E4B785691E9B96DA71E376446FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049265, "uuid": "861d25f0-0c4f-436c-9023-84b636ac4e30", "value": "1536:/S6iiuiETD6mT3/r09ZPH2+zsiVJgUF0hATgnMGtQZNI:pGiErTeZZzljhgMGGNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049265, "uuid": "426cf452-90e9-40ca-81e0-1d2ecb20e833", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049265, "uuid": "5efc3e62-f980-4138-af8b-4427799b545a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049265, "uuid": "3e19f54e-3226-4cfb-abe5-8c661516eecb", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6521c563-1295-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772056828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056828, "uuid": "b09820b3-bd9a-4c36-bb4f-886d62355544", "comment": "Malware payload", "value": "4f49dd776faa95f10f40401a6918943e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056828, "uuid": "7c0b8a05-83e6-4af9-a3c6-0a0ed7970172", "comment": "Malware payload", "value": "68973c2e819d3cf8b2b2cccd181790e7d8e71c094be6aa81caa8fd8077d5a5a7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056828, "uuid": "f09ded6a-5c25-4354-85f2-6bb5ab16f990", "comment": "Malware payload", "value": "8748fbbd748ade23f43499dbb44b799f081644da", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772056828, "uuid": "f797c9e2-136d-4c60-88ae-00c6519e66e0", "comment": "Malware payload", "value": "9e2a481371f153db4a180728e505ac36d1f51d6771701a1d7a0a804695277f5a01f7920d9a15dce4412584ecef68804b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056828, "uuid": "7310b7c3-a342-4cd9-8368-081e44f4426b", "value": "T13AC5591F6D9548E5D46E8272C9B2D1863B37B9180B3E23D31E80BA742E726D49C7F718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056828, "uuid": "ee6f7628-8df8-4f94-ba6e-2bb586d22ce0", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056828, "uuid": "40fb032f-061e-4e67-8fdd-d464e0917a89", "value": "49152:WPal+RwXUSXQUXWgBP35io4xYUWbogL52dQ1EHv:WPoiCJXP/MfWbRL52dPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772056828, "uuid": "0a1c21f5-d5a8-4ed1-b7b5-3215fe4a5627", "value": 2496512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772056828, "uuid": "1311c11d-cf17-4f30-8874-8ac459530710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772056828, "uuid": "bcc36b17-b49c-420c-904c-66e003f6a23f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22257a2-124d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772026140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026140, "uuid": "fdd333d2-9fae-4f67-b6d7-3988745078d9", "comment": "Malware payload (NetSupport)", "value": "71a96576578f5daff6d6f798d9aad4a3", "object_relation": "md5", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026140, "uuid": "3757b086-db84-4f09-8fc2-3b38df5208f8", "comment": "Malware payload (NetSupport)", "value": "69cc84bbc92d8a99b73f642487b9bc95d3205efa42de9a0a1beac83e2f33beba", "object_relation": "sha256", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026140, "uuid": "bb7d29ae-1af4-4179-a470-d253dd7929eb", "comment": "Malware payload (NetSupport)", "value": "c20aa1061da29a2a1fb7161c6768492633d58f54", "object_relation": "sha1", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026140, "uuid": "46fd5084-ca34-4fe6-8625-3f4b0efa0d9b", "comment": "Malware payload (NetSupport)", "value": "2549bf46f152221f1418e951b3565a30e21f5cc20af4137aedc46276bd8ba066d5ad3a788b02fd8ae64c22305c070189", "object_relation": "sha3-384", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026140, "uuid": "416b40cb-1d9a-4119-b450-93bf1a8a6555", "value": "T10DA2D116B6DD7562FFA15AF428828A004FB3B80B13EB1490E7C0D9D6EC715745BC3453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026140, "uuid": "8e85fe47-c402-417e-85e8-f40ee5a615a2", "value": "384:l2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSf1c4W:l2+x6TLKQXK1myQCSr2VS4jTXaRnPNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026140, "uuid": "cbffe83a-c7a9-49a6-b86e-d97f32fb0089", "value": 22182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026140, "uuid": "8282e080-202e-4f64-9048-d5dc2a67d71a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026140, "uuid": "9f446c68-a40a-47e6-a547-bfb784f65210", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac2a4d6-1287-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772050824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050824, "uuid": "879f64dc-d510-4805-b308-859a24b35b5c", "comment": "Malware payload (Mirai)", "value": "78b6c9e6b3357fa238e8db1ee7c16220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050824, "uuid": "01ad1c18-cc70-4e89-957f-48a6bc63f91d", "comment": "Malware payload (Mirai)", "value": "69de9335a5fe3c51c3879e5e677badb610b18a5d3b16509d988b1c4e66c66ed7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050824, "uuid": "053a89a3-6e28-4ac7-8291-f146f1ef7d6f", "comment": "Malware payload (Mirai)", "value": "d81738922092b0cc5edaf0f4df9a792e7177ccb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050824, "uuid": "41f2fe9b-5ead-42cd-aa02-53c473cfadab", "comment": "Malware payload (Mirai)", "value": "b18af19618da6d0b85e96a42f9a0ec5cfe17fd13beabae5d96cb6726ea0a65122497adb5956afa568bdb47a91b78439b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050824, "uuid": "6c8e2011-76fe-404c-a165-380a0d6d7db4", "value": "T133045C17B5C094FEC8D6C2748FAEF216D932F55D2138B11F2BD42E262E4DE206B5E660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050824, "uuid": "6e661650-4589-4e3b-941c-e3ba2d3b2257", "value": "3072:UQmwyp0zHc+WsTRrELgMxRBLdW6PeRpTxNdQ/mtwgYlE:UxpGe+XMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772050824, "uuid": "64bcc3ac-a838-4669-bcc7-11511ce72e69", "value": 175496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772050824, "uuid": "212e6448-8355-4f82-a588-0c8f7eeead70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050824, "uuid": "74a34944-a4af-4dfe-990c-e16c21ff4fa3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919878d6-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017389, "uuid": "2ce24c4c-cb71-47ff-9ddf-cdfdb80771de", "comment": "Malware payload (Mirai)", "value": "e6a08efc0ef45ed510897023fe461b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017389, "uuid": "5790b41a-b2d9-4c69-b2c3-c192d9cf56da", "comment": "Malware payload (Mirai)", "value": "6a8e701c2bccea14460cdf7bc8d92acf5ff1187554094565407cf91ce226cab2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017389, "uuid": "06c81c90-585d-45be-8a41-ebececadd626", "comment": "Malware payload (Mirai)", "value": "460607ae77fa92482846748aefb5bc36ff41f7fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017389, "uuid": "a903cc9c-3651-421f-9abe-a7fa5a242514", "comment": "Malware payload (Mirai)", "value": "81c39eea84db45d3216a1fc8744d8f525daeb330295ff41eaa092069693f8b1651247b6656aaa1a53b5d09e78bc7ffd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017389, "uuid": "219c3f45-7eef-43ac-8d13-2d94b47181a7", "value": "T1A5432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017389, "uuid": "097c233d-d08d-4a9b-a8c2-f11174d796b2", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw6:RqtmZPuutfbltZFBSJsBcfDSTFI+BE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017389, "uuid": "f91a524b-d69d-471c-ba43-2b5dec022477", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017389, "uuid": "b75001e7-41a6-484b-8df8-55914461e1dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017389, "uuid": "110ae10e-4cad-47dd-981a-aea5a9caef5d", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85dddee-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029936, "uuid": "87230aca-5822-4e33-89df-066ed5b1de2a", "comment": "Malware payload (GCleaner)", "value": "f3b7a5be5e60db6b2ca7c023f0165c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029936, "uuid": "e43170d7-47bd-4c2d-81c7-bce72007cf60", "comment": "Malware payload (GCleaner)", "value": "6b9d8aa4170a90b604ee452055d789f864a78978efa43cf5b126ce73acfcf829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029936, "uuid": "f0fe242b-a44e-4103-94dd-1a52461f0cc1", "comment": "Malware payload (GCleaner)", "value": "2b89d8a6d1ca9c6cd488f32fc6214af5c977543a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029936, "uuid": "7a500cd1-2cde-412c-8292-8548b438ade8", "comment": "Malware payload (GCleaner)", "value": "50ccaf96c9cf9e7a8c3b643b067adb75fb2266a1b0fadd86ce3b2264c33949f1b802d90a7b437faee79f8140e7dc92b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029936, "uuid": "6de9b66b-0c3a-4e97-829d-57074a934771", "value": "T13CF49EE2F1B15437E17356389DDB61DC9426BD106924A88637FC1EC8FE396F1382A683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029936, "uuid": "4b18ebaf-af27-43fa-859f-fba22354966d", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029936, "uuid": "311c4621-693c-4dd8-a809-cebf4cc4b762", "value": "12288:r2d0/V6Chk61Wd0Mv6jE/h/pk8FmBii+KV4HtIASBUFz:W6N31WB6YJi753MlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029936, "uuid": "c0208c32-a2c7-47d2-81bf-f47e09066687", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029936, "uuid": "df0b9a8b-3763-41b7-aa19-5069976a5521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029936, "uuid": "a0b5738b-34a7-429a-b8e1-d0f8e6e8ceea", "value": "f3b7a5be5e60db6b2ca7c023f0165c30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348adcaa-1279-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772044720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044720, "uuid": "d4e6bdef-a721-4e41-844f-4dd9944f6533", "comment": "Malware payload (Mirai)", "value": "b870fb2fb8b2ce47178e14b9aa3af288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044720, "uuid": "983d745a-18ce-4757-befa-49462e34f1ec", "comment": "Malware payload (Mirai)", "value": "6bde68fbf2c434ebd6caea62b61d011190dbce595ef4b418e64ddac9a7fcc45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044720, "uuid": "82b3a1b5-9623-4aad-b9d0-a74b814e473f", "comment": "Malware payload (Mirai)", "value": "9fd7175b7f070a0ffa1fc467aadc9b3cf3484613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772044720, "uuid": "562efc0e-eeec-48b7-a5b1-33a37cda54fe", "comment": "Malware payload (Mirai)", "value": "33a1f11640583573e366974ddf35228cc6a005812dcd653fa9c687bdea4ac6425a07458554fa498ef4388a3262dc5e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044720, "uuid": "0c87ae14-e70f-4f92-91b7-cba2426f28b6", "value": "T12DE49E405E1C7822D7C5F0BD8E854BD1312B38BC4770D3BB2D17921ECA92AA59BB6772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044720, "uuid": "25972cbd-a2fb-48f9-805b-48d564b5dc8e", "value": "12288:++Wd4sHTaTiQRxmzlye9s530rTfp/dEpF6vI:KHTYiQRxXezrTfQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772044720, "uuid": "1c875acc-542b-48b0-81c4-c009fe1c459c", "value": 707504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772044720, "uuid": "eb44f959-2731-4a9b-b4ba-3756157f20af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772044720, "uuid": "31dfe17d-1132-4008-9a67-5125b02f1bcb", "value": "a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337ae09e-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772045577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045577, "uuid": "ba5aa66d-244e-4755-845d-b970f702ee65", "comment": "Malware payload (Gafgyt)", "value": "597f224ffa0a046fded224bc9e4f68b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045577, "uuid": "bcae1040-fcae-4d88-82c5-a519af47ec98", "comment": "Malware payload (Gafgyt)", "value": "6bf99028ce476647732b89d6e3f7a835762c2768e508466939a9d49013cd8815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045577, "uuid": "0394d962-04be-4727-8dd6-7de50dc23ef5", "comment": "Malware payload (Gafgyt)", "value": "35ca9b275b3e0b43598fb445dd60ea45086a5900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045577, "uuid": "aa54a914-e035-4da1-9fdb-149814ee1875", "comment": "Malware payload (Gafgyt)", "value": "793ce6e2eafb00204a2b1863b454816d8927d819c1c4a660f9e896f9d3f0700e9c3a3facbfb408f2089652a1627fb850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045577, "uuid": "178494a5-28ef-4cb3-8743-5c17d489543a", "value": "T136C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045577, "uuid": "bd690d07-2f99-41d9-845e-2307f2d8f76d", "value": "3072:4jDy/+mh1vtbPIKavbpcUPium7/L7QsvmGfIiNb:mOJ1vxfavbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045577, "uuid": "daad869a-0636-4c98-b16a-883999180917", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045577, "uuid": "9d909945-4668-4836-928e-6e493d953278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045577, "uuid": "66354026-3bec-4f38-aae0-4830d8d9d477", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f90828a-1251-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772027478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027478, "uuid": "9158c119-8350-4963-b2fe-1128e2edb78e", "comment": "Malware payload (SnakeKeylogger)", "value": "d28233b2ed8ad2db58c386c3e73b428c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027478, "uuid": "9ccdd913-89ef-47db-9684-15e183876a12", "comment": "Malware payload (SnakeKeylogger)", "value": "6d36c8f8c2f52860b0172f656b6e96ecbc68f6fd4f51930c0c64935f67e334b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027478, "uuid": "c11a3323-7eb5-4617-98dd-8fc6bc99554d", "comment": "Malware payload (SnakeKeylogger)", "value": "5813e37dc4519fa50462e2cd392319df6f5af955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027478, "uuid": "9883b347-2ccb-4cc0-a1b6-f86a06137fc7", "comment": "Malware payload (SnakeKeylogger)", "value": "9bf25fbfded6546614fdf306ab415e94d0d62190493088ef68e03b275aa33e2df26f7eb5a35fc686eed9ae098e2883ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027478, "uuid": "a82d93b6-d79c-4ef8-b7d5-bd8edade9187", "value": "T1C9E4129569D069C1C5547230D831CC6449B538B1BE69662E833CFA7BAC343C3EA7BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027478, "uuid": "ccfe965d-c9d3-47c8-b64e-8e2fc99cf5e4", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027478, "uuid": "cec6775d-de08-4f6f-b71b-12c8b1e46633", "value": "12288:/z7hU5I5yuNHIgzSFKxWltRohBfSTso93UbDb63MedkFB60NmM9n8Jv8:/f+iN57Gtene3AXSvuB60Nt8Jv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027478, "uuid": "cb54dd22-6146-4338-ba57-71d358eca3c6", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027478, "uuid": "9e57b509-e5bf-44cd-b72d-7f306409bbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027478, "uuid": "9f98bb3e-e24e-4246-95d3-8298a38cbf49", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9668d6d8-1239-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772017397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017397, "uuid": "35e1ea84-2a85-4613-8e29-a6eb05ea6e1c", "comment": "Malware payload", "value": "a75d0d0a1e368015d71981b44b7a7951", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017397, "uuid": "b9ebedfb-93ad-4f5f-a84d-a48fc5f53363", "comment": "Malware payload", "value": "6d9e3cd2d1570b230be6f00fc89ee2d2f3f345e00f6376e9a56cb67b2fc5a302", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017397, "uuid": "e817bb14-b302-410d-ad04-a28855ffc985", "comment": "Malware payload", "value": "db203ead26f95d0db9940f0a6f0d3ffc5ea0a207", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017397, "uuid": "7c13e8ec-4fd1-4b09-aba4-c7898c1bad11", "comment": "Malware payload", "value": "782c59f61368406b82276a7f2fe8ce164fe374df57211a54735c50b541147c2b2cc8be3495b997e1c003e156a1aa63aa", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017397, "uuid": "e1013374-1ac0-40fc-92a6-4a97a488b4b0", "value": "T1EBF633A8C9DFF5A7F8670834A146A4A764E7F88611BFD4E4483DCAF482BF42495847C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017397, "uuid": "5d132736-761b-4108-96b6-b12f77e5ff81", "value": "393216:cOAoA6cb5DWMqOZHvEDMuU5KNzvL4orIMWiaaYsgP0:HAP6ctDrBZPQRzT4orIYFoP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017397, "uuid": "17eab00a-caf6-46a5-bda5-78e8b659ae09", "value": 15660591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017397, "uuid": "03ea45db-4dd8-4fb3-8f06-8d18545089a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017397, "uuid": "956fceda-df59-4c08-a271-9c69b2baecf8", "value": "ArafRamadanDays26.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c63f48-122f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772013017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013017, "uuid": "4f4b7889-3a12-4ea0-8784-cb0ee27b6126", "comment": "Malware payload", "value": "4ab712a2d344d0a003a3d1fcb7c74998", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013017, "uuid": "f7df25ed-cd2c-4fef-b09c-d4f3e66c47ea", "comment": "Malware payload", "value": "6dc8c6c10f881b7f3dcef42392e9022bd69dabdd0b0fab5d1b27db020df8f710", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013017, "uuid": "7264fc01-ef66-463c-9e57-ec5abdfb0870", "comment": "Malware payload", "value": "c6f65c66baf22a815263e66d92fa751ad3a3a9ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013017, "uuid": "38f4d65f-1b2f-4ad9-b0f0-f5cf4020d889", "comment": "Malware payload", "value": "594c8c1649e2fd33b4b8845b54b8b83b45f3435e8f12bff3c02a283a14cbab756d2fc556a7953da9eab7e500b4b8f796", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013017, "uuid": "abcec076-0154-4f1f-aa06-18997c01b4f0", "value": "T151A3F86C0D47EEE523698AD77E85A67EC21F49CD88D452C1A642FF98B018F125C930EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013017, "uuid": "c405438f-532c-4937-805f-3a5226d17c17", "value": "3072:GDB7b0l47a/k4Vuhf63evEDqrowK6eSFhc/l5T7sDeSD3AGpGkfY1qXeghrlwXA0:0847a/k4Vuhf63evEDqrowK6eSFhc/lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013017, "uuid": "35d4e697-0d61-4600-9666-99350ebcc4d4", "value": 98707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013017, "uuid": "4b2254a1-884e-4019-bc30-9b829a073be1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013017, "uuid": "e392f510-d285-446d-a583-666418bbf004", "value": "invoice-1637482117.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e48302-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001097, "uuid": "53488279-7b4c-4f80-8656-c6f932c294fd", "comment": "Malware payload (Mirai)", "value": "6f3974f68f3c02f5b0004ca50b3ba8a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001097, "uuid": "95b6d525-48e5-4a0a-bf1a-38d7e9e3dc58", "comment": "Malware payload (Mirai)", "value": "6ddafb2228db6334f44afd23775fec15477d7bf128986d7ba1214dd2999c9f78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001097, "uuid": "c2d92ff3-81b7-4177-a4f0-f776c0890de4", "comment": "Malware payload (Mirai)", "value": "e70aa402f2acc8a80902875a7f5fe59c7dddb670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001097, "uuid": "8f92d814-af31-425e-bc94-75b28194b97c", "comment": "Malware payload (Mirai)", "value": "2f0495e06150b4fd47032fb7a98ca4e654d588325d42e9c976c07079e9b314edd482409c0626a94407dbaf07ee592def", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001097, "uuid": "c3f45af4-490d-4856-a18e-a877664bd41c", "value": "T178C30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001097, "uuid": "283b1608-0d52-4be1-a853-ee24192fed85", "value": "3072:f2D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1J:f2D76aX9aKTcRQVnoiYq1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001097, "uuid": "67e3eb03-4e01-4b9d-b9a1-920a828d87bd", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001097, "uuid": "3499085a-58d5-4a15-a1b5-275fd673e3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001097, "uuid": "eeccf134-1e9b-418d-b250-12e6be312c58", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd632337-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034642, "uuid": "4d29a84c-c914-4269-92b3-e4d63a653c97", "comment": "Malware payload (Mirai)", "value": "786c2904b4f9c12610f776c0f120957a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034642, "uuid": "23018b37-486c-493d-9802-dca2147c94ef", "comment": "Malware payload (Mirai)", "value": "6e63c766c70ca762c554241a0b0ba5a944381c4cdf403a59ac3098504ec762b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034642, "uuid": "a776eb74-20f6-4c9f-8b8e-2c71a66a2a6c", "comment": "Malware payload (Mirai)", "value": "8cc19966afa81135b8e0ac03271d0e0e4c31053a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034642, "uuid": "e478522d-7a46-4b29-9c3d-a52aa91cc96c", "comment": "Malware payload (Mirai)", "value": "6ad68bd5f0ab5c9cd655ff95ae0b3ff7cf0a9ad215b2bf2cf401b20c9584f4481d68c3fa426b8a874a843c9fec7ea6cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034642, "uuid": "4d62846d-704c-4992-89c2-623738717948", "value": "T1CE337B77E46A1E94C086817075649F351F23F1C893832EBB26EAC2755483EACF509FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034642, "uuid": "b1449546-4253-414e-934e-12d6358eac45", "value": "1536:waaf6/EDG4TFGjcKAlOWDsNKCVQZlnfE:wNf6CG40DANsNKZlnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034642, "uuid": "22abd35d-f0d1-4b86-b952-94fe9c440e5c", "value": 50588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034642, "uuid": "c6100d2b-10e2-4b9d-accc-33ce08fd74f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034642, "uuid": "74bbfd3e-609e-496c-8d61-187198cc0f96", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae25250-128a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772052247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052247, "uuid": "c7c2ed3a-6fb2-445c-907e-d60b1bdf6cfd", "comment": "Malware payload", "value": "a3c518566cb116dadaed91262f613694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052247, "uuid": "55ace069-b373-42b4-96a0-c8a8f6603f6c", "comment": "Malware payload", "value": "6e9105163e816ed0a2d526cb255e73e7a725a2a556b3e3f8c9a2acc088e0ed35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052247, "uuid": "9d840306-e0dc-4126-9397-39a3bdc28a0b", "comment": "Malware payload", "value": "ef2dcd21c5fddaafb2a480e250417e150760129e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052247, "uuid": "248a4c4e-f13a-4ddc-a52f-713e7afd348c", "comment": "Malware payload", "value": "7534173c888bf99fee544d77dbff7a3bfb3185dc06c32fe26d0108af1dca06e34f4c42815c8a32cc3a7084b7977d5c92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052247, "uuid": "8bb6e614-cd0d-4d2c-9182-16c2e21b6e5f", "value": "T1B2A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052247, "uuid": "954f1eb2-05d8-4886-81af-89ffb23ae7d8", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZVyPjYN5:FOuhPHCKsqZ9YfM6g23ZMLYN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052247, "uuid": "747c507b-2afa-446b-980d-d3fc1ce6efad", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052247, "uuid": "0f9cddd8-7d5d-4c2e-b4b8-591a45267b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052247, "uuid": "f7098dec-4880-4dac-b869-aa6a91b45cae", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e11250-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772029950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029950, "uuid": "8c660fd7-82ca-4df7-a8bd-59c0f24d1363", "comment": "Malware payload (GuLoader)", "value": "71d05d38ba1c60d8d3e9fcfce0c111a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029950, "uuid": "d9942f28-8a02-4776-b28e-8c40a9ce2250", "comment": "Malware payload (GuLoader)", "value": "7012771a0791b11e298b5eac4e58379ef29d8dcacfe89310c30e1765abc29095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029950, "uuid": "ee006d35-7377-4b71-994b-8c9b25a4889e", "comment": "Malware payload (GuLoader)", "value": "83c7709aaa0de2f223a4d9c832e6afb55dafb298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029950, "uuid": "787de8b3-9f23-4b0d-9461-5320d4ee56e4", "comment": "Malware payload (GuLoader)", "value": "50f9a9807a610721c9c26847ab1315cf7d21770a206f42ef8c3ecd3ab98014730af68c33fe5a48f4fc8ba73d0bcf8aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029950, "uuid": "b6d3183a-980e-4e70-b731-a4d953f4783c", "value": "T1534412A1B270D4F3D2739BB05E721B77ABB9FF14039186832B45BB6E7877A40464A502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029950, "uuid": "03414a72-96f7-46ed-893a-20b31449fcd1", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029950, "uuid": "9c5f0708-c92e-42f1-9fc3-cbcfae75f1d1", "value": "6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029950, "uuid": "145441e5-4ba7-435b-a7c4-aab1d4cdc853", "value": 265087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029950, "uuid": "bca4d68e-406b-4e34-a0c8-fc6ed0c6e030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029950, "uuid": "70217ab4-8bcf-45e9-9bd7-879e8e835b09", "value": "Payment receipt (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96ec895-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035602, "uuid": "12e00806-e198-4773-8021-bf0adcb2d50f", "comment": "Malware payload (Mirai)", "value": "cf288f4a4054730a80708d7468fdb002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035602, "uuid": "49d89042-5163-49a8-ba7b-1f5093602767", "comment": "Malware payload (Mirai)", "value": "70b782c4667e4a27403dc4581ccd90d1a0998a6d2f8da124ad3646f871b2d8aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035602, "uuid": "c2039aad-423a-4024-95be-9bf4a502c296", "comment": "Malware payload (Mirai)", "value": "ece0ce427369abf62d2481ab69c12e51c4dd0ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035602, "uuid": "e196c80b-e610-4656-8c63-1bea373f2f1d", "comment": "Malware payload (Mirai)", "value": "bc185496f99f13e4b7fa3f669374bc74ad8ad862f85b0f827935f55fc3533cb882a6e777072e7f789b6b4cd30e2e6c7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035602, "uuid": "25d161ae-3f93-4487-b0aa-fc2dd3a81a38", "value": "T1F0A533292406BEFB6D41DE2302C333E3672DD39A27BF499752FAA457C823D87D901285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035602, "uuid": "3f86c926-257f-4c73-98fb-ad95c9984d00", "value": "49152:+o4SgkpMcyU1HX8WILtly3+pRO1Ttr6xiObkaIEAL/csr:L42pMXqtILB8JtCBXAL/ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035602, "uuid": "2a012552-5f40-4af9-9342-416ecfd7a4fa", "value": 2264064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035602, "uuid": "443a19c7-a6e2-44b6-b2ff-5d1918cfbbf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035602, "uuid": "9a568a56-d73c-41b1-87c3-07767991106d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3916e9-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012821, "uuid": "3921c58f-f2c4-4df2-accd-dab33be1966c", "comment": "Malware payload", "value": "c16c1edc8e497fb14550d3d303022b1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012821, "uuid": "21ecff63-3336-4753-ac2c-6c783c0c9425", "comment": "Malware payload", "value": "71219a53d26f47a2c131311390e28b9281cf3f71eca94372c339b89f65d52ca0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012821, "uuid": "9b07ab2c-f576-443d-9e06-d6ef919b23b8", "comment": "Malware payload", "value": "adad441557ff653779c7057a5db5260364f4c81e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012821, "uuid": "e13d6f03-e3ea-4517-a594-641f44cf4efd", "comment": "Malware payload", "value": "60d762a5d4abcc3421690445418ac82db46a90831c7a455b0af05506f4b21287b53645a989726730a43e05b19e3f643b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012821, "uuid": "ea359270-0ee4-4782-9a68-59392f647c23", "value": "T19F932A149B2378F9653891690F5603FECA5FFC8247E01094397F37651290BAE9F92B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012821, "uuid": "e6e175df-4c01-4d73-b333-935b237ebb43", "value": "768:GDhd0i7J4sYKgY/CMNfWdX/4eLTHmiFXR5yvu05Ao49UE9xJNbXjrXxB9Q51yrAg:GDB7eKg203rdrY4lAXAk0E6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012821, "uuid": "fea8c6e0-3eb8-4d40-a080-af133b0acde7", "value": 95430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012821, "uuid": "980265eb-8d6b-4228-848b-976e25876ca0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012821, "uuid": "0b56760b-f3e0-423f-bd6e-01421293a81b", "value": "invoice-1637482117.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef61b650-1299-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772058778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772058778, "uuid": "dd1678b9-4956-4bb6-b124-df8e4d027131", "comment": "Malware payload", "value": "67159eb198ba6b5b1b54e6978c9506f5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772058778, "uuid": "1d97fdda-5822-4d23-971d-61271d880a2f", "comment": "Malware payload", "value": "71ec4ed47cce0a6c94fcc2dd9ce2d37973555f318393447a6543af4645b88000", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772058778, "uuid": "9c7c90f7-e917-4e81-a293-91b849e9c711", "comment": "Malware payload", "value": "74b1bd37a5b57d083a2268e7bc65b030d5ad3a85", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772058778, "uuid": "95e35e2c-f3db-4ffc-b0a9-d42563f9713c", "comment": "Malware payload", "value": "bed2a95f687ffa6795e22559a3722af21fb0c6a9877abde7030f10ad664d93e4084339faebc7f6c3817477926d11fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772058778, "uuid": "f37c312b-bbd0-4961-a3f2-4072b2e4d143", "value": "T16407334AE1A00AEBD8E7517AC487C960AB33B4634BB0C6CF0BB196952F17FE5057DE50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772058778, "uuid": "de62853c-7fab-46cc-8b01-5c1cfaa0e1a0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772058778, "uuid": "a71b41ca-592f-4526-9242-069a79c84b2b", "value": "393216:L85vzxaY2pm8OYFxVHFF0DfDlMpfaMPZRU8duGJ7vOamg:45vzsY2bOYFrHFF0bhuf9PZu8latg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772058778, "uuid": "1c2f42f4-1919-41f7-a4c6-049fd89eb438", "value": 17346050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772058778, "uuid": "9cbe45c3-53df-4230-9b2b-e709d2646c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772058778, "uuid": "db78cbce-66bb-4f96-9894-7ce649e87f10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb812ef6-1263-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035605, "uuid": "b3415c5a-3666-4c8d-be57-c8bfe4175c20", "comment": "Malware payload", "value": "c4f0b0be305efaccb24baaf35908cd9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035605, "uuid": "26ae5178-0bde-4cc9-91a1-3605070835e4", "comment": "Malware payload", "value": "72f11243ceebf8033cf5c20fdd21bd8e567dd091f2d1af3c9d19b2b49cebcedb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035605, "uuid": "0b8c6a4e-2b16-4ec4-901c-efb55fd55bce", "comment": "Malware payload", "value": "76a3e4fdf1270bd658729b902015190bbfa6cab8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035605, "uuid": "1ffc881d-06c0-46f3-9b34-9643bea43ad6", "comment": "Malware payload", "value": "ed443c6f46700f03b8671c1203887373349d68d47e20dd4c7b61ff5d27f80d764fbf93fd2bc7911b8828fa0a54f15562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035605, "uuid": "8ea850b2-db10-4d9d-a34a-3943d43f7bd7", "value": "T1E8A533E2F738E3DEDFA9C19078F4415D0B17FB804DA3C3816D0A6F46A6A6A57269500F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035605, "uuid": "a70fbf65-6332-4c27-a9f4-bcea9f5650fe", "value": "49152:wXUbf9QDyDt8XESQ5hfPAo0bGqqwf1ucpmkeBCiRdkDyYlRa:tbfoyDpSQ7oRGNwf4HAikQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035605, "uuid": "6e2cf9ec-ff0a-40bf-ad11-00384503bea4", "value": 2123996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035605, "uuid": "06c479e6-cbc3-4756-911c-bd042055db65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035605, "uuid": "e4b980ae-4cd3-4f95-a9ac-4bcb7775d019", "value": "ARM7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7f3919-121d-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1772005351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005351, "uuid": "5d0650b5-b898-460c-8584-5177c25bb40c", "comment": "Malware payload (DonutLoader)", "value": "e460ce81285b4ffbfd0f1e7533800eb7", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005351, "uuid": "b3e87065-123f-4a6d-921b-773ebd1a870c", "comment": "Malware payload (DonutLoader)", "value": "7311b99f21c122d90b622a81da7a81bb2d1d238001c75a68fd40f63ed6bc63b6", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005351, "uuid": "f455992d-11a2-4b1f-8273-1c8e202d1b38", "comment": "Malware payload (DonutLoader)", "value": "dbc1a512d47d968380ef6aa5123c4d4ca769b164", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772005351, "uuid": "900d28cb-7171-4e1c-90bd-9bb9a5bb554b", "comment": "Malware payload (DonutLoader)", "value": "5e2e2f19470b0ec0e567ab098d0586f9f16fbe02b420506960268eed6e3621725d4d20f427dd22ab0073a77276694cb6", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005351, "uuid": "37d60a65-d141-45eb-8dc2-16e01de62333", "value": "T196E312D6EEFC0B11966032E5161CE6873359BA991AC07E253467FE35AE073AC796020F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005351, "uuid": "073493a9-44e7-47f2-b198-e1ec6069da46", "value": "3072:YRyMtV6Or1zUc0w3pbR8t2bcRPom0zsghwRUD6iZlsG:YHPbU9w5bm2KPN0wgTDBzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772005351, "uuid": "d3142995-0afb-4302-a333-ac8b5242931c", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772005351, "uuid": "af48c42d-00a6-4d47-8b07-bc26e20d4856", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772005351, "uuid": "f9baf868-fc2c-4d79-8b09-e85b838fa51d", "value": "New Ramona Agency Nomination Letter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25289338-127d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772046412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772046412, "uuid": "894ed141-b2eb-4367-ac02-8fd8d7bf5a8e", "comment": "Malware payload", "value": "0cb3c718d82e65153d293823337ea954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remote desktop", "colour": "#B19F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772046412, "uuid": "2ce122cd-5674-4d6d-94ed-72d4d7a7df78", "comment": "Malware payload", "value": "76ff32d6e2d2b4d17ba8ad0a011ca924f3b6003991aaeadcb278fc08b66182bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remote desktop", "colour": "#B19F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772046412, "uuid": "408d6bf8-9627-4727-849c-32799f6583d2", "comment": "Malware payload", "value": "2442b610eb8e7a913a0a05cae74a476146e40cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remote desktop", "colour": "#B19F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772046412, "uuid": "397ec47c-2369-405b-8ab3-7e4a9d57ff7f", "comment": "Malware payload", "value": "e627e2b9237468351f5632e6fca302903168f9352c2b2c28b4aa7a1b9833080520683d38fdcb9d1d4ce23ad1979965e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remote desktop", "colour": "#B19F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772046412, "uuid": "2b7fec7d-2619-4f2c-9d98-688fbef1830c", "value": "T1BFA64947F8A549E5C0A9D63185769223BA717C480B3123D72F60F7386F76BE0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772046412, "uuid": "14aa0b2d-e51f-4ff1-a95a-4b26fe26e63b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772046412, "uuid": "3a87e250-d9c2-4827-9b59-8613956a1835", "value": "98304:o2g9zRcQHPPKqZ7Fvpu7bQBnNt93+xCkl/TZZp7iEo:oz7JPiqZb2bknNtZ+4kbzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772046412, "uuid": "d76fb432-37b9-4950-8bab-f4f8556ebf56", "value": 9674752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772046412, "uuid": "34289cad-9b7c-44cf-bc62-3b3684fbf760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772046412, "uuid": "5b712b5e-e969-4d92-9b22-aad911b24eb0", "value": "FemloveLoader hackvshack.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9ab75e-1256-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772029970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029970, "uuid": "413a8120-3e8a-415c-890a-89ba06098cc6", "comment": "Malware payload", "value": "d4529ca79783119c5c7779879f24b17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029970, "uuid": "47805031-ed3e-4fdc-bef1-23bcf96bc824", "comment": "Malware payload", "value": "7700a90cf3358872441c3ab23f9e05457b92ee8c7d522749b173a6470b9574ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029970, "uuid": "f31a47a6-8aeb-4b6c-892d-714942be4d08", "comment": "Malware payload", "value": "6106a055820dadfc43c69b6c2e09b85aec4debe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029970, "uuid": "9bbeae1e-e9d8-424e-9187-6081c5527b1c", "comment": "Malware payload", "value": "21e7dffbff2dbc5b11263b7cd8ed594f5d9edc254d8d683bc4faecc742becfafc0e48118aced009317ae6aa4d42aa456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029970, "uuid": "f008e93f-7751-4d7b-b07a-db8ae8c1519c", "value": "T10E65224873A9DD13C8A646B00A61F2766BB01EDCA426C3074FD5BCCBB87A3E019D5797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029970, "uuid": "2064c5c3-de3c-45b8-a35d-1e22d2c76601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029970, "uuid": "e282db9e-625c-4c12-9a09-3a6e81b37965", "value": "24576:aMPsm6K/FUHPNMfY5ctDHYUhanY9+xpuXSp/zumH/zqqlz+x9xlQG6ksz/F:icUFQY58HYUhaYsxoXurusZ4jQGu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029970, "uuid": "83950484-8dc5-43ba-a713-8c51e15f7d9d", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029970, "uuid": "c4af0007-a2de-4c2b-8409-0ca89bff73c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029970, "uuid": "91f855a9-0f00-411b-9e41-37185a858950", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e00f3d-1244-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772022204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022204, "uuid": "c7714835-cd6a-490b-92ea-10d46eab1070", "comment": "Malware payload (RemcosRAT)", "value": "39d086100132262c09ff9b715f918682", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022204, "uuid": "801db1ff-3dda-43ad-a69d-29ff6b979318", "comment": "Malware payload (RemcosRAT)", "value": "775404da9923373351a1042703db8bc9a4929f2cb15056caebf7208b2671537e", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022204, "uuid": "114dc06b-740d-4b4e-8a8f-362c3a757771", "comment": "Malware payload (RemcosRAT)", "value": "54ee4d3ba594029e73df4abcbe2b44ee633bd492", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772022204, "uuid": "b9b8f3d3-472c-41be-9fe8-9fa157b021d4", "comment": "Malware payload (RemcosRAT)", "value": "0b644aaa1c7c9a399edfbe5e3b36aa37e9ed62b48ecfd4e47ccaf4186baec37789619bc88dc3faee735239474b7d62eb", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022204, "uuid": "96572c86-cad4-4e0a-bd9c-0255e70a95c9", "value": "T11BE5BF029E7A55DDDFD84527F4E774AB11B086BC40617C1E7BFD6866CAB308CA2B3281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022204, "uuid": "4d17a4ac-dda8-4a36-8abf-bac547c484ce", "value": "24576:vrjfyEwPFUwrqSQ/j13QpUMa9pequZDCCAX0dpkyI8fWTYJ0naOC4MN3wqf09kPj:nbMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772022204, "uuid": "5aa47a97-bbc8-4bbc-8d68-69bd35527378", "value": 3264120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772022204, "uuid": "d244fd84-9f46-457d-91c6-c1931dda819f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772022204, "uuid": "725e88cf-2ed3-4af9-b6c0-4a79fcec6a51", "value": "Shipment Documents on Hold Feb 2026 Updated.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da1265d-1224-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1772008175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008175, "uuid": "62caa895-027c-45cc-996d-5133c044c545", "comment": "Malware payload (Expiro)", "value": "7f1ea05746e761c5a3dc7fc622eefaae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008175, "uuid": "c3373a6a-fc09-4991-a0f8-b78c4b7db77b", "comment": "Malware payload (Expiro)", "value": "793812ceaf3412f75c5ef2f1bfacaf87430e0015a91402bf8c9d8f06e20b910a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008175, "uuid": "eb951544-e487-481c-9126-211ca858dc96", "comment": "Malware payload (Expiro)", "value": "762a59bff58f2fd7f538fc9ec230b69ac57befb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008175, "uuid": "89e94a35-05cc-4086-88b8-67784602bfc6", "comment": "Malware payload (Expiro)", "value": "bdb7726b7286cbad1daaa4d7dbfc4750dc5c74f486501738da819b00cba057ca8e11824d2bca3abe85608f1e87003bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008175, "uuid": "81a530fe-a9cd-49cc-8db5-698b076d7be5", "value": "T14585D00273C1D062FFAB91334B56F6115BBC79260123A61F13981D7AFA705B25A3E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008175, "uuid": "d56bf99e-ae76-481a-bfbb-c85cac012fc5", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008175, "uuid": "43598c83-0508-4571-9fc4-0777e2dbcd1c", "value": "49152:EPVtdLZeJbInQRa9qXLNiXicJFFRGNzj3:6pYbInQtX7wRGpj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772008175, "uuid": "1fff518c-c3d2-49fb-9920-139f52a25759", "value": 1707008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772008175, "uuid": "56014452-795a-4f97-9968-61e5fd4d2d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008175, "uuid": "989435f7-ff4c-44a3-8150-c9591cd827b8", "value": "TNT Express Arrival Notice AWB 8013580_PDF_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6cb576-11e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1771982488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771982488, "uuid": "404e4d14-2002-4f30-a68d-5ffdbc88667d", "comment": "Malware payload (Amadey)", "value": "29356ad3ec3359aeebc69a8573271581", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771982488, "uuid": "d40adb9e-423a-4205-b413-b776adb37a94", "comment": "Malware payload (Amadey)", "value": "7969fd3648138292a9398f957f809ca67d9f3a1a9af91f7ac75ca5b2fbe3242a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771982488, "uuid": "45ae18b3-648e-44ce-9973-56d385fdc16b", "comment": "Malware payload (Amadey)", "value": "c29f6f1c92a32211d52f42bcab11e78d857b72eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771982488, "uuid": "92ebb303-9ac7-4fe6-ab2b-86cdca92196e", "comment": "Malware payload (Amadey)", "value": "ce4ae7bb060253ca93935e8b8295def45f29d4826593c6d0c9bd1110d1312735c67b1e50c70425ed6d63ba021b873005", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771982488, "uuid": "de8c7253-5ab2-402f-be19-efc84508460b", "value": "T186170112B9AD16F5C5FAE1388469A211B671386503317BCB0BE816BB1E37AD46F3F314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771982488, "uuid": "2e0a0b1e-a0a0-4eb5-93e1-cb22da41c8db", "value": "5175da4b99d292f751a152b8e78310d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771982488, "uuid": "0093b45b-6f0c-4509-a897-91dc156f482e", "value": "393216:OJiQipGmSn1yNdq1B7iR0gpHskqSPjZpiqbH4a7ho:sien1yNg1ABoS7Zp9bH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771982488, "uuid": "67e9381a-c361-4e37-a0f0-e95684b12983", "value": 20044288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771982488, "uuid": "896d6add-bd09-4af6-b21f-1f0fbc44cc34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771982488, "uuid": "22d2e76a-977f-45cb-9cf2-5477d989332b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af1adf8-124d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772025940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025940, "uuid": "e3d0dcfb-3587-4645-8b99-0d4c327fa996", "comment": "Malware payload (NetSupport)", "value": "0ba4c041327585e73d0a9568b9271561", "object_relation": "md5", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025940, "uuid": "4fbe851e-57d9-43b8-b1f6-cfdbfe40c334", "comment": "Malware payload (NetSupport)", "value": "7a533d2d794d68fd23ccdcb63847ba51b3403d865027e4cc944715e56e9fc1c8", "object_relation": "sha256", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025940, "uuid": "b4d43b1b-98c2-404c-8855-c98ef7c0c871", "comment": "Malware payload (NetSupport)", "value": "0f0acc0f81df21d71ebc117943f18d77bad1af16", "object_relation": "sha1", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025940, "uuid": "2f2c9b6d-9020-4b0c-ba8b-42ba4170e576", "comment": "Malware payload (NetSupport)", "value": "cace01f8722a1225a54b69370026d8660162b3b20b7eb6c33a55e5172698312970b478018d501ae8cafbad6dd9c6481a", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025940, "uuid": "e048e163-1351-4212-be94-cbcaeb2487f8", "value": "T12BA2D012729D7567FFA556B534428A004FF3B84B63EF6090E6C0E8EABC716784BC3452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025940, "uuid": "6f278540-9499-44cb-bb5d-72ff059a3ec3", "value": "384:l2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfHaviw:l2+x6TLKQXK1myQCSr2VS4jTXaRnPPah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772025940, "uuid": "c3a71a3b-e5ed-4ffb-b73d-e59c660a89e8", "value": 22238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772025940, "uuid": "80d9b6c4-ad7f-4d38-a75f-26addf36dee1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025940, "uuid": "cc487e6d-afc5-4621-8bc5-76461b9f8773", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d38b37-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035939, "uuid": "f722b438-ca8c-45c0-85c9-b953539eb288", "comment": "Malware payload (Mirai)", "value": "f61abdc248517c83647d601b40d068c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035939, "uuid": "5fa9c14c-8a19-4e16-a11f-b980477701de", "comment": "Malware payload (Mirai)", "value": "7a98c448020b89db9ffc4b1cc5176949fe714d927cadf4b3c42936d923c901c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035939, "uuid": "09540259-de1a-467d-b26f-8cd34d9b969f", "comment": "Malware payload (Mirai)", "value": "017cfe5f61fd6e2969ee85aec5c2899408171b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035939, "uuid": "c7f32b7e-3a3a-409a-85df-d782e7796a5a", "comment": "Malware payload (Mirai)", "value": "c5d04d1c2ef8a5057c80cbada554ea58a9fb41cb125d3e573b83a94327422b52fa5d407c693c06f4d5e8a446e4fa53ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035939, "uuid": "3ca0c364-9086-433a-a253-f5c277bd1b02", "value": "T18C960811AE862F67C1DC077440ED62A672A43F455B91432323A4EBEC3E7773DAF56888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035939, "uuid": "92f927a1-9eb8-4db8-a00d-1601e14fe316", "value": "49152:KTEpCkLT66sPl2lT3U/EYHRYyqCjTT78lWYZu+GbpvKE3Wam5EJ:wYD/1sPlOTy5LdvWEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035939, "uuid": "06f59ee9-8951-4bbc-a6bd-9adc93cac353", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035939, "uuid": "e491d930-9bd5-40a6-8236-69a2a08c9a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035939, "uuid": "e4521bff-3acf-40a7-9534-36364b93927b", "value": "MIPS64LE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c589ed02-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035944, "uuid": "bb55b38e-6140-4109-9b29-8470f341ad30", "comment": "Malware payload (Mirai)", "value": "043349a9ccbdac98bd05a671ab3bb2b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035944, "uuid": "de4cd723-8435-4ab9-887b-654ba820db9e", "comment": "Malware payload (Mirai)", "value": "7aefff4c9866f16a8073f78d1a0c922da2f9cbbd4b51d2fa8928497ce6451c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035944, "uuid": "e0e2e703-54e5-4088-afe7-46138613cb3b", "comment": "Malware payload (Mirai)", "value": "2ef93cd85fb34eae0abdcefae7428a1fe5a7c9ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035944, "uuid": "2e0c4b7b-957b-4925-8c3b-c33ad91a015d", "comment": "Malware payload (Mirai)", "value": "42ae38fa6b1bbc706545fe38e072abf37121a45835fa685d7f4657545bfa3f9e02afc174d09174fc7229fe2735697627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035944, "uuid": "119c92bb-1f50-479a-9140-2988b675a706", "value": "T19E961A62BF98DE1FD2A431358AB6C23833D53D0182A061379612F7192FBE2B59D17DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035944, "uuid": "f01ddbdc-d353-48ee-80dd-d5102b59d7f5", "value": "98304:ANLEr8160kEFpidehzwMBYkea0Pvsj9cDRgA/1ojkkzAP1ovbRHMzVKlXjBqCluF:gq87Rod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035944, "uuid": "42338644-4c3a-4394-ae9f-b61a5650fb83", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035944, "uuid": "48453521-4e91-4d65-a532-dcdefeb5f33b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035944, "uuid": "73201239-c38c-44db-bd69-aa5cc5aa3097", "value": "MIPS64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c8d9e9-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012988, "uuid": "480ce7c1-4f14-44fe-acb5-16ac46ccdfd5", "comment": "Malware payload (Rhadamanthys)", "value": "d740be8768475b15f19afa1aa1c92d3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012988, "uuid": "62a00129-6f33-487f-bcc0-24bb62d8baa2", "comment": "Malware payload (Rhadamanthys)", "value": "7b18e6ed0518337b0d3286383127184a1e582b8570bd40c629df7b37fffd685b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012988, "uuid": "92d25008-8698-473b-b760-c6345d260c26", "comment": "Malware payload (Rhadamanthys)", "value": "87868a3be20b67ce503d5c3882aae20484298c1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012988, "uuid": "99167127-2be6-4c76-b0f4-af64cbe5287c", "comment": "Malware payload (Rhadamanthys)", "value": "d297624373643fdee5f39640a5ea8c303467df3e35e6066adb338b3e46a18acc2d1a74b058bf62a7e87e02237bec61d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012988, "uuid": "f4e99a30-5e89-4eb0-ae99-fac5edf90c16", "value": "T1B59309469E52BFC82C987901AF8B29B146689B063274C79B521EF793F7D8B3C18471D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012988, "uuid": "739cdbac-ae2a-43ba-a915-16e617888643", "value": "768:GDhd0i7J4sYKgY/CMNfWdkhM+zfDQFVUtT3ck/ANIY/my5EbpLLgSxqGxVSApXGb:GDB7eKg20nrorP448wA8/36BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012988, "uuid": "1919db51-22ec-48c6-8d42-d3c001ca339d", "value": 95467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012988, "uuid": "fe005b5d-d568-43b9-bb18-df61289a3df7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012988, "uuid": "ff7010ea-f193-4476-a8c5-1f2ca29d6794", "value": "invoice-1637482117.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabd4aa0-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012760, "uuid": "a95a1fef-78a0-417a-92db-95a597fc119d", "comment": "Malware payload", "value": "51cd0bfde416ff923152f93750885cbe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012760, "uuid": "58f6b20a-2b8b-4af2-9e20-6289b265a13c", "comment": "Malware payload", "value": "7b6410c3364b09db8a9e56aa2407bb52bb25b02e4063b7af40ed019d51fa87e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012760, "uuid": "45be2c12-d982-4295-8813-d6dcc089595d", "comment": "Malware payload", "value": "bb45625c0193675fa21ba3f0a49ed49346454b81", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012760, "uuid": "d5a06e63-d21a-475b-8d8b-87f49ab12754", "comment": "Malware payload", "value": "17b742588414f05ecaadd68fd8f26d3d9a3355809a6544c6ad9a8d0aa3ea947722b9916bbbb8b1e0a7bb843dcbbba009", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012760, "uuid": "afe6ab78-ee7e-4554-905f-8774f4d9ead2", "value": "T191A3FA93057BEAF9429EF3609DD923FFAA4D94F32A095384626FE732CE04642651D4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012760, "uuid": "54b4526e-9bf1-4389-9238-6d7cf87e4c73", "value": "1536:GDB7eKg20xJZ1MX3sHRnv7OsP29iEkule4X60msB52Aql+fhiShdkZWr0rTGNrx3:GDB7b0Gf7CkAT6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012760, "uuid": "89c77d86-4215-415e-afe3-1bc34bfc65b9", "value": 98150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012760, "uuid": "9998ca07-1b56-4673-a9d0-c9cdbd2dea72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012760, "uuid": "a703f0b5-8e50-459b-b789-e151de11e4a5", "value": "invoice-1637482117.pdf (94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3a45b8-1260-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772034237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034237, "uuid": "e6c59fa0-a7a4-40b4-875a-1123b5ea0acf", "comment": "Malware payload", "value": "fc8b1d3e3a3cf6016b32468ac1eb831e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034237, "uuid": "0fb8cc87-ea2a-430f-968d-fc343735590f", "comment": "Malware payload", "value": "7c3fcca703baa7116ca39cc90bcd506d0212ab94c7e21b9871418eb5d4764c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034237, "uuid": "23bde416-f0e2-41c7-818d-c34103dd10a5", "comment": "Malware payload", "value": "74eb79ef38795a8b539c380bbafd48608d8d12f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034237, "uuid": "7e837f92-3923-47e2-a514-f33fc7ad0226", "comment": "Malware payload", "value": "cca6c66838df5e027f53d627dae0f38305547b56dfb4bc5228d4c419d358a1ae2e43dba27155ffd3d73f9ca7abdcceaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034237, "uuid": "cb09ccbc-939b-4e6a-8a6e-bbb6e959a03c", "value": "T131871256E2F900E8E97BC0B8C6575517EBB1344517309BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034237, "uuid": "73be1df6-8a9d-4b42-8ccd-01f0a1430eaf", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034237, "uuid": "ce5e0337-ceb7-44ba-a22e-7d11dfb89f5a", "value": "786432:35XjhtzhWNsKpjGct8To61nEPwd49C880XsChi:hjhtzEnpjGi8T1nEPtw8z8CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034237, "uuid": "35133c93-5133-43bd-9d5f-2fe19d53313f", "value": 36214056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034237, "uuid": "05e52e7d-68a9-46c3-8360-93a93c626eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034237, "uuid": "889bd0c4-677a-4f7f-b2f1-3f7d0e2ba971", "value": "BLACKHAWK_SUPPLY_LLC_Transcript.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b273b7de-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034624, "uuid": "4021b292-4ba5-403f-91ff-88746ab67ca6", "comment": "Malware payload (Mirai)", "value": "784760d549282600c8a4437e947d2737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034624, "uuid": "581b386b-beeb-4084-9082-acb28aabefb9", "comment": "Malware payload (Mirai)", "value": "7c89a27d2077d008598d0aa1a3f26a5b4f8f17ae7f727ea3fa62622661c40193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034624, "uuid": "dc0e785a-b43e-4867-a975-e7e9c5222e52", "comment": "Malware payload (Mirai)", "value": "5f310f7629e806aa997ea1bccccdbcfb8c1b728d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034624, "uuid": "8038272b-528b-4b15-a710-c5b70e8d66e0", "comment": "Malware payload (Mirai)", "value": "5f86ce8c951de793cee11008d473b41d80a48377c37eaa1b342159dc23dcff9e642a21938067d9260ece9f649816b7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034624, "uuid": "c749cb27-529e-40e8-abe6-ea8c333bce85", "value": "T11D73C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7934D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034624, "uuid": "c723a87b-16fb-4005-896e-eeafde094973", "value": "768:K3sJmkq/lhWHgJvd8p6Et5Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnjS:KcJmkC1u5B4RcBvC8W2ZpMe7+pcI3nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034624, "uuid": "130dbdf8-e7b9-468e-b595-ac5f97328c4a", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034624, "uuid": "d60699a9-11f1-41e3-bd67-2afab52fdb25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034624, "uuid": "4245215e-b38b-4c98-afba-03b18e395a18", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4463dc5-1212-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772000696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000696, "uuid": "fd0b29aa-5e82-4e33-9c05-7739fcf35e90", "comment": "Malware payload", "value": "3a5d04b770a3e487ace30b1b0a215d8c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000696, "uuid": "6ff1228d-9088-4188-8089-98cd7f412983", "comment": "Malware payload", "value": "7cdc63f6cb960db552cdc88e96315b0dc6a7f1418afa452ae325c197351fa8de", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000696, "uuid": "23b03e67-6c2e-4266-b990-e5c1bccd2c5d", "comment": "Malware payload", "value": "34083cdd103d9cb40a2b8cd97d740aa042d4a0e3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000696, "uuid": "ef5ab633-50e6-4217-8640-89631f2f17a9", "comment": "Malware payload", "value": "0552d6ea503c8a9fa7dfbb4cdc4bd77ddb5dd56a489dd642c8435b5cad36bd6e3f525c42b8b7bac0c5e465489546cf19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000696, "uuid": "2e759d8e-408f-4980-bd86-ae3101fda628", "value": "T1DB44227D91075D516ECABF846C2ECE57F780BC75386254932EE4F4C18D9A2CD928A30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000696, "uuid": "80945a17-d7fb-4a5a-9b45-5a658d1371a3", "value": "6144:DWSMVeHKEUd0Qx6F2v5geRiC+A+gCxitIC+C4vzMBYNtFyEyLd:yRVeWdbO2xgecVlgQ/vzR7FuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772000696, "uuid": "1fc7eaf3-f202-4e85-852e-722b3d5b2fe6", "value": 264501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772000696, "uuid": "aeb18222-3915-4a3d-bff2-1c9aa50f2ac6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000696, "uuid": "0ae5da40-5bf7-484a-96df-081e0cadbfaf", "value": "Louis - anti fraud & IO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadeb0ca-1267-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772037295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772037295, "uuid": "1595ab38-88aa-46d9-bdf3-05df6e8b02eb", "comment": "Malware payload (Mirai)", "value": "a53a4562413a863be84ac7264d9f29ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772037295, "uuid": "1ad8d8fa-dfbd-447e-8ec0-f9d4ceabf0d0", "comment": "Malware payload (Mirai)", "value": "7cdf9b7eb8e2e7d3348c078254983128382e292b94fc93ddc34ec57ff171b506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772037295, "uuid": "92fbfb08-3886-49a8-b2b4-2b5470faf2f4", "comment": "Malware payload (Mirai)", "value": "d8db3fbd71c1f4289e0668b21c1391a1b27dccce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772037295, "uuid": "48b47594-8135-427d-9181-cd09ac74780e", "comment": "Malware payload (Mirai)", "value": "5f1ac391c5360fedcba12431f79258e58ecad0df8364c8bceb89e02cf3fc78296c927e6dbf9cfd298407c949e826a841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772037295, "uuid": "8f26c0d0-93b6-459e-ac07-84ce0b01e450", "value": "T1A203F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772037295, "uuid": "1f1a2fb0-c0b2-4853-b321-0beec9e69d76", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTN/NMwWY:AfWb8G5fblUlfbgeaUv+fE6HWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772037295, "uuid": "0b060e30-343f-4384-b24a-96ab62245fee", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772037295, "uuid": "ffedb8d4-ba7d-472e-abbb-dd4a2885a8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772037295, "uuid": "ef5d399c-e357-4655-9801-2bd0092a3e4c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f051ebd-127f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772047315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047315, "uuid": "f1326a80-bd23-4ea6-b4c5-9270b80fa9f8", "comment": "Malware payload (Mirai)", "value": "5ae78723f1e0c2e3ee0959559af130ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047315, "uuid": "17897b87-61fc-4af0-a26c-c267310d9636", "comment": "Malware payload (Mirai)", "value": "7f261643ff3f873f0a4e59ef047e351ab9d854abd11c567a99ad14d999d73afa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047315, "uuid": "54df7014-77e1-4762-9729-030192bdc7a9", "comment": "Malware payload (Mirai)", "value": "fb0d909c167de627357a5dede0216ca1b02d0f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047315, "uuid": "8e0db0fa-4008-4023-b404-d8bf6e27d2ac", "comment": "Malware payload (Mirai)", "value": "82d1e9ce990c7a2d350f105c65e0bece8ae44fe26bd3cec0bd74a9de2431fbacbbbce7397c8ba21bf66674d91ddc6945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047315, "uuid": "ce829643-6dbf-4a56-82af-a989235d4a1a", "value": "T199B35A13B4D190FDC4DAD2784BEFA216EE72F05A1239B25E23D05F263E1EE206B5D251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047315, "uuid": "3ba2040f-37e5-4534-948e-3b00369dd755", "value": "3072:gJiQwIGN+uVzlJDSKyQr6nKLk/NjrcNAZgXV/q9K9LGHH65k:gJiQIBbJDRyQr6n8k/N3XgXNyKb5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047315, "uuid": "6eff980e-3761-49ab-b560-afc74e1cee6c", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047315, "uuid": "3ada7232-c20c-44a3-8d1a-3b4a5168f6e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047315, "uuid": "7523d1cd-b671-4339-a660-bd68a78710a7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8958ca4-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029909, "uuid": "164cfec6-c2b0-42b5-9ef3-9553536933a8", "comment": "Malware payload (GCleaner)", "value": "8b7123ef025599d15146426ac94ed43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029909, "uuid": "f9814d48-1751-4b18-83eb-74a1701530d1", "comment": "Malware payload (GCleaner)", "value": "813db06e23d3af4e7e560b89a5bff0e49f1f0dfb52f0d3de8b0766cd77cd9ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029909, "uuid": "876e942e-d635-4c4c-86a7-53bb9694c5f5", "comment": "Malware payload (GCleaner)", "value": "5ca2dab88168f00151d30bf0ead648a59f63c42a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029909, "uuid": "c3b95149-96eb-4726-9012-c63bcbacd20a", "comment": "Malware payload (GCleaner)", "value": "47146597cab429c22c74c3f5e6f381181cb77695b4db37b3b074d77a124bd413b8947a983480630b5538fcda27f974b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029909, "uuid": "49857bf2-109c-4c1c-adf7-5957d34051b6", "value": "T1B055AE22B1937032C17E16389C7B57556B29BE112E38B84B2BF51DECFEF424175A02A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029909, "uuid": "835a0d29-15df-462b-aee7-6a576114ddea", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029909, "uuid": "5df39009-45a5-4286-aec6-6456a35e8dc2", "value": "24576:AVwXV4HSmYq7MPPfEd+epgLdAu/5o84dE:xcOfmBg51/59v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029909, "uuid": "2e4af768-0007-4da8-b08b-7503688775e3", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029909, "uuid": "cebbd997-eeba-4ec5-a521-92eb44089d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029909, "uuid": "79384f05-80cf-4cd2-a0a4-34f2f865ba7b", "value": "8b7123ef025599d15146426ac94ed43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22088bf1-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035670, "uuid": "9e598f7d-51be-47c0-b5a6-e024c2cc3d69", "comment": "Malware payload (Mirai)", "value": "e7b80e02f6a8bc3474e293a1a9da3882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035670, "uuid": "477386b7-739d-4e12-aca8-f3eb26619675", "comment": "Malware payload (Mirai)", "value": "819531ec365a50d873244ae503650dee13e8481cf93dc0fec0581d872a05f81f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035670, "uuid": "16fc9973-e0db-42b9-a736-48580981b50a", "comment": "Malware payload (Mirai)", "value": "9074f4d87209565a3b873207cd2d9a8748833463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035670, "uuid": "8f83d7d6-4e7f-4424-8042-8fdb450146ee", "comment": "Malware payload (Mirai)", "value": "e72f2f3aff9e9f3d8d485d200197c06fdea7c30c66bf263ccb57faa917e93dbc534e886686dee3fd486d1cfbfc0aa51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035670, "uuid": "6a03cc8b-503e-4ca0-92a5-53706199f87f", "value": "T107863850FDCB14F6EA031D3154ABA22F23355D098F24DBD7EA04BF2AF97B6911932249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035670, "uuid": "9ff5900f-1095-4caa-bcdd-08a34c97f1b0", "value": "49152:lqR/ERlVt68DpNlD71UT5N6YylFNE1n24k3lCUkKocjwic1XFJvYIa+IielgIkN7:+cRlVt6wp1IymUZoCwiCJ0YrxwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035670, "uuid": "c6953d86-3333-42ac-92c1-1319833284d2", "value": 7972768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035670, "uuid": "413d307b-573d-48cc-9ffe-8aea82e7045d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035670, "uuid": "9076930b-8925-41d3-8d54-76ab36a8bb74", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf10d086-120f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771999426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999426, "uuid": "b0f84995-b1ae-4d58-989e-6eba9c97e651", "comment": "Malware payload", "value": "64af4e6216026ed8fcfbf8b07ee20707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999426, "uuid": "250ef6e2-e9e6-4541-a349-f3646af533b9", "comment": "Malware payload", "value": "81a6e6416eb7ab6ce6367c6102c031e2ae2730c3c50ab9ce0b8668fec3487848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999426, "uuid": "7780352c-9a4c-46b2-b083-881effe13498", "comment": "Malware payload", "value": "efb18cf7cf227037e034c0b525f502e642815f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999426, "uuid": "9295f15a-1283-484d-83a4-bdc8597fb978", "comment": "Malware payload", "value": "c313d2605984c38f41bdd59d1b313e605123c18877cf461192c164b04b105c3c2411d48e58cf435235d14cf741c133e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999426, "uuid": "771df41b-730f-4174-9383-53ab323e9e87", "value": "T158E53943E6A680E9C469C474831AA333FA72BC8D473576EB5BE44B353F65BD06A2C701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999426, "uuid": "18070425-eb64-4964-b1f7-f928e3b96fd8", "value": "501c910938c2a0d757002d8397c3699b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999426, "uuid": "29c1fbfb-74fa-4694-bdd4-a641a931f96d", "value": "49152:aAJasiBKTMhol4oOIsSaYOcgBOePBg92yL6uU6/i3vHUPeE2GWF46C:5yomf7Ir+XI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771999426, "uuid": "299b0b88-e634-41bf-83fa-7e0d8021314e", "value": 3276288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771999426, "uuid": "47372351-6fad-4d6a-b6ae-91e2f2742283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999426, "uuid": "a75d4e7e-9723-4c06-a5e8-708c32baa866", "value": "81a6e6416eb7ab6ce6367c6102c031e2ae2730c3c50ab9ce0b8668fec3487848.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759dbf2a-1229-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772010470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010470, "uuid": "c85a78a8-0549-4b45-ab52-f2517f579965", "comment": "Malware payload", "value": "62531f8b67be425f2fb812fba26abffe", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010470, "uuid": "b8ceb8f1-e677-450b-af25-a33438d17032", "comment": "Malware payload", "value": "8271511f8abbe34df859cbc8cfef0908853cca9edd0660a1e98d55917c15dec9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010470, "uuid": "e2f36695-937f-4f92-809c-dac5df3ebd88", "comment": "Malware payload", "value": "4e7edc9c01ff9e4aa8e26077a195654a991c095a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010470, "uuid": "e168b50b-b6ad-4ff3-9ce4-d6156f9b58be", "comment": "Malware payload", "value": "357c5db0f1334d6bc230f310b3c208fec66daba80af50e8957d5035cf79d42f4c3217b327e97504c42e15cd75e95ae1b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010470, "uuid": "79d43a90-01ca-40c7-bcd1-49fbda2e9736", "value": "T105C423B7179AB0897503E3E4854C6D9489AF20D957C3436ECA1E2693F5BE147FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010470, "uuid": "708cc34d-7a21-4948-9f30-86c79ebf38c7", "value": "12288:neElNtIBB2gX3U5SA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezk:neSIBBfH0m6Jj6ESfUxZ91kmY/9Heo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772010470, "uuid": "47689cc4-4c43-46d9-afe5-80639a4629a2", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772010470, "uuid": "f999285a-5727-4e57-821b-c72f44789620", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010470, "uuid": "282c66fe-0fce-4da9-893f-5e31a1fb2a34", "value": "Matcha-Roblox-v3.9-beta.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7111b6f7-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013039, "uuid": "68dbe8c9-041b-4a01-84df-d544722294b9", "comment": "Malware payload (Rhadamanthys)", "value": "bdf16371acea0b013a6aa6d80f4e9f13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013039, "uuid": "bb71ba7f-2438-4134-8c75-a84b788063d5", "comment": "Malware payload (Rhadamanthys)", "value": "835f9846af0a68954c2c33ad79ece7fde74d8142e58153582aa19cd3b4f253a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013039, "uuid": "309c4320-e057-4e3b-a9b8-20b46718497b", "comment": "Malware payload (Rhadamanthys)", "value": "3161c206cd691939f8e9d996fbbbbbfabbb64540", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013039, "uuid": "2a33849f-abba-4592-bf84-0925ddf991cd", "comment": "Malware payload (Rhadamanthys)", "value": "381fa8e58373cd8390a20b40f58451b3cbdee8566a0dce506f945bc85021d9b0bb7213b040821209183c03bbe8510dbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013039, "uuid": "1501c615-9984-4d61-95ce-b4666dd745b8", "value": "T1BAA30A04DA73DDE40E919A374D863471CFBEABC8E6066087665BB113416CB2AEC2F5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013039, "uuid": "3a5cf230-7625-4f97-a135-0a934c14265c", "value": "1536:GDB7eKg203oH/61sXja8+DA99w7HyBoDsoMIyedtKgn3rBNJgXer4BEa2FZgGfON:GDB7b0BRTAIms6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013039, "uuid": "f5a17a05-9962-4ef2-9a78-737e70df3d6b", "value": 98020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013039, "uuid": "2dc2dd4c-520e-48ff-a7ae-dc7300958217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013039, "uuid": "820ff98a-7e8d-46db-a1a8-a3ca6301e161", "value": "invoice-1637482117.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55474e3-120d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998524, "uuid": "13073e6e-8e04-4801-9849-40a8453aa75a", "comment": "Malware payload", "value": "91c5679cd20f708d4456e630a4cc1da8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998524, "uuid": "8b6be45e-66bd-4837-970c-16dc8d4d2f02", "comment": "Malware payload", "value": "8368559a3318d2c5d6ff3b7f96afb00389dcde0007297fe8ed8e504fd3da282e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998524, "uuid": "062ffb6d-2d53-4964-95b7-a5b2712f0ed9", "comment": "Malware payload", "value": "1c854090400090beaf3fb7640ca8f2f37f0b78ff", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998524, "uuid": "5948b36f-b547-4e35-a57c-5bab44e18894", "comment": "Malware payload", "value": "28b7efff87abb34ab7f66d2c4f8f8eea8908504f11cdc72660ccfdfa10d9396fd75aa789cf5e47ee61500d77abef2617", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998524, "uuid": "4575fcd1-142f-4bf2-bcb2-39c71b25af62", "value": "T1FCF4CF117640C436C2B70A365669C6641A7EFC306E618A9B73C43F7EEE317C1AA24B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998524, "uuid": "3e3490d8-5df7-44f0-9101-10a2321c45ef", "value": "12288:sRsNW7ehwj4lkauPx5Ki7BvmZGRiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmC:syNW7nvUAW1lKwPOvfcvUnGJJulXvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998524, "uuid": "326eef2e-95e9-4491-87ef-079c9f0bfde0", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998524, "uuid": "22c83e5a-9c43-4ad3-a84b-6bfd2c4fc8a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998524, "uuid": "0f59ed84-00c5-42ac-8d56-89bc1fbd6c0c", "value": "Drake_version2308378183_go.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749052fc-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771992000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992000, "uuid": "463c1e08-5c64-4ebc-beca-e5ea45eb596c", "comment": "Malware payload (Mirai)", "value": "218ccc12742f59090849111275799954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992000, "uuid": "c06d78b5-2586-4c02-b4e2-cdab9c854a93", "comment": "Malware payload (Mirai)", "value": "846f134b3303bcc2d840a9e39cf3fffe9f3e9f2e6af6eae4bfd364d53b057385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992000, "uuid": "c606457d-f94f-4e4d-a5ab-7a4b5fb0588d", "comment": "Malware payload (Mirai)", "value": "33205c7c5d522e8ff3c23ed63eec73048735b4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992000, "uuid": "1dceae3e-8d33-4cd7-8626-4bb90326399a", "comment": "Malware payload (Mirai)", "value": "9a0bd1af9778055d82c7eb5eb50ddde3e24203821fc1de85852147054403975ae1f1e6a34143f05986d67d47c6c7291d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992000, "uuid": "ba96bc2d-cab4-4b04-affb-8c84d58b3d54", "value": "T1FAB31A34E4504B1AC2D322FAE659815F3E231FEBA3EA30258B34BFA057F26D71575924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992000, "uuid": "40b1dad6-65be-4c03-91f5-07cbc7d0e796", "value": "1536:QMnmu0qJkU5gqLlIuaufJCIzdhiC/VV3NfHRuO5JB72xW9YiqMq:241HOuaGVV3NfHUOjqy+Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771992000, "uuid": "9f3dcab7-7845-48bf-bc67-25fa0c2c94ac", "value": 107488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771992000, "uuid": "975e882c-52dd-44ea-bb96-6496c05e8b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992000, "uuid": "5ccbd6ab-e04f-492e-b169-0369ac42bd56", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9010bcb2-1234-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772015238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015238, "uuid": "33d7fa11-6367-45af-9a96-0ef021151690", "comment": "Malware payload (ACRStealer)", "value": "2294094885d3f9af1d222859c2743791", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015238, "uuid": "eaece0dc-3206-4cac-af3f-b3d53fdaf3b6", "comment": "Malware payload (ACRStealer)", "value": "853c06fcf462269d2345d4a9d2c400ed693391220c50ed7b943b1a2147f74ddf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015238, "uuid": "41747833-27ab-4599-be9a-4cb797a605e6", "comment": "Malware payload (ACRStealer)", "value": "04e24c1c26a8e449a3c40178545fed9db146782c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015238, "uuid": "09b836b0-3b69-4c7f-afec-8fdb0f10549a", "comment": "Malware payload (ACRStealer)", "value": "9c8e3507c5952c50db0e5b5515fc02349a77f1ab1601a9bb57236de213c6b1d4b149864553422fa7067eef7c748bcb20", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015238, "uuid": "ce903a5e-fcf8-4f89-b0a1-12c5622fcba3", "value": "T17EB5335A53D6A5EBFFB157F065E14147833734926B78A2AF26C892344E3B3D46830B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015238, "uuid": "dbab2db7-38d7-4c8a-8481-81dbd68691c6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015238, "uuid": "c6c9294e-8420-4220-9434-e13bbcd82f26", "value": "49152:KevVc1WneSz3cV1IS81e/ntTc7ht799PQ/lFTjN4:Ke6WDzMV1kCTQ799ELm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015238, "uuid": "6033d985-a978-4da4-9a2a-eab7dac6bbc7", "value": 2305024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015238, "uuid": "f24edf8e-1cd6-461d-b79d-5fb49ca43cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015238, "uuid": "40a565cc-8226-4c3b-8fc1-19c1d5e19667", "value": "2294094885d3f9af1d222859c2743791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11389735-1212-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772000423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000423, "uuid": "a119fdf3-9b73-4419-9fa1-c122cd442065", "comment": "Malware payload (Mirai)", "value": "2b1931ca78a0c1832deb0d154fbd17a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000423, "uuid": "b6d2c1a9-caec-4455-8089-ad4e8c2cdc58", "comment": "Malware payload (Mirai)", "value": "857a7bd53687d574906c513adbcff9fecb1269a69756446327e6cee07980e817", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000423, "uuid": "26df5cca-cce0-4e1a-a1f6-819679d02b66", "comment": "Malware payload (Mirai)", "value": "04f894cbfbca34e8bf5db8506dd8d5ac9bf5267d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000423, "uuid": "54165849-2c74-4846-a969-a9478ec57c9c", "comment": "Malware payload (Mirai)", "value": "2c3a85263c3033bd02abac7b646d6093b6e8cbec21ff0fb60669bb4f88a30b61baab989e6b3a0445ddcb2f15999013c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000423, "uuid": "2fb06b97-8888-49a7-b419-45ec983e2e38", "value": "T1D44173BE70F04841A98CDE1170E18DCA6329B5E167F0EE7ADD722EE36499D44740DE39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000423, "uuid": "37bc5c59-c277-4430-bd66-00b0be3c0f22", "value": "48:U/+/C/s/S/b/3e/k/w1Z/b/gl/3/HO/4/6/U/S///m/Q/So7k/N/Pe/m/e/H/a/C:U/+/C/s/S/b/3e/k/w1Z/b/gl/3/u/4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772000423, "uuid": "f421596e-c737-41ed-a122-6b86b50156c1", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772000423, "uuid": "48c6f56d-2bba-449d-9164-570f67bf4489", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000423, "uuid": "13d6d48a-e6eb-41dd-9dd7-9debcc0278f9", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b05c487-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051549, "uuid": "052d0639-e410-420a-a499-250ca623a1d4", "comment": "Malware payload (Kaiji)", "value": "4b7d1eea2657ed2b8178ab364d563cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051549, "uuid": "a3e39f54-5983-493a-932c-29cc140eb968", "comment": "Malware payload (Kaiji)", "value": "85b33cf28ab166cd5338289c1fec17f1d8bc6a7b1acbbc2912971548d6071041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051549, "uuid": "10fcd529-0c5a-4423-a3c0-dd8cb80603a2", "comment": "Malware payload (Kaiji)", "value": "5601a9982f764d07f63d86e76fb0ef782e0c0dd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051549, "uuid": "ef735263-e09c-413b-ace7-2c9048f0ba6a", "comment": "Malware payload (Kaiji)", "value": "d2b9d134d330d26694f7445bd025973cd40581697e6320ebd2a87b123e0ae1ced84c985058f8aa1ff5c3b7daceb69882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051549, "uuid": "8c4ed40a-8a8d-4085-a9ee-5ab841f94e5e", "value": "T1715629037E28D71EC62921345EB2CA9467393C9545DAAA13B395F30EA8F20BC595FDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051549, "uuid": "09b1eba8-d6c2-4fb4-a5fa-aada6ba74f40", "value": "49152:L3qbSw1zUu72RTScFnsKbyRHzPDPs4coYtJkEk2wBIxWyDp/9zUH+zOuhx83ZIqG:jqO0o2egDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051549, "uuid": "6ae22439-c9f1-4fac-ab78-d37205336f6c", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051549, "uuid": "c2a3afaf-d2e3-431a-9d71-f8f6a2281a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051549, "uuid": "3d936ba4-5df3-4c53-b966-d220bf940efb", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09998c0-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035936, "uuid": "ffeaf600-91f3-424b-8094-807641cda58d", "comment": "Malware payload (Mirai)", "value": "67126810c0594838dbddcbe3366c2851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035936, "uuid": "4c658dfe-7741-47ff-a989-1eca39b2197d", "comment": "Malware payload (Mirai)", "value": "86490006aeb6706694c1b51ae60abfd4069e6ff5d86fdb76c3b09650fbbb0ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035936, "uuid": "1b9c152a-d89a-447c-8817-36a61f8bc4dc", "comment": "Malware payload (Mirai)", "value": "ae54381d067844a33577c2b1a634923d24d5e9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035936, "uuid": "8efd8fde-f45c-4101-8627-327688996d71", "comment": "Malware payload (Mirai)", "value": "dbfc7f02a2807b6eba159357add5267d8ef938be2792218dca22c9f73d616aa4324527dc7d8c65f055430d7c6d113268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035936, "uuid": "ecd48dc0-c6f1-4bed-a4ee-2d09bf06f1cf", "value": "T18E9533CD507ED1F2DDADB8BFCAFA0270CD61E729850F385958C9B6263606418BD0B396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035936, "uuid": "048a6f67-b6f2-4b0f-bba2-56e98e3222c8", "value": "49152:Ug1jGKMvRIHGI8FGDWCOxz51Vrtdr4YyzUlBnwn:31j2+R8dCOxzVrbcYuUlRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035936, "uuid": "039bb12a-3f44-4bb9-add3-a234c655c941", "value": 2059244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035936, "uuid": "af45746f-bf4f-47da-91d1-78b2ff86c2a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035936, "uuid": "8ea6b443-3110-4430-b091-68eed37c0e9d", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b260d68-1242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772021243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772021243, "uuid": "2ae79e44-f441-4b3c-ad24-72abd6d74443", "comment": "Malware payload", "value": "1c2a8cfb8c2c4167c56f68e1f49f565f", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772021243, "uuid": "78ebe866-2959-40f8-bc96-2e7c5fec599c", "comment": "Malware payload", "value": "873a824edd1f2f06b85b7f1a662016e67ed09760ba992f7796b53a24113c34b5", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772021243, "uuid": "6ac0496d-559d-4fb4-88d4-bc3a27e94477", "comment": "Malware payload", "value": "7082d01c8206e3f640addb8fe8a4049ae1ea4436", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772021243, "uuid": "a81170cc-ea44-4519-86b5-650539b79d55", "comment": "Malware payload", "value": "8a6d808bbd961baaa5d340c31e1529235981c1a231c9f659bd8e0d3f08e9d2dc867dd969dd73fde9289bcdb7d34f3ebb", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772021243, "uuid": "14644742-c467-4385-bc17-f3516194c38e", "value": "T1B4627E722E175231C02F4D31CB867497A5567C012FF14E9B744B7B4AAEFB364A74064B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772021243, "uuid": "bc3fba90-d1f7-4bd6-bb83-cb0c8ad8f292", "value": "192:hkMRyRl8WpZpf/3cX4xZ/UIQ6P0FCZFa4bjkDdzIk:hkMRy78WpZpfkXQ/UV9MZFaakDdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772021243, "uuid": "82bcbdc3-b058-493e-957f-6f446cac5fa4", "value": 15194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772021243, "uuid": "99adb10a-ce37-49b9-ae0c-116157fdf8b0", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772021243, "uuid": "f59ab97f-04a8-418d-a184-91d76d312a12", "value": "update.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49b13f4-1254-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772029151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029151, "uuid": "6ed974ab-4454-4e17-98cd-4c7b95bd3046", "comment": "Malware payload", "value": "303bf2790ec08389f6e87f2636e2904d", "object_relation": "md5", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029151, "uuid": "22984eb5-9dfa-4416-8612-d925df30a054", "comment": "Malware payload", "value": "88113046f25ab148c74cd5490b53c72157f940bbd4a86fe475c21cf8763acb77", "object_relation": "sha256", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029151, "uuid": "58e5a040-37fb-4938-8765-918980363426", "comment": "Malware payload", "value": "dfcba90612853dcf7e1753ad9184253aae7967b4", "object_relation": "sha1", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029151, "uuid": "de181bf4-190a-4fac-b556-78ec469447eb", "comment": "Malware payload", "value": "525db5d1f78f988f8b195e3441ca1a10d271bceafde1bbd7a2979b20364ad13d9e4eba546a738e368c29de25f0cda1f2", "object_relation": "sha3-384", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029151, "uuid": "e7fa2646-61a9-4e67-bf99-782834726e79", "value": "T1BA45335573A14988BF31D22B2F747920A2F7C937981396BD1EC86DC6C413677B68E0B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029151, "uuid": "b482e6ab-9dd0-4ed1-8c00-6662b3c2d087", "value": "24576:xhLTTXkTWt40UIWnsYsfkESvadRexuNs4p5qE6pikwNwkueXr9LtMFU/GM39mtYP:/Xi/0QJ2ftTexuOYlu3kuajJtPu5ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029151, "uuid": "a9fd1803-66a5-4899-ad46-2717523b6de8", "value": 1249058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029151, "uuid": "7f222ef3-4593-4262-a827-0aed4db66035", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029151, "uuid": "2103c4df-5dce-4ccc-bd64-67f45bb7ae66", "value": "TNT Express Arrival Notice AWB 8013580_PDF_.daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f5e8a9-1284-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049449, "uuid": "251cca89-a81a-4724-9a2c-9fa28d0751c1", "comment": "Malware payload (Mirai)", "value": "6a0b6ac2b3de33bd950bbf8046075094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049449, "uuid": "8b4f9ce0-c0c7-4254-85f6-2a5086a7929d", "comment": "Malware payload (Mirai)", "value": "895538b7444a16bd1fd0929983e500c955f3fd6a273c63aaaf2128f947784412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049449, "uuid": "da38fbfe-3ea5-4fa1-b137-035bd1cd1e5c", "comment": "Malware payload (Mirai)", "value": "cb176f0dc3bd045c61ca49640d6684e16e1ca954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049449, "uuid": "9dead4a2-5b21-4347-aedf-cd96e3ac70ce", "comment": "Malware payload (Mirai)", "value": "2095532bd71f8fb747aa79fe3fdbf2997f1b8f2e2d3594f98f215312cfab759c123435b705b284617e627e5d68d153b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049449, "uuid": "4bd27fa5-6220-419f-ae62-cd1373ce3ecb", "value": "T1AA635BC1E643C1B5E847057021BBF7336E72E1FA0258EA43D7A5D672FC52A42E256ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049449, "uuid": "6adf1c32-5a5c-4c3e-8ab8-fd70206e6442", "value": "1536:MGH4CSCFqGveRygh0JENfGMiUOvc6IvRRAbwvC8zD/qOps1TdaNhwjfDQNXdJfNz:BCCFqGveRygh0JENfGMiUO06wRRywvCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049449, "uuid": "02032f05-ec63-4a17-a6c3-b134e77972ef", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049449, "uuid": "76bd1578-23ac-4c9f-bded-05338b3b9596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049449, "uuid": "b93db1b2-ab83-4c47-85d8-e29d4b4c383d", "value": "boatnet.x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e49160b-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051555, "uuid": "3b613b4b-c3af-4b6c-8fff-3cc8b444bdf5", "comment": "Malware payload (Kaiji)", "value": "3ecec17a6692a97b54b791e710c7d0ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051555, "uuid": "820524c8-3ecc-48c1-aa9c-3a1a0586b796", "comment": "Malware payload (Kaiji)", "value": "8a8524c4d58632b52c6d0fd2c34683605d34d56338fae13362125969ab712aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051555, "uuid": "52b6d8f4-4ed6-4d3e-8ead-b347ef7bb94a", "comment": "Malware payload (Kaiji)", "value": "183a6ec88eaaef8a5222cbc3f0d1c626772925c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051555, "uuid": "cd10870a-8d52-45f1-8516-02a9fe493629", "comment": "Malware payload (Kaiji)", "value": "664f650bb12cb401340d7fca997cc93e73da738651c0addf70314aef7e2cd55d98b449cb362fd5f0f2859591ea1f2bef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051555, "uuid": "f912c0e8-6e45-4bb3-8976-c690ba634959", "value": "T1F7361957B8D28642C0E4367AB8BDC1C433A35EB99B9B62575D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051555, "uuid": "ab317ba8-9d43-457f-ae9f-124556596ac3", "value": "49152:QtKY0CdO+kBRx0Tg0qTecEG7meYuh1+lYfQMcU1F1:OKY3U+qRxQ3qKbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051555, "uuid": "4fa171ee-1fe6-42a2-aad3-143e743cc5c0", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051555, "uuid": "3707686a-25c4-4021-b8a7-b5ecc040c6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051555, "uuid": "438cb018-cacf-4dd7-9235-23a5064064ad", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c20c9b3-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013111, "uuid": "10811220-50df-40ee-bec6-f846d06edfc6", "comment": "Malware payload (Rhadamanthys)", "value": "c5fc77fe785c9de781cd75c136bbd6ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013111, "uuid": "b69a305a-229e-4732-9220-62249318a299", "comment": "Malware payload (Rhadamanthys)", "value": "8b075f2e227a89e6405bf570dd82bc1948bfac19e6bda9e1e6969388d6e27be3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013111, "uuid": "9a460099-b292-4eac-9294-e8b02dd4b2dd", "comment": "Malware payload (Rhadamanthys)", "value": "0611e24002aea02990fde972d03c360126ce8d3f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013111, "uuid": "3ffb27f6-e907-43e8-878d-ddb7826398dc", "comment": "Malware payload (Rhadamanthys)", "value": "c82274100e35396e96c8d993b16d985bf9982c495b896278daec1c8bfc4a5157e3f42f9ba60b5c23e20cf6b835bf92a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013111, "uuid": "78393cf6-dc5f-4039-9cf5-583a3f44fdac", "value": "T1FDA31B6A0AD609D73AF62AA79F0D6077C8E92DF0D785A1805C8FFBE1951D71AB1430C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013111, "uuid": "3271d9d4-0db1-40dd-914d-8f755c4d1165", "value": "768:GDhd0i7J4sYKgY/CMNfWdUfLXTJuJRTNYioufzJ0pJ7/ti7qovt/w2rppBhlXyrm:GDB7eKg20nrsrb3hf4AYIP6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013111, "uuid": "ca8648f4-cb59-4bfe-a717-60c808d628e7", "value": 102647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013111, "uuid": "56702626-0307-4a6a-881e-2410a02165ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013111, "uuid": "75bfafaa-af22-415b-beca-059754930da8", "value": "invoice-1637482117.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0ea8ca-1275-11f1-a769-42010a9c0008", "comment": "Malware payload (SoftConnect)", "timestamp": 1772043042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043042, "uuid": "6781b56d-2c70-448d-8ae0-1598148cefaa", "comment": "Malware payload (SoftConnect)", "value": "9b243ff60a1b5e6f0de9be62bc3e739a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftConnect", "colour": "#B25C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043042, "uuid": "293e2496-a01f-4aa0-8400-0ed530e3a739", "comment": "Malware payload (SoftConnect)", "value": "8b2b511a7f68f20a5a200a9b28adec1e45ef0b5ebbc901485d17916c348a4489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftConnect", "colour": "#B25C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043042, "uuid": "5167afb2-a261-4b40-85ba-cb7d21606325", "comment": "Malware payload (SoftConnect)", "value": "c2b1d79b27874974bcb9e516b206c932453e22d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftConnect", "colour": "#B25C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772043042, "uuid": "7d957c25-e205-4a1f-b0a6-9997d830cd6c", "comment": "Malware payload (SoftConnect)", "value": "ff4f764db037ab7781d7b52017b7e3698aa19b581ecf24dd60aca2632761424dd19dc959d933309d0bed732316e87504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SoftConnect", "colour": "#B25C00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043042, "uuid": "24fe9c23-70b8-420d-9cfa-4f4cbc10ce76", "value": "T175871256E2F900E8E97BC0B8C6575517EBB1340517349BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043042, "uuid": "4d289e40-b96e-4c2a-add6-ad869797a18d", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043042, "uuid": "a8351ba2-7733-453c-b0cc-884906194b58", "value": "786432:65xVhtzhWNsKpjGct8To61nEPwd49C880XsChP:8VhtzEnpjGi8T1nEPtw8z8Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772043042, "uuid": "84b2a2db-0e2a-47ce-b6b3-9a76d8ce4e01", "value": 36214112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772043042, "uuid": "c15411e5-1939-4c44-a81d-f3dc2cc1837f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772043042, "uuid": "0a04df59-4d1f-479b-85d8-7a3293e10cef", "value": "RSVPCardPreviewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bd617b-1210-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostFetch)", "timestamp": 1771999912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999912, "uuid": "47eeabef-8e9b-4a49-87e1-e604652f1663", "comment": "Malware payload (GhostFetch)", "value": "24725e2759db07e879a6a0f248a4dc0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999912, "uuid": "a7c86c8b-ecb9-4bc4-8f20-d653b6316c7f", "comment": "Malware payload (GhostFetch)", "value": "8d2227f2c53d7e22a57e12c45cecdd43dbec08dbc3ab93e74e6df52cdf80548b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999912, "uuid": "6af69b20-34ea-49f6-8ecb-58b5728362cc", "comment": "Malware payload (GhostFetch)", "value": "80cea18e19665c5a57e7b9ca0bf36aad06096e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999912, "uuid": "b2626afc-8a6f-48e3-8b7e-9218efee9b1f", "comment": "Malware payload (GhostFetch)", "value": "2865e1bd79b12dbcb235db404751a6c32ddd73d4f8a1131bf02881c50624f6655848e0ea85d82a06d23252104fafb5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999912, "uuid": "275a8606-6665-4830-8830-dc9e03071965", "value": "T1C3044A67339535E8F5778278C5914A46E77778700B616FEF026086AA1F136E0AE3EB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999912, "uuid": "d6f6ba8f-68d0-4e9e-8b88-84cd8714f44d", "value": "a39163d1e2031de145cebeb7a61b8168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999912, "uuid": "7df2d5a3-a372-4f07-9d76-16c73f55350a", "value": "3072:03TPJHkf7uHYd2JsDUx8RVVnLF5ahbFDPzj:sx87HdRDUxMVtpcbR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771999912, "uuid": "d62fb3e1-0587-45e5-a889-b10a35bfbe0c", "value": 184834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771999912, "uuid": "4dde7a72-e7c5-4a10-8b25-87a8c3bdd847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999912, "uuid": "5f46326f-8820-4eca-ab1e-f7ce5dc5cd01", "value": "8d2227f2c53d7e22a57e12c45cecdd43dbec08dbc3ab93e74e6df52cdf80548b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e1c69f-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029938, "uuid": "b721097f-fde9-4a77-bca6-fac1e5f72fca", "comment": "Malware payload (GCleaner)", "value": "f52d71b42a23f98d9e8ddf12fc2a8249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029938, "uuid": "dbfff285-8de9-447c-9518-fd4906e608f4", "comment": "Malware payload (GCleaner)", "value": "8db18085d1d35dccddd21aec325123dfef8b8cb7dc6721e50366c14df8e5a947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029938, "uuid": "44397659-360b-4fe9-b427-93906e441f5d", "comment": "Malware payload (GCleaner)", "value": "fa3f0c47d5c5be94432b5cefdb1c8d73470e4199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029938, "uuid": "b939c670-0146-45c3-a2b8-5e91d12bb125", "comment": "Malware payload (GCleaner)", "value": "94fa0c2daaa6765ca5caffcdb18a3f897c4a01da85d66b2b87a3fb832907d603f134e4ed4b5d31cba3c9ba35d473b82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029938, "uuid": "67d8e162-41e0-49ed-a3ed-799137ca3482", "value": "T181F49E22F1A1C433ED63DF78AD9A575C4426BEC129296C0E2FE51DC87E39741742AE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029938, "uuid": "acc4c497-1ce8-4bda-9d4c-d077837372b3", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029938, "uuid": "207ecf41-39e9-4f40-9e1f-5a8617a282c7", "value": "12288:t2d0/V6Chk61Wd0Mv6jE/h/YkLfsEf5RuRuNFnJgWVu+CA:Q6N31WB6YJrLkWqRyI+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029938, "uuid": "935046d9-c1c9-408f-803e-b6aee9d61d61", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029938, "uuid": "0d868d07-8833-46d2-b9a8-e26a4322cd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029938, "uuid": "0c425d91-18ab-4b2c-997e-aff6f04dc9d9", "value": "f52d71b42a23f98d9e8ddf12fc2a8249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f7d8d-11ec-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1771984260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771984260, "uuid": "bff1d2e7-e32d-4140-9828-b14c162b5b3b", "comment": "Malware payload (RedLineStealer)", "value": "b397b9309a04ea958aa087b7f8538551", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771984260, "uuid": "6eb4e887-a169-40ce-a574-7c35de61b6ca", "comment": "Malware payload (RedLineStealer)", "value": "8e75dc34d4e08c4f03db2fa125a1ecc90ad445e9a222d0ca191ba03827d823f9", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771984260, "uuid": "40038a64-6675-4f5b-84c1-0f4ec8455b92", "comment": "Malware payload (RedLineStealer)", "value": "b0f83cc969145324cd494ac7bac112407fe60ac9", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771984260, "uuid": "2bee01cd-da14-4389-9540-69869e30c179", "comment": "Malware payload (RedLineStealer)", "value": "c5572487c37d62b9eac4c81647bdcd847d32732ee7bd0295128c754ae9c83a9757f83a4c54300a47f31d3c7e018c1436", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771984260, "uuid": "66fa1a11-cc7e-45c7-a20e-606c92debc32", "value": "T1D3248E21B9928433D5AB097498F9DF75893EFC510F7169D763840FBE89206C1AF34B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771984260, "uuid": "2323ccd9-aef3-47aa-a4e8-be74e0f2ede4", "value": "59f37c13d2cae7cc547b602d07aa7033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771984260, "uuid": "3bfc8d5c-b108-42e7-b03f-a2194acaa393", "value": "3072:QXiZYkCItXCGpSFRSJyE18jSaCTBIJCfCr8OIRachyk2Wh/RgaaATUxtN8l:QHkCItizSJJwYmUU3yacEkJTUD2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771984260, "uuid": "aeec698a-a526-4294-a03e-7de2978358ea", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771984260, "uuid": "b8ec9d03-d459-46d1-a40d-5eee9578b660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771984260, "uuid": "ae851d1a-678a-4a75-a02a-a13dd33c4534", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54dd728-11f5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771988270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988270, "uuid": "88ceb886-3efc-44ea-8d35-416be7ff8a44", "comment": "Malware payload (QuasarRAT)", "value": "2ee13ad3e30c578ad50003bcb7010695", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988270, "uuid": "ff180e27-db53-45ca-8131-b78f87b18af7", "comment": "Malware payload (QuasarRAT)", "value": "8f31c06c8e7ea9eb451bf26666ac4a958bb485b2a8b71feace1981633b116c92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988270, "uuid": "7e0d5d26-25da-4f85-9705-acdc6ab77f2d", "comment": "Malware payload (QuasarRAT)", "value": "e97293b8c90b4ac24ea7cc5754cb31c9a3362eb6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771988270, "uuid": "cd372ec2-4bb4-4de8-9b3f-0f1e2bdbe08e", "comment": "Malware payload (QuasarRAT)", "value": "ead17d2dd5064cefe77cfc7c3fa3e60d8b80b69a1adf58c42c0fac6c62d08f025a2bfb47d991c89778fa70728c763496", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988270, "uuid": "4e6456f4-25f6-47db-8fbe-4c8d68b3e05b", "value": "T18725C09173F4860BE1FF2BB5E4B245594BBBB5529D36DB4F098490AD1EB37808E007A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988270, "uuid": "f6e94b8f-730e-48b4-9e22-a1b64425ec13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988270, "uuid": "08e2c531-9360-448e-b675-ea5b3ff5fcfd", "value": "24576:S4svdSpSgoa8ayclOoWLuyWfLDnbP7xXvDv0:NsvdSpSgJ8DGO8yWDDnbNXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771988270, "uuid": "912d74ad-16b7-458c-bf44-c4c334266cae", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771988270, "uuid": "ea94a2f0-3266-401f-960d-fc6b40a6a2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771988270, "uuid": "940c5194-ba7c-4f57-bb14-78c0961ea850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f6d5a2-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012747, "uuid": "e366a871-f7c1-4141-950f-c33e9dcb5926", "comment": "Malware payload (Rhadamanthys)", "value": "c8c151ce8b8cdf7fc82a009f9d0e6966", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012747, "uuid": "bb7ddb32-827c-44da-a56d-a57e36cdff57", "comment": "Malware payload (Rhadamanthys)", "value": "90075dc7f7b3220789300b342b3e6cb871077c029e57b11ca298d5f5dd1f80d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012747, "uuid": "89f0965b-b3c5-4c21-8a4d-fa4f829b61a8", "comment": "Malware payload (Rhadamanthys)", "value": "0180c1fef9fcf1cc9e365e2f40bab71d88ab8c36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012747, "uuid": "c103bf3c-ed40-4b53-824d-c46251fbd5bc", "comment": "Malware payload (Rhadamanthys)", "value": "9999b134f7dd65f5dba98778e2abdadf781140276c03e2f789429dba2df52fd602ed48adc95ed781c8f2339c67c871e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012747, "uuid": "eb245617-c382-4145-9f4d-695919edfd00", "value": "T1A3A31AB18C86FFC428E851FE1B8470F0657FF361918896ACF52DB3212618F5A3AA15D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012747, "uuid": "8641aca6-e5c2-4afd-a0ea-d50993f23581", "value": "1536:GDB7eKg20bmJbEEuFfYly88nQlyD3hhrmVuma8R2mEQr9ooNilrEYG8iOqEnm3v0:GDB7b0MshKNld6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012747, "uuid": "548cce1e-2f30-4e63-8781-02e1e51bc4f1", "value": 100705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012747, "uuid": "df184f12-5369-4f92-a5b1-72921f078602", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012747, "uuid": "e9bb8d06-d7de-4966-9ad1-8ada43d49fe6", "value": "invoice-1637482117.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d2b1e0-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001070, "uuid": "bcf77c48-dba2-4d93-8961-9a29bfc07ded", "comment": "Malware payload (Mirai)", "value": "f4ff0b96e6262501e81ab206a5318ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001070, "uuid": "bc8eba75-b7ee-4715-82c7-1e8e5e2935c3", "comment": "Malware payload (Mirai)", "value": "90b66cc73c8b1746d91b9e5247e6827499c9d99a94912d29a0f437c6a8ab5507", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001070, "uuid": "3c55690e-e6a9-4b0e-814f-b1b3eba72760", "comment": "Malware payload (Mirai)", "value": "68bdc7f18ddd0e2311467d574ee6e9584dc38d89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001070, "uuid": "50b1ca96-caea-48af-96a4-b0cb1bb33d3b", "comment": "Malware payload (Mirai)", "value": "d793f5199fcd22ed73d3b5ebe609fb7f0276b03d7404f2a011b0757c41f1b9396042e405000ed001e067a154e685b3d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001070, "uuid": "2d030401-7193-435f-85a0-55f15468a292", "value": "T129B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001070, "uuid": "d1a7d60f-a8de-40ee-9147-4a67b1ae4b09", "value": "1536:jUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zv5:QixnUHz4Z+5ypkn3E85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001070, "uuid": "47102d0f-c3a2-4b74-af44-5e37fe0dfac0", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001070, "uuid": "4f2c23e9-2300-419b-bb2e-183c405d5d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001070, "uuid": "a977bba5-9040-420b-a854-e1e292005e0b", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f69b5b-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003093, "uuid": "7639fe0f-37c2-4aef-bdde-ac4b86000858", "comment": "Malware payload (Mirai)", "value": "bdb04db101f2035d5407c80986b6b42c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003093, "uuid": "26b0ad7f-f550-47c4-af51-2b3965378ae5", "comment": "Malware payload (Mirai)", "value": "924dbe5686c9a9a147d86cd890c8fc1dd0a69b013cf68e2b8fe2bbbf44a8c11a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003093, "uuid": "c8771c6d-48f5-4cd9-b8f7-7b5ec6148c5c", "comment": "Malware payload (Mirai)", "value": "6048185f1eb963b61a0f7748157ecc800eb80f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003093, "uuid": "aeb90997-77c6-4875-8e3e-278fe0f8e260", "comment": "Malware payload (Mirai)", "value": "27ea0db37c53a865c10e7bc5d3caabb9cf2834edaa888e90fbae5d25535f9a0d289abad4940c72a20e972264fbc97944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003093, "uuid": "fcffcb7a-20a6-43d4-ac83-e92599daad98", "value": "T108833B42B71C0A43D0675DF02F3F17D1D3EEA69021F4FA88691EAB469176E321586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003093, "uuid": "63a5e1ba-f003-469f-84e3-e0872a0d2999", "value": "1536:dBYvB1A37Mf8sTYE5j090uQ+MQ5eF9UEZ9//dbz4HyU9ONVcB:d8ArMfhTYJoVQoFFLdQH+sB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003093, "uuid": "216d1775-a800-4492-b61d-ecf10a7be435", "value": 83436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003093, "uuid": "65a30bae-4d4a-47b4-9260-0f228a682fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003093, "uuid": "0f60bf59-4398-4c63-acfa-090419832585", "value": "ez_nigger.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc67e25-123d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772018969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018969, "uuid": "d1c8b044-d60f-4f73-a502-f2e71df1fb63", "comment": "Malware payload (NetSupport)", "value": "c5894b3aac979077f6f05cc12569220d", "object_relation": "md5", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018969, "uuid": "9c54914c-9b81-4047-aadd-81f185d73602", "comment": "Malware payload (NetSupport)", "value": "92748a3d9b11ce9290270f72147a25250d17d37697fbef8795af06f4f649f4ea", "object_relation": "sha256", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018969, "uuid": "bf8ee2d2-59c7-4378-a59a-e6368433e699", "comment": "Malware payload (NetSupport)", "value": "2f6d8d663ee38f6b33c639a7691c84530b3065c0", "object_relation": "sha1", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018969, "uuid": "777d23a9-85b5-4af5-b7db-35c300afdfb1", "comment": "Malware payload (NetSupport)", "value": "ecd222e63c4bdd64b081efd7ac4ffd29404d582d67173aee7c5952c35983cd353ae5106df8cb7dacae9fd34edbb4ccee", "object_relation": "sha3-384", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018969, "uuid": "a87b31f1-de3d-47aa-a159-72deebfd903f", "value": "T146D633A0A6E811FFF9EAD33DC8519491C99675AA3B8AC183D3B8D1B12C733C4597E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018969, "uuid": "aa8b0f4c-86b4-4f34-b757-609e03edeac5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018969, "uuid": "ca0afee1-3864-429e-9b7d-f9265df6adc6", "value": "196608:K14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuort3urH/P/XRLSq2KKeF:K14FSsFl7dCR1C99/LkuGuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772018969, "uuid": "c7240e9c-392b-4f5c-aa15-ac1a3e7572bc", "value": 13412505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772018969, "uuid": "7ddf13e2-e2aa-4691-8e1e-bba7862b75c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018969, "uuid": "54d85559-e564-4a49-9b53-cabea224fe40", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e578af5-1282-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772048575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048575, "uuid": "6a127d05-4425-4cac-b025-d6a8037c1a5f", "comment": "Malware payload (Mirai)", "value": "1c3699a91ac0bdc769c517be614e28d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048575, "uuid": "da7679f1-b192-44e3-babc-1aa06040806e", "comment": "Malware payload (Mirai)", "value": "93d61719977e8fa9079eb13a5e3d6d15c0cce2a5209fbbb40c07433d5c9665f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048575, "uuid": "dd2b3260-5962-44f6-8e2c-5397c1a9aee8", "comment": "Malware payload (Mirai)", "value": "247b4981130b4659a0bd9fcb82916492b704f396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048575, "uuid": "57da73e7-4be0-4ef7-bde3-7829aff9cf1e", "comment": "Malware payload (Mirai)", "value": "ffacf51103cbc403669e21e8f366762b8040273243ed62ca00204c8547285dcdce4af033291ad2c6902ce1497fd4db3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048575, "uuid": "31f836da-b482-402b-8c75-10fb527c9dae", "value": "T1F5534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9671E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048575, "uuid": "6e22386f-84f9-4b6a-8263-31ba8cbb023c", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMXd/p9OyDQvSFRMNYL6FV+tg6wWH:+5HAdOmGyNtTAdtOyUaFRMNae+aTWIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772048575, "uuid": "2a85d72a-1979-4b57-993f-2f91e22a4f76", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772048575, "uuid": "5f649a58-a03b-4125-b5e7-3f31b7368f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048575, "uuid": "edfc2169-9f4b-432b-a4de-6728b70f7a09", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e469207-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045596, "uuid": "58ec90c6-6178-48bc-8879-2ff666e1d9e2", "comment": "Malware payload (Mirai)", "value": "013c3a4e11e0863cfeb20ae77c319e0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045596, "uuid": "7ea969d3-1b1f-4dbe-b442-17a744851a86", "comment": "Malware payload (Mirai)", "value": "94ebfda43083094b37bea288eb2ac7c1e77b6c868c27d85264777ad789782724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045596, "uuid": "8b60d564-d67d-40a5-9939-5b055f4a981b", "comment": "Malware payload (Mirai)", "value": "d46596796a2d7af21ffd45e15e6d1865e13bdf72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045596, "uuid": "2ceb53c1-9428-4442-83c7-856cb6dd56a0", "comment": "Malware payload (Mirai)", "value": "c63d2905e6a89847fe4118ea880f20194899428823e4a99b025d488ef979e18c7505c1e084bf5d97155d1cffea5e12e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045596, "uuid": "b576dd36-6d1e-4cee-a971-edbc97847a48", "value": "T196A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045596, "uuid": "1213804e-7196-4d67-80e0-c802d09022e6", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fbHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fbHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045596, "uuid": "a5ed0e8e-ec0f-4c40-b4ae-8a389dbca062", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045596, "uuid": "f06f580e-c57b-40bd-8dd0-2f4118fcc9f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045596, "uuid": "8a9b8b22-148e-4dc3-af4b-135d30994362", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9246cb-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045616, "uuid": "d67a8d81-d2d1-4022-b334-ff7c3de7a350", "comment": "Malware payload (Mirai)", "value": "bb5b79c8bb2fe12a3a67ffedfbd2b0fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045616, "uuid": "62664731-59fc-40de-a9bb-b5bd635bbc0b", "comment": "Malware payload (Mirai)", "value": "95306150b2d778a66b13daa5e016e225e6eed6d812e81ad4fe8f702eeaccecb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045616, "uuid": "9428779d-92f3-422f-8f5c-781fdd84f204", "comment": "Malware payload (Mirai)", "value": "807cf2385740e643e18a6de2b7f26213a4eea15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045616, "uuid": "f39ea8b0-095f-4094-83df-66cbd6b09bb9", "comment": "Malware payload (Mirai)", "value": "9866262b778c10fcea1dd501653b88ebdcb5c14aaf05eb85e7cf75a1a3d8ee57f84d7fc773f51497f4ba855971f033f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045616, "uuid": "bdca4598-256f-4fe8-982d-9eda6576e544", "value": "T12EC35973C8166F68C565A570B0A08F782F53E59492431FBE6CABC2B48483D8DF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045616, "uuid": "97f6ebf6-6105-48a1-82f1-e92dc84f17dc", "value": "3072:D0hbbqpvMeFXphS8sVFos46Hx3WpP6Ei12:whHuvMgLxsVF1ZxGpyEi12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045616, "uuid": "50a29e95-299e-4387-a67f-a99c0a25edca", "value": 125600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045616, "uuid": "40d23bd2-9c0c-4ed4-8745-199cde7f1ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045616, "uuid": "b65cf949-74af-499d-8064-a21707a15f5a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed6d7ee-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017545, "uuid": "16b2fe30-0189-42bc-bcb1-eaba11a62492", "comment": "Malware payload (Mirai)", "value": "30dfad8474477dfe560cffb9ba2423c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017545, "uuid": "e0704bf6-4eb2-4f51-9838-a90118012260", "comment": "Malware payload (Mirai)", "value": "9760ee268dcd02d6e437ec4dd9cf7092f37ebbc38d7400fda44e59c04df18659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017545, "uuid": "2929e7a6-5ed1-448e-8926-5ef072988502", "comment": "Malware payload (Mirai)", "value": "0ce8e4607d2ec01fac31b2d184f967622270c29f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017545, "uuid": "9148469e-d6ae-4fce-b925-697df80c2361", "comment": "Malware payload (Mirai)", "value": "1908a389846127019b72e0ad6039c3f14e63507cfd024cffab59ddacdab32c439eac12538e822c5e678592515d8fb150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017545, "uuid": "58324009-b7bf-42e4-b053-c5e95f947c7f", "value": "T14D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017545, "uuid": "6acaec81-b91f-4792-9d80-e377f66c1676", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStW:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017545, "uuid": "6d015139-98b2-49d8-84b7-7dd4af2944dd", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017545, "uuid": "3aeb52d0-08f9-4f7e-9cd7-5ff37b28eb59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017545, "uuid": "918751c1-bf2f-48d6-9da0-c2e66a4c631d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b243abc9-1283-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049226, "uuid": "af5a0193-373f-49fa-90ab-bd116be2edd1", "comment": "Malware payload (Mirai)", "value": "74093ce2fae845643957583eeffbf5b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049226, "uuid": "cacf35bf-b071-4ea3-b4a6-2fb591b01990", "comment": "Malware payload (Mirai)", "value": "98a5c00f453fecb17e5e633eba9599d26fb48c17e7f894e872b32fca685c5bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049226, "uuid": "cef26872-424c-4af3-8f4a-e7ea0f252a03", "comment": "Malware payload (Mirai)", "value": "3fb9505d3b50478da417d00f54374f3b48fd29f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049226, "uuid": "ec3488f3-12d4-494d-9102-c0c4d6563feb", "comment": "Malware payload (Mirai)", "value": "cad6c269031edc3f2faa950b27b7ab50c77869612db9671e54fb9cafd5bd05ec6139eb813b3442689c3877f304732883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049226, "uuid": "2abbcc33-f340-4167-8f02-c69206ff5215", "value": "T167E2F294CC685969EFBF7BB49D24E3ECF3B35D0E3311C741D152A3115ABAA0A1280E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049226, "uuid": "97220980-a43b-46f6-9971-1b638fd9a337", "value": "384:t34mC9UrLGQOhzTOLglnFb0yG/f72mvBfw2N9Kexz4jFAdGbXo0o35owSj+GPM4P:t7xf+1Mgb0niQN9fVW3Y4uVcqgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049226, "uuid": "11422e93-94c0-4b86-b26a-5ae497706196", "value": 32984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049226, "uuid": "47edfc96-8b57-4fff-913d-e4ea355c8bd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049226, "uuid": "eb6a545b-8f29-4339-919a-64d64405f5cf", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d64704d-120a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997195, "uuid": "de6abad6-dce7-4b60-84d3-9ffab8a676fc", "comment": "Malware payload", "value": "0f839cafa6565f74303e5e5f414f9d8c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997195, "uuid": "2bf277fc-a47f-4b51-81e1-5484581abe24", "comment": "Malware payload", "value": "9b4cd87d338d2fcf30d75f9e5c7abb8be085dc8c4f573df19597b872d8ae8c2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997195, "uuid": "18e93c4b-f296-44d1-8083-8282e45244a0", "comment": "Malware payload", "value": "5c1500296857ed0b0bb7230a1cb17993d25ab69b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997195, "uuid": "a98d9046-a827-421c-a1af-38d58b460b6c", "comment": "Malware payload", "value": "27aecc81cd4da76f5da4876bb1d75a5cbcd3bc60e032ef61ca76433f8959d7de3581d9fc8bb868fa335ec0ba519b1589", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997195, "uuid": "92f73535-5954-4333-a29e-9184c3c27013", "value": "T162762501FECB60F6E903683155A7B22F23316D058B25CBDBEB547B29F9372919C36285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997195, "uuid": "c2187270-1ac1-4b97-9ca1-f521e3c1c774", "value": "7e159dd7f2b2104804063b2f9fe2a4ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997195, "uuid": "37a475e4-05c6-43c6-bc5c-31e9604bcb46", "value": "49152:jFuy7V/5/mlLWQhb9PXn3AJd7ScqXIoEsvq83ZAqBsNnf5EzK9BwA2jjvxpsI+dq:xr7VB/+3ln+aIJ3E62syaRQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997195, "uuid": "1a90635c-0562-4f62-927c-31c4bf35020c", "value": 7649792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997195, "uuid": "38f1e17b-c7ee-4bd3-9497-b7dec9481013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997195, "uuid": "60bb7c9c-84e4-41dd-910b-f2199cb5ae78", "value": "9b4cd87d338d2fcf30d75f9e5c7abb8be085dc8c4f573df19597b872d8ae8c2d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483b1025-120f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771999227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999227, "uuid": "96718678-3841-4085-b4ae-baa3ad6c4071", "comment": "Malware payload", "value": "384e118ce122574dab872efcbc2b222d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999227, "uuid": "008e3212-e993-44c0-a110-2e3df927098c", "comment": "Malware payload", "value": "9c207c51c448f96eaae91241a39c8bb85e2307f2d2a99244763a53176cf4c02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999227, "uuid": "96235909-f478-414d-9e24-41b9ae610ee2", "comment": "Malware payload", "value": "9defffba933fc44f8e3b6e25b31508bc17d29077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771999227, "uuid": "30b9ec38-4ece-4e2a-9266-d3bf1a080244", "comment": "Malware payload", "value": "6ab94781511cf02ab666aa27e4a8ebc6c1a6e821076acf04e549599d2ee4e390f4267249ebc50b14e53acc0cb8b3b228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999227, "uuid": "88877952-0d76-4d51-88fb-880c93b795a0", "value": "T15CF49E7577E803D2D0B7D13F8A999B5AE6F2B815072097C701D442A92F23AE85E3F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999227, "uuid": "efa24402-bdd3-491a-ba03-8aa746d09834", "value": "296f9e2800aaf2ef6a67f7d07dd87863", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999227, "uuid": "31a4ba7b-b41c-484f-9ed1-9b6428db841d", "value": "6144:DPkW/J7egdMJwvD9WMVhuBvBs77g/0GS+t5dhLRWC01nuYux7KmibkE8:AW/RdlhWMeBpsXg/E05/R5MFcK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771999227, "uuid": "f5e5e8cf-2eec-4b05-b7bf-e0696ae94456", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771999227, "uuid": "f791c190-0a4e-4b33-8c7e-536caa23d008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771999227, "uuid": "9b0e494f-e125-4dae-beac-f367e80c78cd", "value": "9c207c51c448f96eaae91241a39c8bb85e2307f2d2a99244763a53176cf4c02f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441aab5c-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045605, "uuid": "1d455c51-0dbd-4c54-a795-ae71f722e99a", "comment": "Malware payload (Mirai)", "value": "048ac98c7d60b6f237a1818bdbfe5ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045605, "uuid": "4092b866-d133-4de5-b853-5c623a57910a", "comment": "Malware payload (Mirai)", "value": "9e46fbfaa3baa10e3f83babd6858c851a6f0c300e269ff760b64d954d7451f62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045605, "uuid": "5ebd1feb-c658-4485-9627-61ca8ce89f6d", "comment": "Malware payload (Mirai)", "value": "f1bf7035b2dc6f239f0bce1b21fb8cf89518d0ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045605, "uuid": "e83f9646-acba-4ffb-9d26-2215f5e29521", "comment": "Malware payload (Mirai)", "value": "bc35c64ea179f07fff6af0950e9991f9034b9e5b3ae8dcbd40051182f5150a84225f2e9c8991af8d4c833cf64e69c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045605, "uuid": "0438b3fe-49b6-4281-87fa-a90ab7735d23", "value": "T199D30A45F8414B23C6D512BBFB5E428D372A17E9D2EE7207DD255F203B8686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045605, "uuid": "169c836c-f349-4abd-a254-9fb353da05d8", "value": "3072:K52ZIkT3Uh0JofYwjCIyHEzt8lez83412:K52SkTGGofYwjnykztN83412", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045605, "uuid": "58aa8a2f-38ec-4151-aed7-89c72238d6a3", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045605, "uuid": "17878d12-0ce8-4d85-87a8-bacb27e47180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045605, "uuid": "38b11c53-9170-4314-8d8e-682527fdf161", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d35d03d-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001087, "uuid": "d2076263-0f23-48aa-831c-8c5677a2fc0f", "comment": "Malware payload (Mirai)", "value": "e1211bcfc6ca58f71a68463100aab8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001087, "uuid": "e4ac1694-31e9-4901-95fd-3db798d0bd99", "comment": "Malware payload (Mirai)", "value": "9fc56422a874797270f38452ad65be9a9e5626aa8ea3ab0daa0ba52daec931ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001087, "uuid": "030a1851-5d84-41f7-a521-6368d6332cbb", "comment": "Malware payload (Mirai)", "value": "656dc2d66b396f1e4963fbb3b0c96d16671cef85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001087, "uuid": "c6056bdb-7f43-45c6-b304-f32396491501", "comment": "Malware payload (Mirai)", "value": "83a233a4a8e7a9c986d4c0e775d5af2e940b20843496c1fb1bd36bfa9b11c80a1e7b840fcafb92515bcb0035c4458c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001087, "uuid": "4d781d5d-71cd-4050-a348-fb6a639c72af", "value": "T174D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001087, "uuid": "0bacb1ad-e8f9-4dad-b32a-74ac9c6bd6e9", "value": "3072:qNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQ/J:HHy5ct8/cyiWuVosLDuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001087, "uuid": "fa685696-0c18-43fd-a799-127c254876ec", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001087, "uuid": "bb37b1e7-6788-42e2-8678-fe3f2175cbd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001087, "uuid": "4de3cf77-4667-4308-afe8-37582c34d80f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a2cfb5-124e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772026227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026227, "uuid": "afdb1a75-a0d6-455b-b910-e476c2d1cd19", "comment": "Malware payload", "value": "9bc85bf4432a5ed8cd00f0eac8a2257e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026227, "uuid": "8690c2ce-7f47-4ee9-9bfc-f733bae0bbad", "comment": "Malware payload", "value": "a0610f08c783ff5486a66022fedf483e1ac81dfe48935680b5d9d29b309338c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026227, "uuid": "a419c0bd-fa03-4c30-b678-d44f8b892124", "comment": "Malware payload", "value": "731fe6688a8b565275ec4d33293ea569829569b3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026227, "uuid": "39498717-d7f1-4934-97ff-90c335f729de", "comment": "Malware payload", "value": "9e80e383ae56202aade8f3c887456adae1c0b2f2f3a39fb9269f8c3fa9e04b10051fbab42a16749ac00a24ec7ad89b69", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026227, "uuid": "f70c1edd-aa48-439d-adc9-15e53149bb1a", "value": "T1EF36F146F785A97BC4F78332467696262237CC668B83D6871D5C323C18B79D80F5AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026227, "uuid": "08a734fe-6e91-4b02-bbd6-7e16e83a3278", "value": "98304:a+tht2IN9FlMM9ZZSSCSKL0+EduWjPnu1ZEDuIWwjuzfrEOKev9N3wlI:a+9lnpHSSuQ+E3mYq/wg7AlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026227, "uuid": "3b7431bc-85b9-4f8b-8dde-adebf0709900", "value": 5053600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026227, "uuid": "e9e01286-b604-41ba-befe-a182f8fbdb54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026227, "uuid": "bbdbb067-5bf5-413d-b1c2-3d50745831f2", "value": "Mp3.indir (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9116a4a2-1224-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772008368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008368, "uuid": "10e49b0a-4105-4f9b-9037-3812c463a2ed", "comment": "Malware payload (XWorm)", "value": "e003ca4e65693a8f57006ac4a931749c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008368, "uuid": "c359dfcf-c48f-44d6-8d87-4cc208dca948", "comment": "Malware payload (XWorm)", "value": "a138f415cd6837538460e01377c8aac345abf74509966886ba994b964105a837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008368, "uuid": "2a2492f4-eb09-47bb-8d6f-04dac5c76c5e", "comment": "Malware payload (XWorm)", "value": "815bcfb51f9bfdd825f6d0667491f4ac7ebddc53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772008368, "uuid": "85b2c1dc-c8f5-4a8f-8fb9-e213f53796e7", "comment": "Malware payload (XWorm)", "value": "ea6afa95cd85064bd6bbebe96925c331a1e1af2f0d61cadfe13327bd187e8370fd2eec0741877f1856bdeef5c0c1a620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008368, "uuid": "146d04d5-dad2-45a8-bdb1-4e2299bff560", "value": "T166C4D0121E826F15D63E5B7CC02214E463F0DA476393E36EBFEC02F58A67B89CE46456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008368, "uuid": "752911cd-4210-4cbe-91eb-edc389e0424d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008368, "uuid": "5a26aed0-e523-47e0-9fe2-b7977f18c57d", "value": "12288:uASOpdzctT3IrmN0Nw1HBY7sOft8VHSzulh1:uAD4Z3saJ1a7bfXy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772008368, "uuid": "ba9bc354-9a10-4b6b-86c0-b436ef130221", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772008368, "uuid": "173d3d79-fec5-4295-a082-697031a872dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772008368, "uuid": "12e5c337-9580-4844-9be3-7927411c3e51", "value": "SOLICITUD DE COTIZACI\u00d3N..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc47811d-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035929, "uuid": "5c6a95ef-a442-4ae7-869e-6a171b08e32c", "comment": "Malware payload", "value": "a7704e7b445c90c16f2709ccc6c5d23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035929, "uuid": "53b48618-314a-40bc-be6e-9b0a0d8ce909", "comment": "Malware payload", "value": "a14e2c9ce324d6506cc0b0e49b3a5b98d8da16ee34b969ed847da668f2534f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035929, "uuid": "425280bd-b029-42fa-87aa-5b36ff4d60ef", "comment": "Malware payload", "value": "1363d5c889ad7c7291149fc692ff945e48438eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035929, "uuid": "756cc5d3-bfe9-4f32-8504-7b7e7f4729b5", "comment": "Malware payload", "value": "64e7dbe86a834bceb1a03552a9c899adfba02271732ec71447467ead542ac0c0e12d01ed484ab3b39bd2f81cf6b70f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035929, "uuid": "4c8f32dd-8426-47c6-be77-a64eccdc81e3", "value": "T176A5339C21D333E3C4A0E8A59541876380B9E59228B9F2E567FB6181CF5B109DDD3BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035929, "uuid": "7227351b-fb4f-4e8e-86ae-7faeb9e878b4", "value": "49152:TEqTE4FE7pJpzyOhLbJ2M4ZnqbRa0fTvlQ8:QLpjP92Gb8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035929, "uuid": "bd6921b8-e22c-4001-ba0c-a8876391fe28", "value": 2121160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035929, "uuid": "5092ab35-be13-4b80-b5af-cdb4f701a663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035929, "uuid": "9170c1aa-9a8b-479c-998e-06fae5d8f657", "value": "PPC64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba5bdfc-124c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772025727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025727, "uuid": "acfadaed-e362-4297-9ef1-824b52e1a221", "comment": "Malware payload (NetSupport)", "value": "3aa39b16198bae46199094da3ccda61b", "object_relation": "md5", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025727, "uuid": "ca5c1aee-6a0d-4365-bbe2-7528d1f379b3", "comment": "Malware payload (NetSupport)", "value": "a20a661b6b9fd661ce583baca84f5b8e8b993cd29d131a27ac3ee2f78598fc51", "object_relation": "sha256", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025727, "uuid": "77e7eaf1-b7d6-4980-87f6-7560be36be98", "comment": "Malware payload (NetSupport)", "value": "8d8f6717a69ce31b7a973357002dd6f9f1a250d0", "object_relation": "sha1", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772025727, "uuid": "f133c7bd-2393-42ad-9cc8-401e164a8d5c", "comment": "Malware payload (NetSupport)", "value": "25f71ef31c61782aaba85c4d08d0607d25cd5d2fd6c2316689d41891d52469d7c864195e7b6034953c39a01c900a60f9", "object_relation": "sha3-384", "Tag": [ { "name": "178-17-62-192", "colour": "#9350A9", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "afreu-xyz", "colour": "#DBB94B", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025727, "uuid": "6339a9f7-631a-4a93-b1ff-a589a86fdaaf", "value": "T169A2D015B29C7562FFB556B524828A004FB3B80F53EF2491E7C4E9E9AC712785BC3853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025727, "uuid": "99362a63-26ad-4fba-b132-d47a174bb1b3", "value": "384:l2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSffcx:l2+x6TLKQXK1myQCSr2VS4jTXaRnPXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772025727, "uuid": "24ce8856-f217-47c9-bf42-99d8a88acbc8", "value": 22193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772025727, "uuid": "7cc3d3e4-e605-41d0-ac70-c2f503f73d8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772025727, "uuid": "09e19abc-dd0f-43b6-9d4a-91e5785c6732", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4a919d-128c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772052951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052951, "uuid": "c433ecb7-451d-4c7d-b499-ba3eec42b6c9", "comment": "Malware payload (QuasarRAT)", "value": "905426cbc53f5a127addb0352997e974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052951, "uuid": "bc9516f2-4fd9-4f85-bc8e-244341bcd1fc", "comment": "Malware payload (QuasarRAT)", "value": "a46bec2031259cff4135b985d533e9c0bdb175603d61f031c227103bbb002a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052951, "uuid": "b4307882-7780-490d-9317-cc11a7e6f33a", "comment": "Malware payload (QuasarRAT)", "value": "072633870bcb7b5f76eaad74a0a31ceb54038c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052951, "uuid": "e6880610-4ca5-4bd5-bd48-a8ba5ad6f4ab", "comment": "Malware payload (QuasarRAT)", "value": "4327972ea0f35963af02f00f7433ba23a1ac1825ee25d15ce9bd0fd8870b12001bd834fa997eec25718f15df51c847d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052951, "uuid": "2bdcaa4f-6db8-4941-a688-9bc69decfbd4", "value": "T1C31633682200C202C419567D95B1F7B8037C8DFFA911E227CFD4BCB7BABAB251E59257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052951, "uuid": "0901c3b8-9764-4f41-ba4e-89944df68b4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052951, "uuid": "67e1b004-ab1a-4fb6-bff2-c5c7ba8c382e", "value": "98304:vjcADthjqXlbIaYs3da4986oss7ZE6bA2WmPIuQVsrb3h9LnXoSr:bbDthjkkaL3dae8TfEQopVsrLjYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052951, "uuid": "9f6cfb31-1346-4e84-963c-6968f7e5066b", "value": 4154880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052951, "uuid": "8df40210-91cd-4cc0-8269-b721f6b687a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052951, "uuid": "e67c034b-3976-4e4d-9de2-08b15a95fb36", "value": "WORDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909c206d-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001066, "uuid": "f593db6e-8941-499c-992c-d50a493aa7a2", "comment": "Malware payload (Mirai)", "value": "6837a585d8359e8f7758fe43a21d78d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001066, "uuid": "103d2ea7-1c9e-4768-8d46-da205d3b38f5", "comment": "Malware payload (Mirai)", "value": "a4f7b8c997d248e9c5dd3eeebca12c564ac98d6240e3b115e51f6c0f4693aa5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001066, "uuid": "d1e3dcde-3c47-4f42-ac86-ed054ff4258b", "comment": "Malware payload (Mirai)", "value": "635d1c34a9b0d31497354bb07609b14210c25fc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001066, "uuid": "64eb9ed4-7b62-4f94-9194-52614f72eacc", "comment": "Malware payload (Mirai)", "value": "479960bcba0068ea145588afe6a26c3baab09e7364bbda1ac20a677ed41f79d901e244f7fe50ecf580eac3926c77ffad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001066, "uuid": "aa77b862-8c94-4f82-8365-5a432a892c39", "value": "T1A9F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001066, "uuid": "3fcb9cfb-32b9-4cf2-872c-7cf00174c961", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMp1En5p5M/LW:i7vDtrnPTR71gmX7Dy7fMp1xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001066, "uuid": "4caa103a-6d05-43d7-8ab5-3882a5647fd0", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001066, "uuid": "cb649bc0-05b1-4781-bbab-72bb79a7c5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001066, "uuid": "a3b62f5b-445a-414b-aa51-454e5347090f", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb0be24-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012842, "uuid": "210a8cb2-8ba5-4d25-b2b7-f787f4b4cdfe", "comment": "Malware payload", "value": "4a50858ee42ab9791c3cc6ec67b0baa2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012842, "uuid": "d6e88e96-1111-465c-9ba4-a50300b18863", "comment": "Malware payload", "value": "a526ab21f0cba32ce16d045ac040b3fd7db344e56d594de3ff3b36d50fa134f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012842, "uuid": "e8ad4641-cd17-4808-825d-26a3dea42532", "comment": "Malware payload", "value": "f48579c04c1e112336b84ea05ae3b17fc24bced1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012842, "uuid": "1a9b6b3c-0968-4a36-8b6b-2d4e61e24134", "comment": "Malware payload", "value": "737538e8faf7db5cc6597b3c2ddfd08a0c1f5e359d12ccc019d429ff94aa954f44be4b4260a4f0f3ade566ed9b5f69bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012842, "uuid": "6fbb5b38-22b7-4c5a-a764-7d9ebde7ec48", "value": "T19CA309455D02BEEC77C212A22DC670A2E51B151B8CA3E7C2BD2FF91C58DAF2625C12D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012842, "uuid": "5157f383-7196-45b4-ba71-f95439e0f3b5", "value": "1536:GDB7eKg20EseS9qbByVga75EHoQigmr3embZgPqbKJ9+Srg4rHgBsG337h0xlUAV:GDB7b0l6i3JIf+6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012842, "uuid": "38c3eda7-a7bb-4bd3-b6c1-88d0c195a1c5", "value": 98137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012842, "uuid": "7b3b39c2-45ea-4f39-a5b1-eb3eb225a4f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012842, "uuid": "6a30d69c-07b8-4224-a746-726b26097c67", "value": "invoice-1637482117.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05bde82-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012796, "uuid": "5dfd4200-12fe-4881-bad9-f6405a6843d4", "comment": "Malware payload (Rhadamanthys)", "value": "9560b6a5740f4c72756ffbe83fa317a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012796, "uuid": "7e41c074-4356-4351-ba31-a53a42109bc1", "comment": "Malware payload (Rhadamanthys)", "value": "a5506b8c299422dd0dcfb2a4288e9ab554962e25f56a3018e9a561922ba5948c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012796, "uuid": "1f4d1e9f-f400-4a83-b5ea-839dd1442caa", "comment": "Malware payload (Rhadamanthys)", "value": "fbb8a7b17ad935af1e215100201da88721f8c2eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012796, "uuid": "ea10352b-0d0e-4e97-838f-2e20f3cb12d1", "comment": "Malware payload (Rhadamanthys)", "value": "57a15ae1058890569be7fcb1b4ac6c2a5bcf1c3f0de66cfdcd7a20361783af3edc722dee91206dbd46340c0ab445d1df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012796, "uuid": "c2e47b0a-5b91-4979-bcb9-f043549258d0", "value": "T19A93E6190EA6ECA59561BEF1BB9316F6CE5BA44E81C102C5986FF7027482F2C3F445CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012796, "uuid": "617f2eb2-780d-421a-aa17-5946454018f5", "value": "1536:GDB7eKg20gBirTrlRCgP6swa1A6NI/oT6BkQWJ+aY:GDB7b0gBgvvCC6swanNI/oT6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012796, "uuid": "b71c26c1-48c1-44a6-a719-1027f4d98dbd", "value": 96077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012796, "uuid": "a01974de-33b7-4664-ba83-ae5ac9082614", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012796, "uuid": "26bab5b4-2490-45a2-b187-3c430256e09c", "value": "invoice-1637482117.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70db9695-1234-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772015186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015186, "uuid": "50100652-f51f-4bbb-9a98-df5c42d34305", "comment": "Malware payload (NetSupport)", "value": "a8f59d6e05899c16a687bdb4ae5b12e2", "object_relation": "md5", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015186, "uuid": "d346f742-6360-4cfc-a311-616c005215f0", "comment": "Malware payload (NetSupport)", "value": "a691097198c783bd5a543c0a1462c19245f6d648855e588a359f8b8d8dffca5f", "object_relation": "sha256", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015186, "uuid": "0e534e60-77cf-45c4-9534-8bd8ae7ade1f", "comment": "Malware payload (NetSupport)", "value": "5c141bcd95b179095e70b56e3a74adab6e906fa7", "object_relation": "sha1", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015186, "uuid": "925388a4-9808-4675-8b83-e04d03b03a72", "comment": "Malware payload (NetSupport)", "value": "808e18e18be7b3486eff02f3f8ee11d1a841350ea97bb024b0c37a01c0e912a19bcc31f1b506684f603be7327d6024ff", "object_relation": "sha3-384", "Tag": [ { "name": "103-227-84-10", "colour": "#46E337", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015186, "uuid": "a393070a-7b61-4f7a-ae84-583dc809732a", "value": "T121D633A0A6E811FBF9EE933DC9129592889A35673B45C1D3C3F8D1A12D733C46A3E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015186, "uuid": "9904a50c-50f8-4844-8f16-a8753088f354", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015186, "uuid": "4f62d582-4a0b-40c3-b941-a619131c4689", "value": "196608:M14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorW0urH/P/XRLSq2KKeF:M14FSsFl7dCR1C99/LkuH0uDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015186, "uuid": "00554606-8aba-4bec-ae32-dc26ed202fed", "value": 13414697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015186, "uuid": "1b197d0e-ee0e-45d5-8460-2b0e044bc52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015186, "uuid": "3f11109e-19d8-4611-b831-38d211e45b04", "value": "us.gov.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0317b573-1265-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772036047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036047, "uuid": "40ce1106-40f5-464c-8a17-e9962f736fef", "comment": "Malware payload", "value": "c38458d38bcc369691c3e6aba5951f7e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036047, "uuid": "49e98b34-2890-4b78-ae22-b791080c377b", "comment": "Malware payload", "value": "a8690ae273b872e19771f12b7d9a24a0282dae5aecf8e8cc38b32e02d8f2a7fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036047, "uuid": "e66e628e-eafb-48ed-aad1-1ae04c5d1cb1", "comment": "Malware payload", "value": "1f150ac4631eb35157deadbc35a1975fda4cebd7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036047, "uuid": "4febee0d-b2a1-406a-be4a-5f7067412944", "comment": "Malware payload", "value": "d40e4c85bc3551ac17511e4cbc8821e1febc35743d0999cb3cfbf85f2ff8a09e925f6f2735002eeb27a63ec70665bdff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036047, "uuid": "277524eb-07b7-428c-b7cd-509e34ee4813", "value": "T1E63633D11611969FAF7DD9736A0A16B86940EB324365D3F9E8753BC0BB4093E033F9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036047, "uuid": "95c17aeb-a512-4dbc-92af-561497aa3732", "value": "98304:rpiisdr65KqEt6nm6hijUBfCydvIR2he2idUWgwDf8YtAgaqpPXF6lYCYGuTQa:1iisdcKvt6nm6hijgfCyZjCdUzwDMypb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772036047, "uuid": "d82100c8-6b8a-46e4-9357-4bcc668e504c", "value": 5271870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772036047, "uuid": "369aaa5d-6bd3-4350-89b7-4e9a81facb7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036047, "uuid": "99063969-77fa-4f25-a288-87d2d66a8bde", "value": "NVIDIANotification.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392a8c51-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003067, "uuid": "111e2bff-ca31-46d4-9a68-85a6a8f85367", "comment": "Malware payload (Mirai)", "value": "426671bd60ac27f6261a52c58eda9ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003067, "uuid": "e355a639-6fd8-4d13-bca8-205044ad5939", "comment": "Malware payload (Mirai)", "value": "a9b26f00361d52b2157c22ea7a664f36df511f8ff911ab6c96d14fb681b97d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003067, "uuid": "22955b81-0163-42d9-9b2c-42e5d6329815", "comment": "Malware payload (Mirai)", "value": "2b523e4835bc25d8a842e7975784eb9a6fba6527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003067, "uuid": "3dd5ffee-fa38-4934-92d5-3d0166beb9fe", "comment": "Malware payload (Mirai)", "value": "4e18c58b65009410b469447bfb6c49508978efe61922e2c00cdaf2b8438118bb674fd4f750a5272d1ce650117dffa814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003067, "uuid": "c9374795-9e0a-46ec-8bb6-d21407203d3d", "value": "T1037328C2B547C0F9E81748304067F77FCB31E6289061CA6FDF6A9E76DE23542621729A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003067, "uuid": "2a839ce3-51ad-40a2-94d4-eb7406ab5538", "value": "1536:xRm7i25PUpfDuY8yYi2AE48YVULM9WxiEKJRh1F7a3ytY:6eOPUpfDEy5PE48Ys7QEKJRDFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003067, "uuid": "32fb7190-ba65-4ec3-b8bf-5fd7ac7e45d6", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003067, "uuid": "2af836ed-78be-4484-9fe9-e7de98493655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003067, "uuid": "d6809784-4eac-41d9-96b3-acf3180d4491", "value": "ez_nigger.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300d8101-129e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772060604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772060604, "uuid": "7388c6ce-ce98-4b2a-9cac-ebc338e1d8f6", "comment": "Malware payload", "value": "5ca998f08206d683746ebd4a0e597da8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772060604, "uuid": "08545aeb-8c5b-406a-92cf-77f6c714a2ba", "comment": "Malware payload", "value": "a9f8b78385e5371b793c25d35ac0ab5d1809de66154d163027c60c0c188053c0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772060604, "uuid": "66b55658-b0f6-431e-91c5-f0a6d799ff50", "comment": "Malware payload", "value": "1dbabb6bddd808461005ec884b62bb460aef7737", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772060604, "uuid": "6bd44364-96ec-42f1-8469-f3e9269e50c5", "comment": "Malware payload", "value": "7a6b5b5eecb5ce0d3d647c680646d6c7c0aeb8790e642bab815f9bc1c9cd27580a0a7417f9b7d19e2a10cd96a23000a2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772060604, "uuid": "13a8db11-ccc5-4c28-8f64-9cc99e0b508f", "value": "T1B3518706E2F2316527529C2412B72E3F9AA89817DE07CD50356D1EE8BF75874FC07E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772060604, "uuid": "1e51bf4f-d647-46eb-8a6b-0a7bc668abda", "value": "96:hYPYSyiXfUJMPqUpIHHHHHP9naHHHHH/1OSxe7:hYP38JTWIHHHHHFaHHHHH/ESxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772060604, "uuid": "66fa3f4a-74b9-49ed-8c26-5f8413576018", "value": 3162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772060604, "uuid": "8aa09c25-5d07-43e7-ba74-3fd917d09457", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772060604, "uuid": "9f90513d-5974-49a8-b1fc-9d479797f77a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b6a1d2-11ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771985296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771985296, "uuid": "db322e93-c8ee-43f9-bebc-b97145cc5208", "comment": "Malware payload", "value": "1340efd6954d78f9fd979135b01e40a1", "object_relation": "md5", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771985296, "uuid": "2e80425f-461b-49fd-8e5b-84cc1e5b607c", "comment": "Malware payload", "value": "aa48c2758f396c1d5b6fc7604bfd688b4f6eefcc61b50fb383f11dcbe4e90d75", "object_relation": "sha256", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771985296, "uuid": "271a3089-3305-4250-ad42-2912139eea16", "comment": "Malware payload", "value": "c34f768a7a727fd2800a02163d1fb4e8331d7fa6", "object_relation": "sha1", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771985296, "uuid": "64eab7b9-186b-4a4b-89db-3035a34ca695", "comment": "Malware payload", "value": "58217b7091bc64dacd8fa72f1fd516f28b4772a04a330c114f75227cfa69d0a120316faaafc9331a8982daddb3b78094", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771985296, "uuid": "c29df0d1-78f4-4ee7-998b-2344e91ba87f", "value": "T1FEF7BE6D13BCEFE4F039BCCE409E2C9109982305A67A6233D25CEA55D3D875E0E768D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771985296, "uuid": "764376d7-33c6-4ab7-b88d-831b266f7071", "value": "347242d48a281c2f06e28c2e3e32b2ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771985296, "uuid": "d2e62dd7-c16d-4d6d-87bd-b5cdcce90175", "value": "1572864:FF+IY7nDAWyY+DhXuC+CR3kWPrjfy9UDOgi0FYg9Sz+OU3PGRZ2E:X+p7nDgNFF+CRhFYgDOCORZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771985296, "uuid": "ba365be9-8af1-425b-95c0-5746208b6afd", "value": 74105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771985296, "uuid": "461f158f-1de5-48b6-9717-97f03a027ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771985296, "uuid": "f44d7c8f-a07a-4c17-9bba-dbc667425737", "value": "NotaFiscal132421323344432026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93879f39-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017392, "uuid": "bc16795e-b081-4138-a09a-17203bb34685", "comment": "Malware payload (Mirai)", "value": "aa1dfa735f6913529d3048a40e2d4e1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017392, "uuid": "bc27150e-9036-46cb-8e88-5ad5d4f89035", "comment": "Malware payload (Mirai)", "value": "aadd6c06fab540b50b2f84fe852b970fd625defa427597e8a4c0f33ca1320c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017392, "uuid": "6de29364-3fff-4932-b482-0aec7b0186d3", "comment": "Malware payload (Mirai)", "value": "1e60fed1562b19abcfd9d6ecfcbdd20455ff5f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017392, "uuid": "967237a6-5e50-4589-b7ab-f55cd9f3306b", "comment": "Malware payload (Mirai)", "value": "05d4eadfea71d8a95499bdadecf5fde5a7fdeb95cd4bd9e24c85a87cad2c695ec01233688e638c133bf26a766c2ba78a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017392, "uuid": "5260f2eb-49ae-47fc-baaa-f5a9bd920622", "value": "T180330A9EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017392, "uuid": "c1bdc726-0cb9-455a-b97d-39a4703b2d73", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGS:r/hqaJMeteqK806MHdkfQX6HuCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017392, "uuid": "bf0c1fd9-0868-4d12-add3-f37d24418c20", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017392, "uuid": "36aeabd8-1fa5-4eb7-b32d-169b1e03ae7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017392, "uuid": "cd9f2268-acd3-415a-b379-073c191598da", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bccf1ff-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045591, "uuid": "272b319e-5c5a-4f1b-9fd5-f0be2bdeff75", "comment": "Malware payload (Mirai)", "value": "cba2e794e63a4588bc5fe8e01ac29966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045591, "uuid": "fefe22f6-091c-45c3-85d1-7c9091e695aa", "comment": "Malware payload (Mirai)", "value": "aafc0007db2fe59fcf25dc26ea16382a9990ce7ddbd34ab6e5fba2117282f914", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045591, "uuid": "74a95886-c98d-40fc-a313-c6b826f86eca", "comment": "Malware payload (Mirai)", "value": "bcb834f6bca29fc04ec4ed7f38aa6dae3b38a229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045591, "uuid": "0fe41601-afb3-4dae-8c51-2c318cd21608", "comment": "Malware payload (Mirai)", "value": "973d949613bd9f56e26fd9157921de8fc71d9a6120144cd4b34047fc46c84857e06958fd0cd54ec673892717e6af0b6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045591, "uuid": "58ab1e68-e0a2-4a7f-815e-316d222a591f", "value": "T135A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045591, "uuid": "52adfa41-f6c1-480c-b2f6-3157a7786259", "value": "3072:VK1z13U6HzHoXRtmTUhQog3EmmFVcqq0GnDZT:VK7DDeKlog3EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045591, "uuid": "9e2372ae-451f-422f-af72-ecdc757cf6ae", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045591, "uuid": "a5edc879-07e6-4dc0-bb6a-3dbbda35ffd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045591, "uuid": "8f025e3a-3560-48c3-9839-eae06ec5a586", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb51fb1-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017385, "uuid": "a0ed9d47-edf9-4fed-b090-c3c6ccfd4e35", "comment": "Malware payload (Mirai)", "value": "ad04d1a8355622cb1f920e6674170d81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017385, "uuid": "19041706-ac8f-44be-8b82-e789177a7d65", "comment": "Malware payload (Mirai)", "value": "ab277a4ed7e102b7ab4c204127cc5c38ba69cd8799d6042518457b0225abfde0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017385, "uuid": "76083996-90da-4cd4-96fe-69bbc90849d4", "comment": "Malware payload (Mirai)", "value": "6117743f7421bc2c934b8abddf50bb671a149242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017385, "uuid": "4b9b4349-a545-44a5-b729-c963e23fc0f7", "comment": "Malware payload (Mirai)", "value": "8e595c38d863844e346c53fcdfff03c71bd8f96eb87f5b2a30b65d52e8cc8ef6e07970fd3832b11046d44affa0e40721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017385, "uuid": "0a0ce7a1-d673-4fc0-9963-42a2a42601fc", "value": "T14B230271490E8EB524303C72EFD99793B6E12AB1C6673023D6280A386F757531E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017385, "uuid": "cdb34685-bae2-431d-b195-a6953039efcd", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3M4V9q3UELbUXfi6nVMQHI4vcGpvt:gECFd+A6YHAxMJLRQZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017385, "uuid": "d2e0420f-96db-4434-a4a2-7be16ee09edd", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017385, "uuid": "d8f175cc-ebd6-438f-a6ec-930a6acca76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017385, "uuid": "7ced9da9-2462-4cdb-b2b9-ef8a5518e25a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8ed8a0-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035952, "uuid": "fd18ceaf-6f65-4218-b2ed-6d5e0e4ec7fe", "comment": "Malware payload (Mirai)", "value": "5a442c288a58d9eb10c6f1aad2d02186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035952, "uuid": "70f7bb63-4e2a-495a-876b-0e11800a6b6e", "comment": "Malware payload (Mirai)", "value": "ab880037ebe477c1043ccee499c418644aa0247b93d50c95bf4f1b60c4ef5f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035952, "uuid": "722f6974-ccae-4f12-be9b-cf836688b9eb", "comment": "Malware payload (Mirai)", "value": "5288613d6675932d5f882d4ebc83de29df97323c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035952, "uuid": "4a3d1205-7bbf-4d3b-9d98-48577bf812b0", "comment": "Malware payload (Mirai)", "value": "09ce0b56f3e17d98d7eb1b7ed6815daabfe7815cad0c60ed9b7b1f8344c83348c58fe7b4b981bf0e74dfd1a9293738b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035952, "uuid": "d7c86415-4065-4a9d-b682-7cf8714db635", "value": "T1E49618C1E891D28AC63C6D31EFD5EFE8E26B2E315D88994AD9C8F33E58B315480F5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035952, "uuid": "647d3aff-1eee-4f93-a5c4-0133352661c3", "value": "98304:bJqEt+wWOjJeX7Girk0zBo9yTedqHN0k69GoURgjEN:+wyTX0XUXRrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035952, "uuid": "f127297b-32b0-4e12-8071-be1449d05c24", "value": 8781972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035952, "uuid": "33a4e016-0f82-42d6-bbbf-8732566371dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035952, "uuid": "28b6bcaf-ac9d-41cd-abad-237f99cdd6d9", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad20a376-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012710, "uuid": "f40f2e46-bcf4-463d-aa68-169d7b3efce2", "comment": "Malware payload (Rhadamanthys)", "value": "5fcb7f678bd61eb3d71e8bb2f8c45755", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012710, "uuid": "925776e7-9a8a-457a-ae15-c69eeb528796", "comment": "Malware payload (Rhadamanthys)", "value": "ac87add4a40deb4f149bed9f19a36e27865ae6d744472237c253d6c7082089a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012710, "uuid": "d3fd68b5-01a5-4be4-ab48-03481009a5db", "comment": "Malware payload (Rhadamanthys)", "value": "4487481be80bc0c1e34c5425c4048c0dff7ab532", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012710, "uuid": "91745ab0-8a82-41c5-a01d-4b31042108d4", "comment": "Malware payload (Rhadamanthys)", "value": "9f6e3c4c23fd661627ab703394d95a090ab04e477beb0f91a1009ddd595260dd8137d28fbca8a86b51b179c0f06bb977", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012710, "uuid": "1b837d4b-2485-4c1e-b052-d13e56e64b54", "value": "T120A33B8C5960E13E0DFD2EE73CF287F5DA2909445A615AD1BA9A3730C29CE03B5F52C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012710, "uuid": "82a6ec3b-119a-4570-84b4-31d313a5849d", "value": "1536:GDB7eKg20inVn8llPRQu6mV5r8Oj58K7E8kbCVLiLLnblJw8RarE+zTrf5WI6loQ:GDB7b07BREnWn6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012710, "uuid": "d030429d-f498-44d2-a9be-9f10f1811945", "value": 102772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012710, "uuid": "00763837-b316-45c7-9936-3cc3e706a558", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012710, "uuid": "c18f3db6-761d-41db-92b5-1a668958096b", "value": "invoice-1637482117.pdf (99).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b097427b-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012716, "uuid": "22ab73e7-491a-4dc5-9877-35cc0d6aacbd", "comment": "Malware payload (Rhadamanthys)", "value": "8ff83524c375dfb7d98f69d65cb8a77d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012716, "uuid": "b06e669f-b28e-4b0f-9d7f-e67968d18392", "comment": "Malware payload (Rhadamanthys)", "value": "adf38d26fd4397f7ca8470c6ac9eda73dee4c1b09aca7bb7fbe81589a8184535", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012716, "uuid": "c8dd1d05-b72e-4ab9-9182-50a28eb53967", "comment": "Malware payload (Rhadamanthys)", "value": "1597fa5bc20d3f8ca1386c1d7fec0f814574eebb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012716, "uuid": "a5818afe-3f0b-4022-975d-5340e97e846a", "comment": "Malware payload (Rhadamanthys)", "value": "12fbc5bb65a3aad8e17ba4fc2fc97f810ad05871ca04c24bd692868620f0fb38f57b6002e05e75932daa9856095aa51b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012716, "uuid": "69065bbb-818b-4fef-b76b-ba66545da94b", "value": "T188A3FA832E236CF4162756825A522AD3D86584A57FCD02CDF42EE33406BE79E3B590F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012716, "uuid": "e1ea0966-c808-4030-8b53-ae8388c70aae", "value": "768:GDhd0i7J4sYKgY/CMNfWdFj1prXJ+rH4gz/EHVaaTxnr0AIobsGmsSLAuAAroQWK:GDB7eKg20tr0rH4OA8AWLs6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012716, "uuid": "b089a147-f868-4b96-8e91-72297f4fcadf", "value": 101369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012716, "uuid": "a988d1f2-af98-4906-9942-106a4b012be5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012716, "uuid": "02a264ab-4667-47a2-b7a5-f2055acb34d5", "value": "invoice-1637482117.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6bc6f8-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045589, "uuid": "fd7a8a8f-9e90-4306-8849-761f5bcb25fc", "comment": "Malware payload (Mirai)", "value": "0a50b4c9e7ae6dbe929d1849d651689b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045589, "uuid": "c0329e75-d441-4629-96b0-0b8063b67d7d", "comment": "Malware payload (Mirai)", "value": "ae6d1c92cf378ba3bc20a8c1387556c95e5841ef6b8cf0f534222204469e67a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045589, "uuid": "cd189319-ec3d-47ea-ac96-b1a88e8b4ff5", "comment": "Malware payload (Mirai)", "value": "41026e5f8ab6047610ac725a9a8a356db7d02a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045589, "uuid": "98ea33ed-42a7-4695-ae19-9fc886fb0992", "comment": "Malware payload (Mirai)", "value": "710f5b7969122ccdd11edf2e077ec22f36a1c4a0321c8441af013120609491bf7b385d36d34fd98e40c548864dbc9e3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045589, "uuid": "55d18019-25de-4d02-989a-e92bfe9de509", "value": "T129E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045589, "uuid": "10532cec-cc92-4c24-92b7-4e2b3b79545f", "value": "3072:JW6dm9tS1aRGQdK76t/zCqI5mrThPaLEnvPrNb:c6IG+LC7mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045589, "uuid": "2d23a47e-2f07-47f5-ac14-76d4f1e7ff2b", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045589, "uuid": "d648f34d-84dd-4ac0-b63c-30bed82c8044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045589, "uuid": "04aeb3f7-e9b7-4adc-b560-e4aaba0c35fb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b66f8d3-1211-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostFetch)", "timestamp": 1772000198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000198, "uuid": "75b56a35-dbae-4f0a-b6cf-5eb0834db907", "comment": "Malware payload (GhostFetch)", "value": "940f0f4f4231808eb2d39c0c3217a553", "object_relation": "md5", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000198, "uuid": "7984e862-7f2f-4801-9b9a-38c3b0bcd138", "comment": "Malware payload (GhostFetch)", "value": "aee523056d602571ff006565b432148715a6a13d098d518ba8131ccbe719c043", "object_relation": "sha256", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000198, "uuid": "05f195cd-81b4-4b15-9bea-aed513af46a1", "comment": "Malware payload (GhostFetch)", "value": "7d3757d5165e2e95b0b89e33316025a4b9301e2d", "object_relation": "sha1", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772000198, "uuid": "a4200868-3b67-44c7-b243-cef1f779578e", "comment": "Malware payload (GhostFetch)", "value": "74d485b9eea7fdbf0f0a46469b8ae903814406d0815c76255e3fb0c34cc18061ded1d7ef00f468e41269e0eea9ac1890", "object_relation": "sha3-384", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostFetch", "colour": "#CE2A78", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000198, "uuid": "d1ec6b42-9397-41ea-8eb5-468fdab15437", "value": "T117044C5872AA00ECF53399B9C1574B42E5777C616B21AEDB033083759F13AF4AE3A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000198, "uuid": "fd8e814d-dbc9-4515-becd-a5770e5ab001", "value": "6d9148e6fe8f4b0c2d3be076d75bbd03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000198, "uuid": "8c63b520-b87a-4594-9ba7-cf280268700a", "value": "3072:6G59d2jYVa/UH3zYlsuG2uow1DxwUcYRwt3QIsybbxZZT:H59d2jKa/oWs4QDxwl/TJZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772000198, "uuid": "2841236d-9e01-40a3-acc3-aa25f74ba7cf", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772000198, "uuid": "b4b46703-50cf-44ab-9aa6-8d2823c2f295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772000198, "uuid": "71e35b7e-1ba4-4bf1-9861-18ebc561bcf9", "value": "aee523056d602571ff006565b432148715a6a13d098d518ba8131ccbe719c043.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708a387c-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991993, "uuid": "6b2ee6b0-33e6-471e-ba3c-011a16828e12", "comment": "Malware payload (Mirai)", "value": "4eab39f9301b5b66fcd4b95ed9938124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991993, "uuid": "d948b96d-0376-4da8-8832-1bb45e0c8122", "comment": "Malware payload (Mirai)", "value": "b1a122473a7ffd38305703219562e87500772622e3f20c055eabbac72a455b8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991993, "uuid": "5c07438f-c91e-4c10-8496-3f69ef96b3bc", "comment": "Malware payload (Mirai)", "value": "89b754daa3f238ada91c547abf49c2d95d0fc37e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991993, "uuid": "56f65914-1fd7-4123-8be8-154338d71f5f", "comment": "Malware payload (Mirai)", "value": "e3017e3de5ce62993c73466bbd77fb6f5399236a6faf7dedac02e7e4b42b69c78905e37f495e1b06644518cf5f7561e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991993, "uuid": "41682fc2-22a5-49e5-92bc-c59bb4e33064", "value": "T1BAB3E8B3F801DE66F406E6B208A38C267D70FEF30B62156263177A9BDD360D61497E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991993, "uuid": "2234788e-6f00-48e5-9d8b-c73b92482bb9", "value": "3072:xpkTqZn9QeuacWjcW0JcWcB5MubDSAewPP8tAn7:xpjn9QeuacWjcW0JcWcBWubO50P8tc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991993, "uuid": "9216d78d-9117-4e7b-91d4-b592f18e4543", "value": 112080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991993, "uuid": "829256a8-aa4c-4b57-b51c-2d1952c37553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991993, "uuid": "527e77db-88f3-4b2d-b419-49485e7ecbd3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29be3ba6-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051574, "uuid": "b4aa58ff-4f66-42d3-aee2-7a72f4fa4fc9", "comment": "Malware payload (Kaiji)", "value": "b17d39340240af6db72a8fc135f8cc78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051574, "uuid": "1769b3ba-07f4-4db4-b919-40b46c74107d", "comment": "Malware payload (Kaiji)", "value": "b242266656a36344b9f3d4e011763812e8c08178ab4dcfc098820b0bc55c7974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051574, "uuid": "75d5e03c-5d17-4a81-ba09-61f861651463", "comment": "Malware payload (Kaiji)", "value": "0581d06c01e91019ed64bffff0168e8ec5fc752a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051574, "uuid": "ed9318cf-936f-4409-90c3-8507293dd1ae", "comment": "Malware payload (Kaiji)", "value": "58780ac03408a218197bc231327ce391611740ad771f2596ba4ee00bdba7e8e47923c1afa1d4125e836216a56dad2eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051574, "uuid": "24e675ff-6130-4af4-ab37-950f72e5d9f9", "value": "T1BF56E604BDC46BB6C82C8B7584E6CA9223B06D144AF15A271664FED9BC762787F47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051574, "uuid": "608345c8-7dc4-459e-81c8-b16b004b93ba", "value": "49152:+RxVVRFMTwxupkYzfgh7rxQ2USaU85Jbq1rQcR6VYv0VF1:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051574, "uuid": "679b44c6-e792-45a3-8126-1b751d46471a", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051574, "uuid": "a1ffae2a-0186-4186-ac6f-5845ed40786a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051574, "uuid": "5e568ea4-90ca-4b59-8c68-455be89af724", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da7d081-1280-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772047769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047769, "uuid": "a6b1ce72-f8b2-4b7b-9ace-c5abb46fc536", "comment": "Malware payload (Mirai)", "value": "8a16abb178dfa6b2335a4ffafe3c06c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047769, "uuid": "9adbc52e-47af-4458-bc8e-a0d24c520a89", "comment": "Malware payload (Mirai)", "value": "b3a24cb6355026c0a5c8d0516bc9bfb0ece76a4870958277df2fd6aebcf97476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047769, "uuid": "7c05d696-4e88-46ea-ae5c-1f29bf76eb9a", "comment": "Malware payload (Mirai)", "value": "02be34622a38525b41988cc3d0632b1d185447d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047769, "uuid": "71c4f408-dace-4249-bfb9-9189afe4353b", "comment": "Malware payload (Mirai)", "value": "b14216c43aaa67172592ae783362c28689211e530bb458a73288ad2cc5725429b01ca587a5b01d2a536dd77a02399e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047769, "uuid": "f956f958-d329-40de-95c4-dc558191ff36", "value": "T16B83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047769, "uuid": "9984eb0e-4612-4faf-b25d-069f07173ca9", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTY7ZDYovZ73x/nL8y8Qy:Rakdn2Eo3ePu5GTYRYo99Be037Wj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047769, "uuid": "256e94f2-d230-4eb4-9c61-4624b1ec9644", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047769, "uuid": "2392dbff-e68c-49a7-9868-b005df0709a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047769, "uuid": "4ce78ed2-5361-4920-88b4-c1e5f4881442", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0162cfc-124e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772026540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026540, "uuid": "22ca0fd0-0b56-4582-9532-f581b58df2ff", "comment": "Malware payload (NetSupport)", "value": "8fdae5fbe8d3803f869010d69c47cd88", "object_relation": "md5", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026540, "uuid": "c8ee57ee-9d9a-4475-ab2a-35566553c819", "comment": "Malware payload (NetSupport)", "value": "b54249101d2cb7e12d141b44babf815c1254ac45ffe78d32128b4a885ee388c0", "object_relation": "sha256", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026540, "uuid": "bdfe0ac3-ff74-4aa1-8775-925f683edb29", "comment": "Malware payload (NetSupport)", "value": "cfcfdcb20a0c47274e9ef14faeda88965128d6e6", "object_relation": "sha1", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026540, "uuid": "5e20a2d3-926d-4662-af8c-1dec5056933f", "comment": "Malware payload (NetSupport)", "value": "fe50e8d126dab57f2b40cd39a79cee01d199d32c91c145e321c321c3ace05e31f5167022a59983c73e059cf9458ea2d8", "object_relation": "sha3-384", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026540, "uuid": "8195f711-4519-4ce0-b98d-5ef7ed7c822c", "value": "T18DD633A0A6E811FBF9EED33DC8529592C996766A3B49C183D3F8D0A12C733C4597E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026540, "uuid": "bf9e3818-cc5b-49af-aada-b94ac81565bb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026540, "uuid": "8b1f81e2-0171-4ad6-973f-d061d3e39838", "value": "196608:714oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorOnFurH/P/XRLSq2KKeF:714FSsFl7dCR1C99/Lku3FuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026540, "uuid": "4175d673-707a-4b61-bdd9-80edcde53604", "value": 13413536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026540, "uuid": "72f56a51-b73b-4110-9f10-4ab16fd53a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026540, "uuid": "d114dbd1-0e61-45d2-9dbd-bb9207c09d2a", "value": "b54249101d2cb7e12d141b44babf815c1254ac45ffe78d32128b4a885ee388c0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2ddb9d-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012977, "uuid": "75f1ea1b-977d-40b0-a400-d9583c024c9f", "comment": "Malware payload (Rhadamanthys)", "value": "e58cd98f06495b3c77c2fea58ff06a52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012977, "uuid": "954896b5-f8ba-4dc4-afee-fefb0927e058", "comment": "Malware payload (Rhadamanthys)", "value": "b5ab139464ce8a4c6dd15e4a3148bd4e94884f6f650c6c177c980177f96d44fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012977, "uuid": "acf9bbff-0e98-4eff-b703-11e8b01302e5", "comment": "Malware payload (Rhadamanthys)", "value": "607c4cd1a8edb1d8eb3635dff67ac74a0d5159c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012977, "uuid": "269d9770-ad8e-4545-9de7-5484ed1daee7", "comment": "Malware payload (Rhadamanthys)", "value": "f40d6788c78896b93c1f841ee6d07be8bc0451f9ded0b140d7be8760df8e9061db0a548c36d5a8d363a4f9ed31b1144c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012977, "uuid": "3039069e-9b70-4be8-81e3-e516f187e470", "value": "T143A3FAA94C05AFD53AAFA0901EF969F5CE011C5693EBE4158DC7EB3BF1008065AFE4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012977, "uuid": "f6f013b1-3803-4ee2-92a1-00d4d224aa2e", "value": "3072:GDB7b0+qvHYtK/ggBoLj3N7mCr61/1I9nkzbGNFoSU3Is3jFOPSm9GOhk1KxvpiS:0nqvHYtK/ggBoLj3N7mCr61/1I9nkzbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012977, "uuid": "5d1043cb-7d49-48e1-9929-71352c5839c4", "value": 100879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012977, "uuid": "f42ebdda-9c56-45ed-b9d9-17ea566ad3c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012977, "uuid": "dfda4ed8-1bef-4e33-b7e3-8a2a9620165d", "value": "invoice-1637482117.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fc0b28-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001053, "uuid": "45567fc1-61db-4ad0-b36c-04b325e33808", "comment": "Malware payload (Mirai)", "value": "1b6f542b6bf453d6b6c9e0a240ff2aa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001053, "uuid": "6f9651f7-9537-4b38-bb26-936c994d56d4", "comment": "Malware payload (Mirai)", "value": "b683f75b4d148ee87892db75e268901702d9c126548aac22654ee8b061eea6ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001053, "uuid": "7112545c-821e-436d-bd4b-c76a7d0a9db5", "comment": "Malware payload (Mirai)", "value": "d0f4160ee62c450beb907ce0de99d90ae1c50c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001053, "uuid": "c6f4d0c9-526d-4381-bc3e-a0a9b222b85d", "comment": "Malware payload (Mirai)", "value": "a6024fca6b18adfc4f3397235f4f9540733237fd970a8736d0d0f75a17454a89d4d3827722393183a29388b55a0939a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001053, "uuid": "5777c8cf-b7b5-40f0-9c63-620fc08c80b5", "value": "T114333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A02711B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001053, "uuid": "0bf7bbb3-b4d4-43b5-bb35-e432403f9875", "value": "768:VwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98eN+s:VwOt37pOzwLMU431ANA0BLBCyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001053, "uuid": "9bc31b59-a39c-47d6-8f4b-a7e597577a1e", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001053, "uuid": "064bd51c-2cdf-4b58-b7bf-99dd4118a17f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001053, "uuid": "66b6fba0-7c3b-4f0a-b225-b28aaa40bb63", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300ac680-11f3-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1771987160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771987160, "uuid": "20db37cc-b520-4f8d-90be-80c471026500", "comment": "Malware payload (DonutLoader)", "value": "f1822314540832e92413bc39f8f0e135", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771987160, "uuid": "53e726d5-f069-459f-b54b-a5cdd8e74fca", "comment": "Malware payload (DonutLoader)", "value": "b6bb5d5959909551517f75e8309b7044b20bf28b89da2ae413757a69bc109559", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771987160, "uuid": "1124a91e-2d7c-449d-a2fa-ce63e20433b0", "comment": "Malware payload (DonutLoader)", "value": "1d9c06ed981f978968fe5dad7acde7ffc444e7f5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771987160, "uuid": "2748f311-71f2-4f65-b8e8-1c10def3affd", "comment": "Malware payload (DonutLoader)", "value": "bac024ed5fb79943ca149a75c5e547590fca1017ac69f6a6d987035b841a7f5698bf7d8b2a78f31cc3880dd0de2d6996", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771987160, "uuid": "b991339a-40aa-4e06-af44-37e8c8f3f39b", "value": "T12626021189C42FB9CFAC5A1C90FE171E63E04A9E541A758AEF33BD47AFE7944020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771987160, "uuid": "f606cc7f-2eef-415a-869f-ef51203a14bd", "value": "24576:feibphBDz6jVanpw/iFSzog6PycNBSQY4jiSYZPQmKaFzFnw1NYda3SMIAw6mD3o:HDxve2EdTPxjFbQ7wzXe1DyuKozxW18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771987160, "uuid": "88a21f80-0300-46bb-819b-e8881f8592c1", "value": 4498808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771987160, "uuid": "06d2e077-c7c2-4893-a864-c76f58f1a0ed", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771987160, "uuid": "7571ac8d-a2fe-4e62-b718-1d137654c3ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715a19df-1285-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772049976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049976, "uuid": "d32b562b-a1ef-426f-8904-49f4a969af77", "comment": "Malware payload (SantaStealer)", "value": "2b3fa95cb00e0cc7d60a7515e1affa52", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049976, "uuid": "9ff09345-b501-4ba0-b13e-a388b9719aa2", "comment": "Malware payload (SantaStealer)", "value": "b8f664bb33570ef296d2dac59e04735830af97de464d546843045b2cf4d62741", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049976, "uuid": "eed7c6ae-6949-4699-bdab-7b23dc81d00e", "comment": "Malware payload (SantaStealer)", "value": "95ea527c0c8766109eed73a1b3a0e67fb6999655", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049976, "uuid": "355701cf-d12e-4d83-b479-5d075cb8bc0e", "comment": "Malware payload (SantaStealer)", "value": "36cf7bb1fbda4feb4e860d6e4cfdb4554db668c7d076c79a7723ce0c99d7d99362b08d0fe819855601bf03ec68d4269f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049976, "uuid": "7efe2f89-eecf-4e63-a02f-4ab3b8d1f2d5", "value": "T1F6F6172010D96607FD3EEFBD85DCB6444F7AB2953727EA389B410DE90BD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049976, "uuid": "17d0cc54-f199-4ae1-aa76-52eb96cbe992", "value": "196608:00c1TnWqBGXav8jdReU5rE6PiJzKV977JITKjFRjeIrk2+YLFF1FSm/vo:0xnpQ68ZEU5rEhW9jrjeaP5F10mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049976, "uuid": "e36531fd-181b-456f-8854-fdd4ca358369", "value": 15386112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049976, "uuid": "8ba815b1-6856-401a-8cb9-22d92cd73671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049976, "uuid": "88e722e5-b5e5-45c9-9cb4-7a71bf7614f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276b3b49-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051570, "uuid": "58012c3e-d605-4a87-b8a7-24dc8eb2fff4", "comment": "Malware payload (Kaiji)", "value": "f4bccc5b19ca78daa54daa7024ac94d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051570, "uuid": "1f266f48-ea86-484e-a2e2-36bbae754a63", "comment": "Malware payload (Kaiji)", "value": "b956bbefa82f464cea53ebaa9ee303813de81319f222b31b4613139258d3c0db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051570, "uuid": "0c5ea974-9da1-4d04-b651-69aab2bf58d6", "comment": "Malware payload (Kaiji)", "value": "64a9dbfccf9ec65d15d3af46ed9b91657e7c34b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051570, "uuid": "d700df87-04bc-4e15-9eea-7867211ad463", "comment": "Malware payload (Kaiji)", "value": "b4db1c747cd262a42c346408cafa48be87b61bc78c6e37aa8d609df627c655e6d612126880aea0bb4c11cf4fc33823fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051570, "uuid": "124fa4be-03c5-4f8f-bc0f-b57fb52a59ce", "value": "T1EA362A57B8D28A42C0E4367ABCBDC1C432675EB99B9B12675D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051570, "uuid": "bea958a9-c2d5-4bd0-9c8b-9837ab2e187a", "value": "98304:8cSBHdgN2a7JP97kJru8cYWPAXqcu+60:8cS03Eu+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051570, "uuid": "9538c270-cb9e-4b10-b072-68cd4a5c928c", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051570, "uuid": "e21d675c-8d6e-416d-8fc5-281bc6da6556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051570, "uuid": "51c2d184-5586-4836-855e-47cfaa3d940e", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2316347a-1236-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015915, "uuid": "f297c6b5-8252-42d5-810f-24444ed78eac", "comment": "Malware payload", "value": "b9179ca37fe7c1ad67b13480d02df4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015915, "uuid": "094b7ac2-a39c-4d71-b1ac-bae76ce8da4a", "comment": "Malware payload", "value": "b9cfede5b9fdc3ec5c137bef9be25bcbce2468ba2d4eec2c686584be1d8613bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015915, "uuid": "ef9819c5-53aa-45ba-afc2-f03bf034e9c9", "comment": "Malware payload", "value": "0c509c2974990c34508e383bfd2c6164168ca7b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015915, "uuid": "e53f9867-473c-4863-a816-a33018cffe65", "comment": "Malware payload", "value": "d401fb982269576a65603b000fcae59cdd25bb9e2830ac0ca601896a53836159789dcdd709b85081c6275008b5009db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015915, "uuid": "0cd42824-e21f-48f0-92d4-b8761a728da6", "value": "T1E607338127C20D61F9CBF23A64D58B97D2F1B59417718A8F0BB44AA92E770F0DE36780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015915, "uuid": "41a5052e-3119-48ec-96de-028d20001f92", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015915, "uuid": "e87852d4-655e-42f7-b37c-5c20357e25f8", "value": "393216:CqTFn1yNdq1B7GRheXpiEHsn4qSio0piNgWw4:CqTR1yNg1wHaFgzSF0p+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015915, "uuid": "ce1df5e4-032a-4b0a-a8a4-8a4e10896ee3", "value": 17664406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015915, "uuid": "41a84804-44f2-4852-a18e-2216cca6b8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015915, "uuid": "90c8007e-702b-45fc-8865-51a33b4127fc", "value": "SUNMT1VEX0VZRQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbfee0d-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012742, "uuid": "88e044e9-fa60-46fe-820f-4c235caf2c02", "comment": "Malware payload (Rhadamanthys)", "value": "9b85467e26751b1755b9b88d1eb73a5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012742, "uuid": "389984a8-f7c7-45f1-a5a2-4254eefc99c9", "comment": "Malware payload (Rhadamanthys)", "value": "bb2a84f6bd1e8d59f0880377845a6ac3c13144892ab4d003d56f15c43d2a8ad7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012742, "uuid": "89c913f9-32f3-4da6-b373-d5f30e233b7d", "comment": "Malware payload (Rhadamanthys)", "value": "c1f80bef35c5510a18ad2ddc4facabe6461ffede", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012742, "uuid": "24fec276-aa1c-447e-ad53-c48cfd120cbe", "comment": "Malware payload (Rhadamanthys)", "value": "52f597bd923af3231050d6a8535e3b3ddc0a31841ad03b2451d630ec184f47a03e9b638d696de7d43a6f129bc579fbed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012742, "uuid": "fdf8d503-fa40-4100-af80-e8c30c79ec63", "value": "T1D893DA77DD1EAD703131B1781F55367AAC1ECD4AA481FAC5EE2AB1B0C1A8F19051BAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012742, "uuid": "63b9418f-77db-4e38-a028-3496bd00a9ab", "value": "768:GDhd0i7J4sYKgY/CMNfWdhpXcsd3dPrX8mru4ZdTVdZHWzdmd9dZABdEdjdrN8PQ:GDB7eKg20DrXru4f4KAiuP6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012742, "uuid": "50fd49aa-3769-4cff-9419-21e3a790d273", "value": 97455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012742, "uuid": "c34df0f7-f426-4c04-a4e6-fc0820fd9739", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012742, "uuid": "a1a6a951-2d3f-4d1c-ba63-c60dd6e31f14", "value": "invoice-1637482117.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ee2677-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012962, "uuid": "1189171d-915c-41a6-a153-258d467e64e3", "comment": "Malware payload (Rhadamanthys)", "value": "dff9495765520a133492a2624d347455", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012962, "uuid": "369c2e1a-8bc7-42eb-8d4c-f25b517ee951", "comment": "Malware payload (Rhadamanthys)", "value": "bbfa37dfea92cdf3016594010e710dfa9ce9942c04f100eb89e51d15c0f15ab9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012962, "uuid": "8011b848-19e3-4776-a25c-95f6bd7c171c", "comment": "Malware payload (Rhadamanthys)", "value": "23270ee3dfa0a5cf209c231c57765b5df8fa4f0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012962, "uuid": "f73e1eb5-e447-44e0-bc83-6dab92c75485", "comment": "Malware payload (Rhadamanthys)", "value": "dd7ff315dfddb97a4c8a13d1d7c6514f33854e3e8df6d7dd2dd52a6a735328d8cc8711528aafbd4efe7ffde2940666c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012962, "uuid": "eb60ecdc-8c7d-4739-ab1a-afdf2ac1e5a1", "value": "T197930880F8F28CAD35F423B29CE61DF9CA5E8913858504F6B60FFB1A405C5EA78695D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012962, "uuid": "3bb693d9-3879-4d59-81b1-06ef6e4ed801", "value": "768:GDhd0i7J4sYKgY/CMNfWdNlYqcwdnGuH5GxkO+Mz6t9mXOmSx59Xq7hj8f5xRN0i:GDB7eKg20ZrlrmuVIbJAaim6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012962, "uuid": "b5cd1604-5fdb-446f-9093-6d668f75b9f5", "value": 96130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012962, "uuid": "3cbfc7d3-780b-4d98-a580-6e1f936a4c88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012962, "uuid": "4205c261-fd9e-4150-889c-f081e948738a", "value": "invoice-1637482117.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733c42ed-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991997, "uuid": "118079aa-1143-4e3d-880d-347e892cbbb1", "comment": "Malware payload (Mirai)", "value": "f34e6a64d8e04ac4bb9c86ac813ed0fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991997, "uuid": "50121f11-e0fe-47e5-a527-5a969a6b4632", "comment": "Malware payload (Mirai)", "value": "bcb7f2280de34809fbd8d7bc25a26b30fc9387b5999cadb57341e9f1b2df45c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991997, "uuid": "52cadab3-73db-4921-8e1d-bea663dd3d6d", "comment": "Malware payload (Mirai)", "value": "57e4b2a4cdb032dcf07f8abbe83d17bbb358dd5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991997, "uuid": "5b45fee4-0e6c-47c5-83c6-41dc29ad4d74", "comment": "Malware payload (Mirai)", "value": "70750a2535a6e3b7e3ca85f2703c9d465eb5acd2dda8c4f4cf6a4a2f1a34e1fc80e6de08563df3b935dc319e19b064c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991997, "uuid": "72d2b7a4-32dd-4eee-8431-87f558ddf7d0", "value": "T12683C332A281D876D00314F200A2DF7B0D32FEB71564959AE3A53EB0ED365C259E5FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991997, "uuid": "21217cb2-a331-4ea4-bab4-0811499b5ab1", "value": "1536:iEJWqZ/S3UYe8hP4wEeOYr0DFFZzb1qCkZ9rpID7kz:iEJWv3UYZhgwWFx11kZAD7kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991997, "uuid": "028306ae-9018-4ec8-8531-e26fda372853", "value": 84868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991997, "uuid": "20a8ad58-46fc-4173-8de5-411f7d64fa06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991997, "uuid": "0330af02-7dd3-4be6-84bc-84728851d803", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc127a7-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029915, "uuid": "82494008-b5f7-44dd-8a34-b841a5774cca", "comment": "Malware payload (GCleaner)", "value": "9344df4c4257cd51061555e603023740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029915, "uuid": "6bcfe67a-f674-4191-b6b1-bf6f2958fce6", "comment": "Malware payload (GCleaner)", "value": "bcf861959397a661a780bc7e78cacab7e820405eb9e9afe11b685b91b08a0c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029915, "uuid": "5bfe4847-315b-4dd9-a65e-8931a636a915", "comment": "Malware payload (GCleaner)", "value": "6eb664f1fb280319ba219d4166558870d8324fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029915, "uuid": "adcdba9f-873c-4c80-a5d5-4b3ab2e58785", "comment": "Malware payload (GCleaner)", "value": "e30e42c63e2ebd757204331c2c5dcf6b566378e5396d6326ba2684263011697ab0b71c0578e45600ce6c6ecf889307d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029915, "uuid": "9f120682-1487-4df2-95e9-4e31f0a769ea", "value": "T1FD459E23B292443BC1721638FCAB17945C29BE912E3B984B3FEDDDCC5E252417D252A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029915, "uuid": "813e0cc1-9808-4ac0-aaed-8dbba7029e55", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029915, "uuid": "fb3466e6-92b9-4b9e-abaa-849c1eb7b624", "value": "12288:fVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRLi9nM2DthdsMVTh0JL:fVwXV4HSmYq7MPPfEd+epgoe2DXSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029915, "uuid": "6238e2a7-83aa-4f0d-847a-9f617ece7fff", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029915, "uuid": "b79fdb03-daf0-490c-a3a9-61103dcc5b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029915, "uuid": "f7330655-239a-4eb4-acb7-2b1c96050c9c", "value": "9344df4c4257cd51061555e603023740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9554cb-11f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771986270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771986270, "uuid": "c7fede3c-1620-457c-a89a-5d8a5772f6ff", "comment": "Malware payload", "value": "ba4d018e0967b969faf9a0a64a46730b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771986270, "uuid": "4646f308-a22c-46a8-ac14-7250537b78d5", "comment": "Malware payload", "value": "bda644dbdd47073db87e3404258f5df1750885f5c9e1893a29dc0778e20456c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771986270, "uuid": "99586baa-429f-4fe5-9c80-be4cac70e2ad", "comment": "Malware payload", "value": "a838e25fb1f90fe45442fe5c4b634a79c642026e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771986270, "uuid": "cf86e86e-24de-49a1-b223-9e7c5f2c9b64", "comment": "Malware payload", "value": "f7e1fa81bc73d8f87e8ce0e0d4b55d4f8e585c277cac07b6264d11e3e0cfe084d3e18a24876fc29a70e7d705c3e5e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771986270, "uuid": "ca28e8ef-b86c-453c-b8ee-b17dc0f61f7b", "value": "T13EC62315D3E401A5D97BDB38C9258733CAB178625770D58F0259E28A2F33AD29F7B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771986270, "uuid": "f9be9e53-a633-4836-bd38-6ba75a5ccc01", "value": "593665e716878f07e434ffab188abbe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771986270, "uuid": "7a0bdd01-7bec-4518-a048-8dfbb79fe3cd", "value": "196608:f0KcjxIv8c5xl2K4P30ViQX/kUx6IZ0fJLzKTMtHzzeTn7ldhlj/gJCf6:8HxIv35xUB3Js/MkTMtTivXhyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771986270, "uuid": "06b0300b-5209-4753-94df-20d45ea5b3ac", "value": 11872676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771986270, "uuid": "c4257b26-d38a-4dba-b05f-c14d25a6c029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771986270, "uuid": "888cde2e-cc77-42d8-9d29-a545f34f6bf2", "value": "SecuriteInfo.com.Variant.Lazy.589245.23207.32041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b77cc0-123d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772018905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018905, "uuid": "c62328ee-6be0-482e-9ba0-b96b68968133", "comment": "Malware payload (NetSupport)", "value": "4319c8385f7f9181d9f8989a0e182800", "object_relation": "md5", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018905, "uuid": "0943e0ab-c0a2-4c0b-9874-2ff3476e9b0b", "comment": "Malware payload (NetSupport)", "value": "bdf9f680afda4aceaf89e106136f14472adc17d7264648f82880d4a247cd5b5b", "object_relation": "sha256", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018905, "uuid": "6ae829ca-4d2a-4972-98d8-b31e0fa9bc4d", "comment": "Malware payload (NetSupport)", "value": "c8843ef37f03833ef6c79fb4a1a1d627c44f506d", "object_relation": "sha1", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772018905, "uuid": "d5bfdffe-b176-4bd2-91da-ef47e4d0c1b3", "comment": "Malware payload (NetSupport)", "value": "caac524705098b4d13bcbbed77429179b3bcaccfcd89482d8b5ad2e8cc0e175c94ecb625cf462ba21884d0a58a9b292b", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-18-8", "colour": "#88B691", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "efsllc-org", "colour": "#4A0E22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetSupportManager", "colour": "#403BD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018905, "uuid": "b31506a1-dd80-45eb-a1de-9253b6f2f674", "value": "T103D633A0A6E811FBF9EA933DC85199A2C89A35763B49C183C3F8D1E12D737C4593E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018905, "uuid": "92382eb8-aa1d-4d12-8d58-8cf14f703f74", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018905, "uuid": "f3202827-abb0-4f70-a8aa-f2a7e874a416", "value": "196608:v14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorijdTrmLurH/P/XRLSq2KKeF:v14FSsFl7dCR1C99/LkuhjdTqLuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772018905, "uuid": "e635497d-2df5-4601-94a7-3a3cb0ff7dff", "value": 13415451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772018905, "uuid": "ea58cdc1-5ef6-4213-80e8-2c0103ace6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772018905, "uuid": "e906ca9c-36a7-4dbf-8459-20b7b14c03c0", "value": "Net_view.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1fcdfc-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017411, "uuid": "cf0ec73a-c050-42c3-b347-48dddc3594fd", "comment": "Malware payload (Mirai)", "value": "8a36ab0e48f4ce2d3d303a8f5b063fe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017411, "uuid": "09351346-2830-4dc9-9354-1ce0fd4bf1fa", "comment": "Malware payload (Mirai)", "value": "be4e5905ac734250ef02d18c3cad7c537ae7f6c2b4a35a77da99c1e2eb74abb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017411, "uuid": "1529d07d-13f7-4b6a-b1ab-fe3ba2954465", "comment": "Malware payload (Mirai)", "value": "ec18401feac282545e89f6ffbcfec1d0f866005c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017411, "uuid": "53e9b527-1eb7-4d7b-9a0d-d3045c20bfd0", "comment": "Malware payload (Mirai)", "value": "dac8d3198e0fcf0a2fd3d878a65ba400afaf6bd2b6c41c27eb08a4faeb3ed1c310e6ae08d9d06b86e8d1404064d2b114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017411, "uuid": "b59bfe6c-58e1-4a14-8d13-d4013264b2b2", "value": "T153B2D0CD649430C4CA8D7C7C178D4B664F6CA190BAED9B26E354CD9873BEA4B386D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017411, "uuid": "3a16c4ff-db46-410e-a086-a951d1714610", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpQZqSWvX:4QlS07FUXqIYSXQKquIqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017411, "uuid": "11aa3977-4c5b-456f-9bc0-1c26e671e940", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017411, "uuid": "42480b6f-51b3-45f3-8404-e407f55ddf06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017411, "uuid": "973208bd-386d-489a-a28f-7258923ffdb2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34bcfd2-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035591, "uuid": "8b4e886a-cefe-4e99-b633-e18068a6ad13", "comment": "Malware payload (Mirai)", "value": "33cfc14250e11eca98d506447f173f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035591, "uuid": "c3e8a68a-d4fc-4bde-869d-c3136e0d4663", "comment": "Malware payload (Mirai)", "value": "bf5f070536080f3e403d4beaaccb2115a32b10514a0953c6f29d97a0bc221e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035591, "uuid": "2d6ea709-0516-46ab-9edb-7810281fd682", "comment": "Malware payload (Mirai)", "value": "76bed9fb1909c24445aa0a4236a5f041e3b43341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035591, "uuid": "a419cb9c-c924-4be6-9718-58545790698c", "comment": "Malware payload (Mirai)", "value": "b998b0f846094e05687a25851ba0517d746684e7c6149452c9cea5d679852eab644337bb97b224cb55fbc87947ed030b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035591, "uuid": "2e16f50d-0485-4e5e-93e3-daff46191fdc", "value": "T19FA53382027ED10CD8DB8FAC4E96C58F687D2DB4BADB3645006CDB1EED854E81B45F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035591, "uuid": "6c3f2114-2890-4c79-b89b-a96b0249325e", "value": "49152:uqepZuOz5prUMQBBty6zNTOLBIfGhy0Bt4alDPi3X3X3SE:TervzrUMQjTB4BIehy0flri3XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035591, "uuid": "8c6cfea1-81be-4cc1-9170-e9ec1e2ce4f6", "value": 2096256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035591, "uuid": "cc153642-cc2e-4869-ad9d-4718951ad0bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035591, "uuid": "bfddc0fc-7437-4b40-b157-ff4b8b621d21", "value": "MIPSLE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9669c0-12a3-11f1-a769-42010a9c0008", "comment": "Malware payload (GoProxy)", "timestamp": 1772062825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772062825, "uuid": "4d6e21c7-ee28-4805-aad7-3ec9c0a56f52", "comment": "Malware payload (GoProxy)", "value": "15c0870846bc6b74a4aabf06d6682538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772062825, "uuid": "0c3dbcf5-a151-46fa-8a83-18d9557ccdd1", "comment": "Malware payload (GoProxy)", "value": "c26ef8b39b3a3beb5c6de2be743a6af799d59a1a1fc85021aacb70117dde7907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772062825, "uuid": "bfb5868d-0bf4-4a81-96aa-f0e6df70075b", "comment": "Malware payload (GoProxy)", "value": "aa9f7d0ad1760d8701b712822b19d7818851c8da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772062825, "uuid": "21282968-1715-4210-a1be-fa1b7a3b8a4e", "comment": "Malware payload (GoProxy)", "value": "141c0e43c57359adcf09a6bb29bd9fedd191e157d319e40488fd083e67e239c36340ac91d4a3e3ff2abf6dd6c108b9ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772062825, "uuid": "e3d8027d-3408-489b-9807-00a6099a9cfd", "value": "T165664B03ED9155F9C0AEE2318A66D362BA71BC491B3123D32B90F7292F76BD06E75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772062825, "uuid": "59be31f1-d849-4fca-9aa4-f484ec7d973b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772062825, "uuid": "5513961a-bb68-409e-b80a-7de9c0240704", "value": "49152:xm2mmsV/yF987YWT3dNsSMEyC/aICrsB/D6cjMqImci2HTG1XmLMlLAgMaGj0HLA:xJY5iWXzB76cwqdKOLzHb2SkME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772062825, "uuid": "7a0b0bd2-e772-4102-b6cd-4982d38927ee", "value": 6663168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772062825, "uuid": "4ae12936-88f6-4909-ae46-ac794ad77123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772062825, "uuid": "65d7236e-b6f4-4dba-8a34-50dcf735e78d", "value": "15c0870846bc6b74a4aabf06d6682538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63620151-1286-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772050382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050382, "uuid": "94248905-91ea-41b6-9918-53894cf3c63a", "comment": "Malware payload (Smoke Loader)", "value": "61a373ff44ce5f7c51587b6877c10399", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050382, "uuid": "367b29ac-6ad2-402c-8a00-7c76e07c6f04", "comment": "Malware payload (Smoke Loader)", "value": "c371928e3bfb54be11b073c953583498544aed7bf5e042cee6711825ae1a5967", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050382, "uuid": "671458af-3cc6-4403-92d1-576c850bf047", "comment": "Malware payload (Smoke Loader)", "value": "1acb649e7a847fdbf911197e6454c9e7146d978c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050382, "uuid": "b6d5bc41-a287-4205-9507-c56c0830d2c9", "comment": "Malware payload (Smoke Loader)", "value": "f126c9d399423ea1daa4180c6fd4e765755a0503319a5ab92636e2da2b071ab07762e015092ec998665eff0397230034", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050382, "uuid": "5163f012-1380-4419-b857-a4d252e64554", "value": "T1A055CF235ADA76D2F1AA63718DB197026B74FCF0DE50864F76D8323B8D305061F2A71A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050382, "uuid": "779134a7-4d2b-453c-a05b-6f9f47569b5a", "value": "24576:0nSw8ARJrDzDjKJoYVRDsC7/QSJlcOXbvoz+383:0nC0HrKJoYbsC75/cOjB83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772050382, "uuid": "3ad62739-ecc3-407e-841a-11b5fa6ceb6f", "value": 1348024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772050382, "uuid": "0d050a51-0970-4a93-8295-719c3a3385ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050382, "uuid": "5a142905-2861-4689-8770-25e711018618", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b461fd1a-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034627, "uuid": "3940afa0-a0e0-409d-aa45-2cef5ab7954f", "comment": "Malware payload (Mirai)", "value": "fec62e2124873a3caa15e24506e54171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034627, "uuid": "f833a244-399d-4448-81ef-a2e015136026", "comment": "Malware payload (Mirai)", "value": "c39c15d74ff5b95a2bd1a257a131a0afe37d432f37564f9df07ec88cf21f04d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034627, "uuid": "396c62f4-0008-47af-ba15-2ecadd03ef68", "comment": "Malware payload (Mirai)", "value": "07f1af091c679ff8afdcdf6081ac19178327a45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034627, "uuid": "654a642e-e1f6-4063-8b24-e0c8fa1eb9b2", "comment": "Malware payload (Mirai)", "value": "c8f01a651c796b2034e9c5ebc8c00059b1abd7723b6b11c22093a5fa7527ab1739e06b92f3d7943af3c343c5ecab5c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034627, "uuid": "786c6f29-75ae-4b0e-9b38-648e133544fb", "value": "T190D32A56E7408B13C0D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034627, "uuid": "d01f54c4-d669-4428-a307-5d454da48a73", "value": "3072:tS6VGvn5uacAFEsHYoPNqE4wxGnzR+SQkM/9CH:tS6VcuacAFEs4SNlgnzR+SDM/9CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034627, "uuid": "742ef897-e93f-4ee4-848b-fc3f8263c9fe", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034627, "uuid": "f6ce141d-b4ce-4103-879d-50eaf8e7a7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034627, "uuid": "a67151d1-4512-4703-adbf-1722a79d17b2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cebbb0-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017375, "uuid": "19a5a065-ecc0-41f1-9a88-3cda406e4306", "comment": "Malware payload (Mirai)", "value": "9292c9309f308ba809711e5ccc3a07f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017375, "uuid": "a558a942-9935-4443-ae94-a3ad13dcc009", "comment": "Malware payload (Mirai)", "value": "c3bf3b0be0e8a68eef4365fcae96aeef658b18e32fe52c86701e13ae464ecd70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017375, "uuid": "7917ff79-e6cd-4daf-a591-2343897a1ab3", "comment": "Malware payload (Mirai)", "value": "8c8eb1e8a583c4507ac5e2921517bd26ff4ad36d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017375, "uuid": "8c1b88e6-7a36-40bd-b8e5-2535322c3cfd", "comment": "Malware payload (Mirai)", "value": "b14a7e578edb1e88c05e3dd457c50afe99e08f23bae87c4d92eb6753f224b8c79ea8c9b76990632dba77704033c83503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017375, "uuid": "a6c4536b-465f-49e2-8e83-3705e415e597", "value": "T1A5A2D01172A32D65F3ED2C3DC96E8357F9671BFC80F6327569415A20C94924A3E38A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017375, "uuid": "326dea65-9d62-4a2f-94b4-099e05d47d10", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjGHN4hymdGUop5hl:UvQn4j+ZO5fKAlxyOs3UozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017375, "uuid": "e7ab2184-e5ec-4177-974d-71ba53041758", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017375, "uuid": "32b6372a-714d-4937-bfc2-aa0e67eb418c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017375, "uuid": "a4cc7dbf-7e32-41de-9378-86288387994b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1f01ac-127f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772047555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047555, "uuid": "f35aea62-402a-4296-8477-387a368933c6", "comment": "Malware payload (Mirai)", "value": "8076e5367e53a39c5b29585367850e4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047555, "uuid": "01f47c90-9d8a-4b2d-9d51-4669fe7af666", "comment": "Malware payload (Mirai)", "value": "c3ef7574153f0c3bf9dd4d75f4526b2f1600e7163c312eebc31090b2546dafcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047555, "uuid": "fc2f2911-cddb-481d-9d04-3a16dccab7a6", "comment": "Malware payload (Mirai)", "value": "e26b941109c9c9f5cfc3a6a4b654e8086d4f658f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772047555, "uuid": "86991c9a-f25d-4dd0-b751-c4319237080e", "comment": "Malware payload (Mirai)", "value": "b046f103a15804c39d521e4d19ed44f0dc0d0ecf7469c8676f1472f9ded9e786e75959fc4f0f338049c0e164543de050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047555, "uuid": "be243fb0-bf5c-419b-9611-e426a5a2f1e4", "value": "T1C7436BC4F643D8F5EC8705702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047555, "uuid": "17d20502-16a3-44ef-9d79-6101fff39b10", "value": "1536:JeESt/basV2rcZhG6ySN7naLlSR9zWOIaEjrqMZs:JeESt/basVTgS7naLQRVtXESi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772047555, "uuid": "a6ea27c9-c161-4c05-b0dc-3f12d3842248", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772047555, "uuid": "4aed5f3f-7a77-41c2-8923-dafdc50d76cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772047555, "uuid": "c4d70543-d5c7-4b12-9579-90ba2acafd19", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1765059-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017549, "uuid": "11228488-ae08-402c-bc44-dfac5dfd5e03", "comment": "Malware payload (Mirai)", "value": "142a5e66a00d3997d3b740cfeb6d179a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017549, "uuid": "8cdd869a-aefb-4445-8ee1-ce1bfd989688", "comment": "Malware payload (Mirai)", "value": "c4e35365043b113f496fb70d67e447e4b0bc49fe1e1a720dc42de94131eed0e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017549, "uuid": "ff42aa88-8db9-498e-b46b-0bb8a5176210", "comment": "Malware payload (Mirai)", "value": "ceb15a0ba3f562eb140c4729b023e09a35b49c8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017549, "uuid": "fdd1a3e9-035a-481a-bda2-6504fc1670df", "comment": "Malware payload (Mirai)", "value": "6711daafcb917d96b651395dcfe9578571d0b0bcb8479df1a0262b360a80846193d97c04436d654bc4678c8e56320a42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017549, "uuid": "0bf1a5a6-18a0-40a1-adb4-4de6d1783042", "value": "T18E2308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017549, "uuid": "14eaf555-1f67-4e7d-9818-c05d75856912", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2iCe:Gv4QPfZfW5XTOeoEzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017549, "uuid": "1acb7f37-700c-4144-a944-71da3d40bc08", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017549, "uuid": "369be882-b3d5-402e-81a4-097a36eb2554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017549, "uuid": "869939f0-dbe3-4620-b4e7-12f971bb81f9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0be8f3-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012953, "uuid": "0e282bab-3ffe-481d-8fe7-cf7526f081b6", "comment": "Malware payload (Rhadamanthys)", "value": "d3db0e193f13861c17dabbbd4e463087", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012953, "uuid": "2f7e4e4e-5491-428a-81b9-67aeb8c52a53", "comment": "Malware payload (Rhadamanthys)", "value": "c557309e6f01ec2f40090c2e1f8aa3769c385096a0597eafe8128329e842da0d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012953, "uuid": "8ff9fb0d-49fd-4578-be5c-cd825a7eec3c", "comment": "Malware payload (Rhadamanthys)", "value": "f2ac1067e653f0082389e89ad39e55a8e9350ee2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012953, "uuid": "ff719aea-5c1a-46d1-ba31-e8f9c855a9ed", "comment": "Malware payload (Rhadamanthys)", "value": "acea56a048c9775724576a04f4f7ebc145e82c79c1b4b90abd885d85161bd1ce898a74ca8d8ab183121b030c28a0c7f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012953, "uuid": "2b92c912-2077-478a-847f-439b2e63485e", "value": "T1F3A31A81DE7F8F6B8089A07117852BB78C82C5358129442ED7EFFA5684DD3C77283AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012953, "uuid": "04a2aa96-48fd-4362-a483-93d15cd82ab1", "value": "768:GDhd0i7J4sYKgY/CMNfWd+zVyTtWtw98qQ4jSmGCkAqZH8Q6HD+rxc+xVzD8KBrp:GDB7eKg20qrrr6A1M7Akwy6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012953, "uuid": "7f05fd96-a168-48db-8c4a-31827e2d35e9", "value": 100141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012953, "uuid": "4d2216f9-5f11-43e0-aba1-5967585c04ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012953, "uuid": "87b89420-0900-40c6-ae3f-bfa9a3109c34", "value": "invoice-1637482117.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c9dcf7-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012802, "uuid": "07a723b1-c1e1-4f0e-8b3c-a6ab7c5c12a6", "comment": "Malware payload (Rhadamanthys)", "value": "1d973d759eda05aa24138ba40b9347ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012802, "uuid": "683b13b4-3e6a-4c69-8239-a9071cc854b9", "comment": "Malware payload (Rhadamanthys)", "value": "c5e27c06e2ae01842334b19b868b1ada7a813cf3598c6aab7a9e2399c1670370", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012802, "uuid": "2b3bb786-c9de-43b3-b98f-1e2b3b777e19", "comment": "Malware payload (Rhadamanthys)", "value": "da715f0e4ccca066bf373636aefa1dc0e5941f7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012802, "uuid": "abb90e9f-ff59-48f5-befb-12cd99a901f2", "comment": "Malware payload (Rhadamanthys)", "value": "b69035d7d66fbeda8f38a4499a3c9b77ffcada140ee2bc4ed65d3382aaa541f93efb0fdc216d853ab8ef58f0a2c2506e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012802, "uuid": "848eed48-7ec4-4276-a4f6-e57bba486dcd", "value": "T104A3FA4255E2EF5138623BE6AEED00604F98B3899DD192E5E11BF3E07BCD61E0DC9187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012802, "uuid": "cf0c5d14-4f91-4254-a71e-866ae1b6d14c", "value": "1536:GDB7eKg20MvR7vUWY/xXjZ39vb+doEpwXkwXz7O68r9aFrikxGUrjMtDj1X7PbKl:GDB7b097uPQwmy6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012802, "uuid": "40a06463-587c-418b-835e-2d97542f2629", "value": 101425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012802, "uuid": "6d0bc41d-1b05-46df-a4f4-086923655c40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012802, "uuid": "2e04a001-ff25-4134-a3cf-c6cdbb980c0a", "value": "invoice-1637482117.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f5b2ab-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771992061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992061, "uuid": "ebc4d5bf-4d85-41e0-b988-69448da9e3fc", "comment": "Malware payload (Formbook)", "value": "f3d96580d8faeb81a46a5fe61d0d8dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992061, "uuid": "1f8052b4-da17-4418-86fb-54e6517a4c25", "comment": "Malware payload (Formbook)", "value": "c66b86db070b2d193322fe933f9a6b0916cf178bf5cc0700aa8c929054de32be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992061, "uuid": "e2d4e948-fae3-4c46-a912-2692bfc8fcac", "comment": "Malware payload (Formbook)", "value": "aa9467823ff86d2536dc8b1083168e4835a0fe39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771992061, "uuid": "4651635d-d10f-45d7-a74d-688f3c760c56", "comment": "Malware payload (Formbook)", "value": "1e82aa6c86cb79004535bbee158b8741e16dfe70901d237398de2f9a2387dd29948ae7cf66e27aa64f5fc98af7c6baa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992061, "uuid": "73060254-2414-4e32-82ca-8cdf697f1ed1", "value": "T19F45BF027391C062FFAB92734F5AF6215BBC79260123A61F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992061, "uuid": "9b82351f-97e3-41c5-9bae-1e4ddce9350d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992061, "uuid": "3516f712-4be8-4324-b982-f809c71a9369", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1ijXdaC+QLa0Q2chGhn/:zPVt/LZeJbInQRaC4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771992061, "uuid": "f0c3d6a4-039e-4de1-9b4e-435c12698f36", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771992061, "uuid": "376760bb-2066-4f1c-861e-9eab33b3e48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771992061, "uuid": "00482169-7ea4-4b86-90eb-a912e5283e0a", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b09f78-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035938, "uuid": "e7f514a9-e459-4823-8bb6-455753588082", "comment": "Malware payload", "value": "d56245b7e2d29b838c3e7b1b01f6dd6f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035938, "uuid": "7740cbc7-7b64-4a9a-a4c1-9426c66ec298", "comment": "Malware payload", "value": "c748389a07625c77bcdc5bb0c2ce20807dff925f93df8e924ac3f51ad79ae03c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035938, "uuid": "2eb87be8-507a-4875-a80d-0ae47141124f", "comment": "Malware payload", "value": "fde4fc3339365819659e8e13dece2cb3848d6394", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035938, "uuid": "335cd7dd-5111-4099-9e88-736f5e6e5524", "comment": "Malware payload", "value": "9c3d3f461dd1d5d5f1cce7acbb08ebadaba9a95f16842900e4a143b2dc9ebe8824f09a2f6b0401684a41e3dd867acf26", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035938, "uuid": "396949a5-3607-4dfe-9b89-b8f524647b4c", "value": "T1CDF14134EC289E4D03FC6365480568D5F228035EA3B41AE0FB46AA7436E51F5F73BA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035938, "uuid": "5b35a1cc-7d70-4619-81ce-91ffb02e214d", "value": "192:a4aqAlZNLw0QsRqVGn8CbDZqcD3xPFLcpzZDcG1mlZY95Lm7:olZNM0QsRqVcVDgcD3xPFLcpzFcUmlZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035938, "uuid": "ad7145cc-4e9d-4618-bb73-40423bf6fbf5", "value": 7700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035938, "uuid": "15fc6898-f6e7-45c1-a8b9-6aa5fe8c1a48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035938, "uuid": "127098ff-99ee-4b63-b0aa-d15292b0a653", "value": "conf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8908e3-1281-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772048383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048383, "uuid": "28f5110b-3e0f-4b6e-82dc-90192332eb30", "comment": "Malware payload", "value": "2f575c13c7ca44089f5e7e76e082209f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048383, "uuid": "c095f6a3-1164-4ad5-80be-49ce036005de", "comment": "Malware payload", "value": "c74f52ba13a42d10747bdea46ff19982613d026ff238bc51c0c5833842d764dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048383, "uuid": "eaae0012-f6fb-45b8-89c5-b4fe40b682a7", "comment": "Malware payload", "value": "f5f5883afb067ab50d819c07e14a8aee93eaefdf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772048383, "uuid": "527fbfd1-bcb9-4d0f-88a9-5ab20e8b1f36", "comment": "Malware payload", "value": "46e5dd20f4c9a64ad733caa609fb5e181fd402d21bf8dbf46afd0d858b37a173330b84bd791aa76552776b0b080806c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048383, "uuid": "ca009091-a6cd-4db5-b862-4fb84cb7915f", "value": "T100925BB906496C79BBC0CE799F3C7F0CADE582C42128E39DBA1F39705A2065DC60935D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048383, "uuid": "ff1814f0-f1b1-4ac1-9751-586e82c9a10a", "value": "384:IMzncuxOLnVYMSmzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:IMQuQL+mzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772048383, "uuid": "ff47fb9b-5439-439a-b463-161cd0da3764", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772048383, "uuid": "383a93a1-449a-4ef6-b373-d2347b17fb8f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772048383, "uuid": "9b17d8cf-ecf5-4bf3-bfd7-1fa781dedfce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a2933-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772036003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036003, "uuid": "16e74fe7-9012-43eb-9d8e-8575ed535647", "comment": "Malware payload (Mirai)", "value": "6c67a4fb84c9c16fc1af177578273994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036003, "uuid": "3e00ef6b-48ff-4034-be50-ec23f38bb32e", "comment": "Malware payload (Mirai)", "value": "c77b6993b55251d34ac648e12fe1b39542f974633d7883c7372efcb8c3ab4c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036003, "uuid": "04f9fd32-63d7-4dee-b9d2-64eaf4ad97cd", "comment": "Malware payload (Mirai)", "value": "8e4cb94c050471a8ea6e39336784914e85c7f2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772036003, "uuid": "759f0134-31c0-411e-ac78-282eebcebe05", "comment": "Malware payload (Mirai)", "value": "d4556fc45c2555020a337f533db47421fbc673fd654b77ed82ecc75f96945014f959d31f792e797956675ded7036c95f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036003, "uuid": "ba7fe301-5f12-4a9c-acb7-f093b2a765b5", "value": "T11E861897B9C24942C5E43A37B8BE80C433631EBA8B8752566D05FE3C3ABE5D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036003, "uuid": "5469f42c-c805-435d-9d6d-08b76f0f8391", "value": "49152:2LRUlp2dVtdRCRyB0bhutDNqfYga+0T+QF+HX2OMyWG5EN:2dkRyB0QvUX2OM2EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772036003, "uuid": "d9b29045-c64b-4fd8-bb10-a29b8894db1b", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772036003, "uuid": "24335a50-88b6-4350-a677-0d1d5e67447d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772036003, "uuid": "a2515d63-6002-4c4a-a026-877f39c8f79d", "value": "ARM5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fb0df2-122f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772013051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013051, "uuid": "1225424a-b96a-49ca-b086-49955736a1a0", "comment": "Malware payload", "value": "840fdaab95f22480c72be410b7d5de40", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013051, "uuid": "b1b0fea6-29ec-42b5-bd82-7ada8de7f889", "comment": "Malware payload", "value": "c8652921200e91a464f1fe99ae644330c55071f99dd73efba0dccbda0cfeef9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013051, "uuid": "1892072d-e60e-4975-9d6a-f816a10bc19d", "comment": "Malware payload", "value": "3bdcb8ef941c0d1c2f6e956eade31a057e6419e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013051, "uuid": "3b2a42e3-85d7-4e9c-abdc-6de4c44ad581", "comment": "Malware payload", "value": "50ee96698babe8d3c5842256cc1b01ec6fa8dd9458f50ffab19ad971e6738e8a8d233566e50531591d99ab67275f9929", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013051, "uuid": "16a6a116-6498-434f-832f-3e474dd0b88a", "value": "T19AA32BE3AB21A425A0B36291BF48633E5962C79E05AE4160D4DB7731F41EE383C45FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013051, "uuid": "0cb3bab1-7bbd-405c-bf46-550adc8de099", "value": "1536:GDB7eKg20zhTfrrrGZW6y4sdkjA+3ac516BkQWJ+aY:GDB7b0FTTX2Wv4sdkR3ac516BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013051, "uuid": "db5a765a-a54f-4c3e-bd79-4a5b33649420", "value": 100060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013051, "uuid": "0011ec84-2414-41e4-8666-647ccc0d2899", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013051, "uuid": "9c996fe3-4b43-4678-a8d3-46426eedf99e", "value": "invoice-1637482117.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d63fac-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035867, "uuid": "f45e48d0-7bda-48eb-a00a-58f2ef52ce7f", "comment": "Malware payload", "value": "74819f9f99b402ca5d98646460497af2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035867, "uuid": "a6852b44-2019-450d-a251-bf501bd65839", "comment": "Malware payload", "value": "c8e508abb8ffaa12b56722aa4d35c0c0be21454c3c42ce278d6ed9b92893913e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035867, "uuid": "e51ea1fb-9d5b-4f67-b45e-138693764282", "comment": "Malware payload", "value": "ce57f898a5fa1c3a3e5a02887763b7af899b1114", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035867, "uuid": "da8e9675-c536-4812-b02a-bc901175203a", "comment": "Malware payload", "value": "c50f2743faeaa1b50eb2afa66fcda6d1646696b4b791572382e60d9d88da70d785b263a4be46bd8d57244a9b04711aab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035867, "uuid": "782c8312-187c-4acb-820a-107b711f3908", "value": "T18721A7806CC009C3C98DFDB9D19952A76DD9276341246F2790B076468FD65CC14F23CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035867, "uuid": "8744acde-cf8c-4e2f-8d6b-c909f534fb6a", "value": "24:9p4y5rBk8T/zLmVfxlkyctipn2Smu562AHvvwCxotEl+XGSIpQUyS/:9jWfxat62Smu562+5eg+XGtpx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035867, "uuid": "521f437b-49eb-48a0-aa36-45ca5f4a3151", "value": 1224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035867, "uuid": "7b1793b7-fd85-4a98-b446-0e964c43218e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035867, "uuid": "d338885e-da95-42bd-b5b3-9bf67d42a27a", "value": "T4FORM_1771968540050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87ec8ba-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012729, "uuid": "d0b40851-9965-4e29-9449-fc642066fcf3", "comment": "Malware payload (Rhadamanthys)", "value": "04e01ecc34881e01537db14e5fc6ae3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012729, "uuid": "56c03a1f-8a50-461b-aa8e-05dd5441dd94", "comment": "Malware payload (Rhadamanthys)", "value": "c8f837877818122997b5e5ab58745f410d8f0c9525c3859b0c6d9d9044e59253", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012729, "uuid": "87b003eb-0718-40e9-9e50-1429ee616224", "comment": "Malware payload (Rhadamanthys)", "value": "8fc014612198de1670f68ab7231a6c79ff6718fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012729, "uuid": "3ac6b321-c816-45a8-b525-ac018e4f4bae", "comment": "Malware payload (Rhadamanthys)", "value": "de00b83ee1731fcfb3e93e6e0b8ad89795e5caed5d92ce6c3bb93fcd73cf95b838a8cac2ffc04f90b1f9fbcde8056fff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012729, "uuid": "11421885-4323-4de1-9b2b-85a8fda8522c", "value": "T1B8A30AEFFC123EE812D297BB6A4400AFE60D04390D5AC744DA64BB7E47B76C73916942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012729, "uuid": "8192085d-3eca-4390-a624-95408d11a614", "value": "3072:GDB7b0lvakyDLbouqxpqDf1mDsxoKmXGrmGqJg8q7ZzpavK8aAklGk7yyng1/qlB:0c2lIAvWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012729, "uuid": "32091af3-cdb6-49fd-8652-83a022783578", "value": 100863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012729, "uuid": "1cc92089-eae3-47c0-8add-43275c0855e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012729, "uuid": "e7f1c0d3-402f-454d-9d10-a187ba7087d2", "value": "invoice-1637482117.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c0fc3-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051577, "uuid": "73f7fb23-57a8-4950-a68f-f60097eb38d6", "comment": "Malware payload (Kaiji)", "value": "d0b98a656c72242baaff6ea51452cd04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051577, "uuid": "2a7ffce4-9fbf-4392-8f0e-0b054b1f3edf", "comment": "Malware payload (Kaiji)", "value": "c8fd4e4af3f4dd29bc956904d7f489da64664689120ccd639522dfb87f4de85b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051577, "uuid": "d1386cbe-abdd-4fa0-b09d-63b5ed45ff3e", "comment": "Malware payload (Kaiji)", "value": "3cd5f4374147ef793dbf87ad2c51ddfe1b9aa7a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051577, "uuid": "94a0b144-1182-47d2-aa7e-7f7171751c6c", "comment": "Malware payload (Kaiji)", "value": "98772c80b0e49de3fc67860ae6dd467b9d1b84cba93a7586b97dddb21d8be8ea2ccc55a1a36f566e65922ad1fc29be76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051577, "uuid": "298f32a8-1f7c-42bb-829c-22d2154058c7", "value": "T1DBB5D615BCC42BEAC02C5F7898E6896623A45D044FF2573625A4FBE9B8762347F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051577, "uuid": "88caa39f-a025-4bff-9a4b-bed1d557d62b", "value": "24576:kO+PuaNFZRml7/I1n0mOakVXFYd+lCQYWz1v:9eNpxd+lCWz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051577, "uuid": "f0720f9d-5c06-4ac4-8cb0-ebb195f97e0e", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051577, "uuid": "903e5156-0287-412b-8ee1-bdffae59be6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051577, "uuid": "6171ab1f-5179-4c10-897a-2b3601a42f4c", "value": "el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7a5522-120a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771997056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997056, "uuid": "e4e5155d-bf5b-474d-800e-acb25df4d55b", "comment": "Malware payload", "value": "f5ef5f40922113c2dfb32c202ae2b3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997056, "uuid": "8455e484-9dd9-427e-8d8e-b4f643bd5086", "comment": "Malware payload", "value": "c91413ad7c94c0e2694862b9d671d1204873bf65576ba2cb91fbd562a4ccf79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997056, "uuid": "42e14046-2b56-40ba-a3b7-809771cd89d1", "comment": "Malware payload", "value": "b55e063607e8f56c9b398b289ba04ddca11398fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771997056, "uuid": "ea4dac73-4a6a-414c-af45-5dba936d3442", "comment": "Malware payload", "value": "170cc468f09fdb29fbe29f5fc7b395bb525af5c8bdfbcdc424fc077863015990d53541c6975930870a41c4b1bf7e54d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997056, "uuid": "41828a08-0497-48b8-a2b3-41a171a2969d", "value": "T159348D05A3A50DF9F873817AC8968943E6737C014BA09BDB07B04A75DF635E09E3DB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997056, "uuid": "829c4867-7885-41a2-9c6e-6b38afaeab16", "value": "d831dc128ddb4df676d022367ba3b5e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997056, "uuid": "000b3348-bb09-47c0-85e7-05bd4ff144d5", "value": "6144:GLMI+Db2B7y5tkqsrElNFec0iliy4ccccccccvHx/u:Goe7yVTHMcnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771997056, "uuid": "e45cb636-ce90-49f1-b211-ad008968406e", "value": 234683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771997056, "uuid": "b77a5273-8577-4908-b232-c0eead69b30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771997056, "uuid": "d263f76f-b6a8-420a-a7eb-3802f6c46cc8", "value": "c91413ad7c94c0e2694862b9d671d1204873bf65576ba2cb91fbd562a4ccf79b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d163166b-1209-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1771996880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996880, "uuid": "80a0a6e5-9056-4f3a-b525-43f94129eb33", "comment": "Malware payload (LummaStealer)", "value": "f96e2225af8dbf7555f3f4669d685d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996880, "uuid": "0e0f22ab-21a6-449b-9131-bb47026ff0a3", "comment": "Malware payload (LummaStealer)", "value": "cb08fd349397af4528cb8cd94cc69434388747f93424da44c31169ccddc876ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996880, "uuid": "80f35615-f6f7-4293-a4b3-403cba11a5e4", "comment": "Malware payload (LummaStealer)", "value": "88cb6169fd7dd21e6d6aa3a8df0a78938e698028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771996880, "uuid": "ba305729-6ee6-4cfc-9734-245fd224b5fd", "comment": "Malware payload (LummaStealer)", "value": "2b2ba062822095b5ff12c8aa834022ecc9b8d5d2224da9e85648396634c31a2f0fff6481c9d21a4b06c2796bfe5de768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996880, "uuid": "827e4672-d085-4cf9-9595-ae388fcbf052", "value": "T167763801FEDB60F6E903183055A7B22F63315D064B29DBE7EB487F6AF9776920836205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996880, "uuid": "6d8eadc1-8d3f-432f-b3ce-b3a73af26c23", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996880, "uuid": "19d970c9-2b5c-4a42-8d8e-790893300ff5", "value": "98304:/5RI0R796nAlJXlkv/0w01yAA2p3EUIk:/l95vHA2p0UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771996880, "uuid": "09d38581-c82b-42fe-a60e-4e1fc3b261c2", "value": 7607296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771996880, "uuid": "39a396bd-ec88-4e8d-880d-4e4b95689602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771996880, "uuid": "bda60ab6-d478-4b63-88b4-d074227c47a6", "value": "cb08fd349397af4528cb8cd94cc69434388747f93424da44c31169ccddc876ac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd1d8fe-1204-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1771994454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994454, "uuid": "fad9dee6-6745-408f-931b-c8e40a60e7b3", "comment": "Malware payload (Meterpreter)", "value": "ab8bab19130296731d3d1d1afd628f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994454, "uuid": "a8b653b6-17aa-4fc9-a05f-85eacf2495b2", "comment": "Malware payload (Meterpreter)", "value": "cb5e10b604cdca1bf5d6f497c83d5ccd391acaa4df7b2f5fed8037812bf03b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994454, "uuid": "50e8fa07-7319-41e3-b40c-ff5487d90bc4", "comment": "Malware payload (Meterpreter)", "value": "3441306816018d08dd03a97ac306fac0200e9152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994454, "uuid": "dfa2f5e1-b1ef-42b9-9af5-11bf850c27e9", "comment": "Malware payload (Meterpreter)", "value": "480f416abdfcbda618fae6ea582108bd8074b87fa89af1eba47344e555862370383313fd8f94565768480d44788214f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994454, "uuid": "d911fe19-6d4b-457b-83e7-60e772525102", "value": "T1C474BF09F7A950F9E1BBC538C9524905DEB27C9E4B60BACF03A409A69F237D09E3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994454, "uuid": "4d81a922-a7ab-464c-b87b-bd3a6c20fdd9", "value": "a4f1ffda5ff75f252ab009dcfe9a563f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994454, "uuid": "bd8e244c-6615-408c-90d6-021d16c1d03f", "value": "6144:Z+QIULRfNXutGOWCb/YAEDLju6jmx33eAP2a/Z4aa4eWGmR:ZxPN1+oOWCbgAdVuioaaMNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771994454, "uuid": "13dead45-1e51-4bc2-b9f0-81e290e11189", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771994454, "uuid": "cfca3cc1-1464-4016-ab60-2d77bafbb00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994454, "uuid": "95a2f74d-c587-4ed7-a785-345224471574", "value": "cb5e10b604cdca1bf5d6f497c83d5ccd391acaa4df7b2f5fed8037812bf03b45.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d3867-122e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772012766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012766, "uuid": "c246a136-7db5-47e3-b069-7b31b3ed537a", "comment": "Malware payload", "value": "91366e4c267ceef23abcc866a5aad3d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012766, "uuid": "3589f3ed-ecf6-4239-8b3f-57b797bff855", "comment": "Malware payload", "value": "cb79dffd6f75d75068ef4520af97e3ddee7c4094f17c603917b1bd0a4b5dab01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012766, "uuid": "efca7e8c-035b-4007-9d5e-c58194f97f30", "comment": "Malware payload", "value": "e364f628bdc0de4418086565cfeba8dd703b58ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012766, "uuid": "40ef6445-70fb-448a-8d12-ab035b1b8b04", "comment": "Malware payload", "value": "c7b36db1d33bded299febc5953ba5c5e1094307a3486c3d6aa86382d467482d78338e0d75776f1353cfa7e18c0a5ca06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012766, "uuid": "26a1a1fa-7236-48cc-8dd6-2db0392737bc", "value": "T131931A5D6A13FCF0294F55C7BFE1AE3C8E0E6F901257904D521FF281994CB36B8A5A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012766, "uuid": "9bab9f4d-5a65-4955-ad42-060f66310d4c", "value": "1536:GDB7eKg20hdSrMrP4U2w2zx0NAsbek/B6BkQWJ+aY:GDB7b0hdwigUx2zx0Jbek/B6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012766, "uuid": "01203774-c6ea-4a99-9129-ae02c1f5107b", "value": 96876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012766, "uuid": "392ad324-dfed-4e56-ada9-d388ad667aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012766, "uuid": "9c3421b8-83c6-42fe-9219-286c8d7054b3", "value": "invoice-1637482117.pdf (87).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba327d68-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034637, "uuid": "d62f4f17-c03f-4dcc-99e3-af72e3518325", "comment": "Malware payload (Mirai)", "value": "28bfcf919875f58f6d226283d434482e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034637, "uuid": "588a7d3c-0815-4f61-a1cb-75ee3891faa3", "comment": "Malware payload (Mirai)", "value": "ccad12231dfe7feeec242d1ee5b30c24b9a6a9e20fc60c623457ae5689136d01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034637, "uuid": "a0f224e1-327a-40ea-a470-0adb5aee98d4", "comment": "Malware payload (Mirai)", "value": "82e7a2130f57d48c7c5b105907650bd1ce6149e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034637, "uuid": "75637514-f3da-4ef6-8dab-42d42d67b0d9", "comment": "Malware payload (Mirai)", "value": "28df8abfe8c76a31416b38ffc52dd37aebef99d4625554b031b98911b23f0920726439a0770f9086cd88209f8b7b7a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034637, "uuid": "842cbf3f-77a9-4d70-91b9-315f4f43735a", "value": "T176532B9AF801CE7DF85BD77B4457090AB631A3D112831B3623ABB993BC731991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034637, "uuid": "bee6a005-d966-4561-bb5e-cf0ea23c3f39", "value": "1536:KU4gDtK+jO48P6Py+c+pL7DPDGdi4a1c8Yf9:KUFDtljOt4ckLfGT8Yf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034637, "uuid": "daf3574b-94a7-4cba-b3a5-f6798e1f3be2", "value": 61712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034637, "uuid": "d7b74341-4c78-4f4a-8039-fccdd390a0b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034637, "uuid": "209063d4-042c-4d12-8d9b-412983a1cd08", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8da4ca9-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017428, "uuid": "f792f787-0584-4990-99c6-290573f8357d", "comment": "Malware payload (Mirai)", "value": "cdbd08923868e8b7159f9dda2a4bfac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017428, "uuid": "ad3258af-b8a5-4ad2-a231-e6246a9fb987", "comment": "Malware payload (Mirai)", "value": "ccae8d90b726076c6ff90415a55de56ef297bf86e518ce6727b3b486eb87fb49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017428, "uuid": "68da63ad-bc03-4245-9f6c-056212432f60", "comment": "Malware payload (Mirai)", "value": "0c26603a91a595e1e1b9cdec67294637fecb9e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017428, "uuid": "1ea89d45-9a32-48e3-9b6d-0b22231bfe36", "comment": "Malware payload (Mirai)", "value": "17e53571d285d7c9ddfa84d4b6432c00af6f7da8bd3ada99dd8d36d21abe2d859bddf32ddb6155fd46aad4c93c3d9010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017428, "uuid": "0891f94e-06ae-469f-99ea-2f46d8c712a3", "value": "T1B4334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017428, "uuid": "79e552a1-a9b5-4cbe-a606-584e9ff3c7c6", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twx:ivW3jdQGqt7Y+Z+zN9cGgI6bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017428, "uuid": "fa7f4a94-c2b5-4c8e-8499-956b7f1c5eb9", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017428, "uuid": "59360952-0c55-4461-ba21-d4a587429558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017428, "uuid": "7cc955d8-b933-459f-a1e7-47be05967cec", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585fd316-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012998, "uuid": "d4312d59-f3a2-4913-b74e-4441fbbc1a6d", "comment": "Malware payload (Rhadamanthys)", "value": "1f3a68aa69c48d644c8e3b42c4396f77", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012998, "uuid": "822e9914-9bb3-4fa2-b693-dd3b3d799f9b", "comment": "Malware payload (Rhadamanthys)", "value": "cd2aad9c41e4834728657042e778e52822fe829f5f685c9d766dc1c69a1e2abb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012998, "uuid": "51d8e861-66b9-423a-827d-8786aff891dd", "comment": "Malware payload (Rhadamanthys)", "value": "ddd5339aa4dd91f5cc039c100eaff1e45b5a19cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012998, "uuid": "f64b6b34-f793-4419-8902-f5fe9dfe489a", "comment": "Malware payload (Rhadamanthys)", "value": "e12b34ace58e50a4558379fce4500ca9efcc296fdcde755004773e3d3e412aaa9db2b0afbebd7ca2d9469c45f4fd0073", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012998, "uuid": "10c692ee-a475-427a-86ef-948fa903ba43", "value": "T1C0A3290C6EA0ECF9C459D3E07BD82AC5D7186C1F0BA591E4CECEAF214C41AA8D7615E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012998, "uuid": "3b3f465a-c72f-451d-93ef-6462af3472f8", "value": "1536:GDB7eKg20gQgbTMrvrC4vIVRNrCiA3BW+4h6BkQWJ+aY:GDB7b0ETmjzvwRNrCZBW+4h6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012998, "uuid": "d5f6ebea-c1de-4d50-b49f-7a73de09c1b2", "value": 98843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012998, "uuid": "257364a7-825a-4d4c-a35b-b3a1b5a772d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012998, "uuid": "26862810-2384-4d12-8791-b48f1c662201", "value": "invoice-1637482117.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70bcf9-1228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772010265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010265, "uuid": "0ef20c7e-7e6a-42f8-aff0-8f2d8b25c08b", "comment": "Malware payload", "value": "f3e8549d52fc66dd1d0c8782c7b2d124", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010265, "uuid": "1a52e9b2-77de-4dbe-b313-45cd1c3dd2b2", "comment": "Malware payload", "value": "cd32e607510bca425e81a585ae40fcb75e2a1240cb8d52c720f790ff54f4d8be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010265, "uuid": "83ae9d3d-fc74-4af9-a670-c8d862ec6229", "comment": "Malware payload", "value": "a08942663b26a48af5e257d772cb5ba05f767cc7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772010265, "uuid": "8ad4f063-557d-4292-90c2-c5ffadbc016f", "comment": "Malware payload", "value": "1b8eb41e4ccbbd3e6ea8600c1e967c3398e6cf5b4193f3956a3417256b5fb6181dd5f3f18d34c6080474539991c2ef37", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010265, "uuid": "6d3ff1f2-de1e-4dde-a100-6174a9237ccb", "value": "T16A069E16A2B500ECD0BBC27889469607D77278550335EBEF56E08EA22F23EE15B7F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010265, "uuid": "ba214b90-6d01-4d8f-9862-262ae0db11c2", "value": "af0c845503178cb230674faadcc961fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010265, "uuid": "42164c5d-a8df-4f5b-abcb-9a56ec5eee51", "value": "24576:Coij9wqn7meRNGKda9Lrc5p8JruwnFPtR7XI:CoowqnfN/grc5ppqD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772010265, "uuid": "0307d541-8074-49df-917d-230a206b3e17", "value": 3757568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772010265, "uuid": "d6eedd4e-767e-41aa-bbff-5f8dab07a22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772010265, "uuid": "cd5b93e1-7ab0-4029-ba91-fa4bb42d267a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2e257a-1284-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772049429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049429, "uuid": "689a2991-ef28-4408-85b8-0dcf79ec198f", "comment": "Malware payload (Mirai)", "value": "563083a06b1ff42b4884ace3cadcfb41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049429, "uuid": "d488b912-f4d0-437c-adbd-053bd0870099", "comment": "Malware payload (Mirai)", "value": "cd64edfed62ba97796e60df28869e19abbd120a913a6c0dcc239b71c36f92637", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049429, "uuid": "0fc199d6-3afb-4d31-b0c3-da8d26e88e35", "comment": "Malware payload (Mirai)", "value": "99e0db604a65967d07dad4f6fd7865f09390ed5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772049429, "uuid": "f69b6770-4842-4e30-a9ca-b88075be240e", "comment": "Malware payload (Mirai)", "value": "7c0f1403fe09522a90a2a8a5b4a817648dcffd48a315ba348053da608eab8ab3cc03b8379ce56e6f584410fb6f59fc18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049429, "uuid": "24f7acfe-0942-4d42-a15f-72f2a4e55b7e", "value": "T1AEE2F124625F408ED122A632413F6FAEE5B0DC24D9D7ACA1AD1294CAC9D33747694FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049429, "uuid": "c66dcebd-cf4c-4fa8-97f4-eddc42681c65", "value": "768:5HQ7WUx5TygVxDfxxbqSifvc8OHtOeCytBVZ:ZuHTd3Jxb2fk8OHtqy9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772049429, "uuid": "8f0a6e31-7b5e-45fa-a41c-70b87c8ed288", "value": 33908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772049429, "uuid": "987abb16-de9d-46ea-bda3-9dad5e2a9629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772049429, "uuid": "b83f9a97-14a7-4a7d-b33b-b8eec73f06c3", "value": "boatnet.x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b0fe06-128a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772052316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052316, "uuid": "934a66ef-099c-475e-9bbb-4ccabc59821c", "comment": "Malware payload", "value": "27ee27ef7a421e665cb0144d78f305a2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052316, "uuid": "144270c0-26cf-40ab-adf6-edce7cffb635", "comment": "Malware payload", "value": "ceb9fcd8899a4a135858ebe1f731b93f9556b3b19a1b9986b06596a2720d2e5c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052316, "uuid": "2aec2a60-0682-428d-9504-1b435ceb3dd7", "comment": "Malware payload", "value": "d4a1d20a5cb7b22200c0caf7e9d557104409b118", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052316, "uuid": "f016d9da-a082-4da2-b96d-6fc1d84ba43f", "comment": "Malware payload", "value": "04de4f83e8ee5b062c8d65cca083a81c57cd72c73c9c6548ca070bdd1e56857f0a1ca9bc1c8defb03c9597e0c528cbed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052316, "uuid": "9be7c368-0a5d-41a7-a272-e512ade404d8", "value": "T12283E04BB9419223C9890F764B1FCBD06F719D08EF66384126D7738C2D776902CAAAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052316, "uuid": "ea285b38-b392-4cea-9c48-df64c22d5807", "value": "1536:tL12b1Nktc8Ab8NS2oI2rtAsF0C0qkLCF3XqP63xobR:112b1Ct7uIoIYvF4qLe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052316, "uuid": "1e02efce-365a-4362-871a-4ebd5baaff6c", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052316, "uuid": "cb699b77-a029-4012-8976-8de8d42108df", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052316, "uuid": "3e05a839-fa5b-4d0a-ac3d-f01f04f05f29", "value": "Agenda draft Vasili.rar .msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6465d02-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772029959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029959, "uuid": "242999ae-d9f5-4e72-a10d-615275081f53", "comment": "Malware payload (PhantomStealer)", "value": "dc9792fe7d61fa3861ce3f5ffa8278e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029959, "uuid": "2e889881-20a2-4952-b080-b83274a3a193", "comment": "Malware payload (PhantomStealer)", "value": "cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029959, "uuid": "20425db1-6e94-4622-ba06-4d26e33ed6e0", "comment": "Malware payload (PhantomStealer)", "value": "16923c81ff9564b8a16070e3c9dc51941711fc47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029959, "uuid": "c9e11109-83cc-4d70-9acc-2457c2279e13", "comment": "Malware payload (PhantomStealer)", "value": "959f0d830cc5a6dd3466fa21f7b62c99b7f42457f5ea37b6f364f7cdd34c322cb07d45f643c47f7df340116dfab7017d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029959, "uuid": "0ea98eda-3ec8-4319-9302-86ed3c3dfddd", "value": "T14A85F12037E94A44F4FE5B78457246105BF9FC0BAE32DA1E6E8420DE1D79F418AA1B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029959, "uuid": "2a028259-3cba-47bd-bde7-193149304bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029959, "uuid": "fdcc657f-e5f0-4b20-b9f4-3e26a6e1e469", "value": "24576:TlLoRymbJ8wgMh4CEv3ksjU6UsHMcrE0Jv3oqv5BYg9AxMkD/zfp:tajbOhMhjE/7xUsHtJv3sxMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029959, "uuid": "ab74d53a-d0b3-450d-acd3-11bc28d05252", "value": 1795584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029959, "uuid": "0571f184-1e73-485d-a4ba-59428a0a5a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029959, "uuid": "0cb3dc7a-142d-41ed-9e79-5ad87a4f572e", "value": "Posco New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52e57d8-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772029904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029904, "uuid": "9d3676a1-0c2c-4dd4-8eca-7f508c48e042", "comment": "Malware payload (GCleaner)", "value": "53be172219f459d6d981178985786345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029904, "uuid": "896366c1-5e73-46b8-904c-38cc0700ec30", "comment": "Malware payload (GCleaner)", "value": "d02d1508176ea159e20358f58ee07d347e4643393d72a2ef1dba2f4188120b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029904, "uuid": "7b52d22a-4f23-4130-b65c-68aee8e9a352", "comment": "Malware payload (GCleaner)", "value": "ffd78c6d4aa2fc8b69255dc55515fc7e6e18475e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029904, "uuid": "3228c9af-21a9-4a99-86ce-45712f01edeb", "comment": "Malware payload (GCleaner)", "value": "eb76e15a80c1133703051ef7b046548329cf8eb48e27b433da2ca6cadcc932adcb71f786ea6367dd42b989a9fbecc54d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029904, "uuid": "4e2d2935-f08b-449e-92da-1e337c43d8a2", "value": "T133058E27E2908873D132197C8C5BB2A45B2D7E8C292469753EE4DFF88B277833525277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029904, "uuid": "6fdf7e33-fc3f-4508-9077-bb27fc6df10b", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029904, "uuid": "53b8bbfe-245f-4af4-a28c-4f7dc22318db", "value": "12288:qeM9gzhW/BsjB7V+bRO88pvnsU1Db62Aiye0YCFFdr71Jrhx3oZxE8:tK3/q7gR8/K2p/0Ymzr71Rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029904, "uuid": "db47d935-46b9-470d-8da3-dee2258cdfe9", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029904, "uuid": "0e3a0135-a779-473d-ac3e-2f0b1f2748b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029904, "uuid": "98f994b3-efcc-4d9a-9c7d-36fc9a3d2379", "value": "53be172219f459d6d981178985786345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c178e6-1256-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772029983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029983, "uuid": "884c6ff8-fd8e-4eb8-bdf0-a6957c6f2ce1", "comment": "Malware payload", "value": "3351480ae698fad343efc0b41e14c701", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029983, "uuid": "328e5c5e-f7d9-487b-b4ab-eb26836cea1a", "comment": "Malware payload", "value": "d16721db8e65ebda8554ca0ef49656430c1b21b9f3cad03a826d673c95c6d63e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029983, "uuid": "fe96d0f7-b909-4ea3-8b69-110b31b66cb4", "comment": "Malware payload", "value": "42a39ee3a7b989ae375669da041a8a78c3755fb7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029983, "uuid": "5dafea8f-636d-448c-82dc-bd41d0f9770d", "comment": "Malware payload", "value": "47720b098e3268c3b8954efbffc89e59fff2bf09a02ad6f1e6b4a7dcd18fadf202d083628123a367275789e2aae9c5fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029983, "uuid": "91a53367-e1cc-48e7-bf81-137cf810c930", "value": "T1CB0330165F5D0E901DFF4A33EB969CCDAC0AB2C6650547BE8239E4FA8536337DB49820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029983, "uuid": "260dbf4e-b53f-43ad-a860-7b09408283ec", "value": "192:gYBZH8Tl4CQ0/O9tctT79f3ORIIXIimZ7SE4phsT8:gY8iCQ0/O9CX9f3WIIXIvZ7SE4HsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029983, "uuid": "295f1b05-2959-4319-89c4-44a1e3303dad", "value": 37895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029983, "uuid": "2755b596-b931-4081-8b6a-3f09ca39e156", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029983, "uuid": "e9c0278c-0c92-457e-8510-de3054673a7d", "value": "Items list.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9467e5e0-120d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998495, "uuid": "7bb3f187-5081-4eec-a60f-fe465967d0c8", "comment": "Malware payload", "value": "3ca8a9ab86a5f8d42bdc49a80fc36de3", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998495, "uuid": "170db81e-0f89-41ba-9dce-bed53aa32898", "comment": "Malware payload", "value": "d2b908317ba856b6a49b5f4b9c63f077646b407eb779f172f9edfe4d8b886220", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998495, "uuid": "0df6a018-4e24-401d-b908-f42a058ba76a", "comment": "Malware payload", "value": "e79ccc3f6517c911d6c1df79c94e88896f574e64", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998495, "uuid": "a4ebb70c-215e-45f4-adaf-99e939ea8daa", "comment": "Malware payload", "value": "430e5fd93be1f759b4fa1fd1aa8060de8286d6b41a297211d62a1e83f0364f9bc3d7c14b87dc8c71b30be3582efe4faa", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MSWord", "colour": "#7092AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998495, "uuid": "cab29eb9-437b-4055-b8a7-f7ac384dbadc", "value": "T1E65596438D448B83E02982F8BD437DE91E273B19E9C52EFB53261E8F3E695221D8D51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998495, "uuid": "4ff62895-00be-439e-b3d2-45b6fe752679", "value": "12288:/LjApcRHX6O/9PrqFvKQk1hQe1wt8myjtjajl20ERk9lQKxpAjjjjjj2jjjjjjjK:Tjrd1MbIQeeORk9lQCEEyLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998495, "uuid": "df531984-962b-4a3f-93ef-4443c6050f69", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998495, "uuid": "16b55656-8cfe-4819-8adc-8fb15d825b71", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998495, "uuid": "b937327b-eebe-4f17-a04b-15c096998ff9", "value": "d2b908317ba856b6a49b5f4b9c63f077646b407eb779f172f9edfe4d8b886220.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4911ac-1288-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772051333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051333, "uuid": "addb0382-33f4-45f6-b0b9-f0e34480f67d", "comment": "Malware payload", "value": "89da4024ee6fc85ed6b7229a91d1312d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051333, "uuid": "92c43697-e7c9-4e41-9d35-669577a069a3", "comment": "Malware payload", "value": "d2ca7d6de6f442d32226ae80271829e9ec78994b5d38f0fc5f382c4659ed29bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051333, "uuid": "260659b9-afcc-49ad-a684-31dfe4ed230e", "comment": "Malware payload", "value": "e023f330e46cdb761bd97d696f429092e5b4425c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051333, "uuid": "426ed074-256a-439d-b81a-436c384f84dd", "comment": "Malware payload", "value": "244b8486ee9628a09c83a3b2cf77014e3891c1cabbf9440e10423132d1cf3414c8947e6e4a9f7c1258962921a6f50b83", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051333, "uuid": "17e77a78-be1b-4606-87e6-e08be6a9908d", "value": "T1B7E2F02076E48714E073DA39AD7A33499579BEF9EF32C34D0224912A2CB1210D469F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051333, "uuid": "c1d0cd08-e5bd-462d-ae54-a5d39be91b14", "value": "96:cxzz9GiRfbkPovBiRfiPRdlfVfPB6gvBrz:cxfhRfbkPoERfiPPlflPBRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051333, "uuid": "359d2bb4-b5b3-49e6-9f64-e8fa958ea453", "value": 33756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051333, "uuid": "0350790c-16c7-4500-a9a7-ccec11028486", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051333, "uuid": "6c3a5bc0-2cb4-48f5-99c1-acfb33ce36a4", "value": "123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1906a4c8-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035655, "uuid": "21d2347b-ffaf-4ff0-8a58-2a3c2ea309f4", "comment": "Malware payload (Mirai)", "value": "a9db20df51f98d2975555db1251e6232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035655, "uuid": "15b7b49d-4915-4f23-9a56-03dbf455af84", "comment": "Malware payload (Mirai)", "value": "d2e68f921e38299775a2a2c5cf3105648d851efccbd3c3f8a3f3d416292ed765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035655, "uuid": "9e5142be-7d6b-432a-8551-318f8e82b655", "comment": "Malware payload (Mirai)", "value": "4ee7fc57b636ae9f2ce3f471d396daf51e8054e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035655, "uuid": "8e22d4b0-1f43-4f26-9cbc-76e1c358961f", "comment": "Malware payload (Mirai)", "value": "441f71d24c5938b74ef4c740a70a3895c279f9862ca193725c3f00e7374054c1d4eabb5fa74917881ef5c89d5f0f02e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035655, "uuid": "bc44d6e1-9e09-491a-a150-0f7843ab4040", "value": "T17C865B46FA096FA5C924483399B3496033B26C585B329782F744F37EA9B32451F53FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035655, "uuid": "7e9378ee-0f61-45a1-a1ea-e4450390a3c5", "value": "98304:ld+KYa2euI7np2ALN7iLpV42aanPdzm4/SR12Eo:ld+KR2lV429k1zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035655, "uuid": "ab7dd6b6-58c5-4a55-86c0-22b3c81d1bb0", "value": 8257684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035655, "uuid": "a9188dd7-c079-4b13-a11d-aed2a39fb08a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035655, "uuid": "bfdd9797-7804-427d-b9a1-42e9daa5f25c", "value": "PPC64LE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a899d19-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013028, "uuid": "b444d534-1109-45d3-899c-6c50d04506a0", "comment": "Malware payload (Rhadamanthys)", "value": "6ab5308217fc93facf406965112df182", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013028, "uuid": "c0a195f4-8720-408b-ad47-19338bec075c", "comment": "Malware payload (Rhadamanthys)", "value": "d318416ad77241b9333242838e69e20b758f5e6d53fbef0811fe25864ec7863a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013028, "uuid": "33b05a36-a97a-4153-857c-54c5659535c3", "comment": "Malware payload (Rhadamanthys)", "value": "b5f55ca41acdda9cfb57c235a576343a8db18c8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013028, "uuid": "7d8a040e-f90d-4c6e-afa1-3499850b6404", "comment": "Malware payload (Rhadamanthys)", "value": "9d25c933fe33b5857836d86fb8ba282d9bbf1268f8861365fbda17ce1624d4111f232fdb2e41db5e1f2e846d7e0e041c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013028, "uuid": "12a8e256-d56f-4e96-8f06-da85bc661e16", "value": "T135A3E882B772ECCE9A613D51978810F9895EC1494C8379B0ACEBE38195EFE1CCD861D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013028, "uuid": "d8b9cb76-10e5-4ded-9643-d8228349405e", "value": "1536:GDB7eKg20P+grnrG41IRNUIzUOAtHAyAg6BkQWJ+aY:GDB7b0RrXiUxAg6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013028, "uuid": "c05aa908-787f-4ec4-a7ba-60d7b33b0a0e", "value": 98120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013028, "uuid": "7866f269-44be-4463-b66a-1b67eaf63186", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013028, "uuid": "c570d9e7-703e-4e9e-9cd0-d32fc28a6594", "value": "invoice-1637482117.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2dba85-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017483, "uuid": "d9026821-8f3f-4fd8-892c-2d5244556b94", "comment": "Malware payload (Mirai)", "value": "7692589f5e687830ccd879d33db431e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017483, "uuid": "c8c19ada-ad24-4480-b720-666dbd8d5daa", "comment": "Malware payload (Mirai)", "value": "d4b9276162cedea821540d9e4ad93b39aa893778edc0aeb6f74fe132e0db9b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017483, "uuid": "a7320b82-4764-4bc2-ba38-b5a290306bf7", "comment": "Malware payload (Mirai)", "value": "d4a74a567bf4786a21990783a3525d8ed649c125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017483, "uuid": "e5f4abe2-92da-44b0-9745-308f37ce28e6", "comment": "Malware payload (Mirai)", "value": "4dd9d2b285b3fb6af19a56eb68440d7a94640b732712bf9eb1c793814b6ee7afdc7f02383dba5061e24277397b14faac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017483, "uuid": "28f11c0b-23cb-4cb2-82b4-73ed0ced6768", "value": "T17B630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017483, "uuid": "31cac974-8984-441c-ad43-5379ae39304c", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017483, "uuid": "be183c39-5128-4b54-83e2-5ed870da0545", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017483, "uuid": "39108b9a-ddc6-4f25-84d3-ff5146d475a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017483, "uuid": "15f5f407-edcb-4496-acb9-aa0903836fd7", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4289a3fc-1204-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771994493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994493, "uuid": "f4a9df5d-c8ec-433e-b372-602633fd6c7c", "comment": "Malware payload", "value": "da52c20a56cca22ad994a1f3baa8b3bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994493, "uuid": "49cbf2d4-7fa7-4ee4-9f4f-6fce0818991a", "comment": "Malware payload", "value": "d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994493, "uuid": "b8cd2938-c9bb-4525-b5d0-bdf79d107b6d", "comment": "Malware payload", "value": "2f5166086da5a57d7e59a767a54ed6fe9a6db444", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994493, "uuid": "2b4e6410-6f72-4ab3-9df3-ae5e366114fc", "comment": "Malware payload", "value": "28a0375fe8c7383ec762b2ca77068e618bf584b6861e7d25ca868135cb03bb9409834afa6a419d8d872e95687c1370a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994493, "uuid": "3884b987-0bc2-4ac4-968b-4b48cf99522a", "value": "T1DE935B41F4D1D471D9FE097E0865DAA18B3F7820DFA09DEB279006AA4F342D1DE31A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994493, "uuid": "6b2994eb-2251-4d6b-9b2d-513a94fe7a82", "value": "fe7da361da124240609840fbe97461bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994493, "uuid": "f58df9e4-4f8b-4bee-9757-6ecddefb83c8", "value": "1536:nkajKVY1kYPbxRQgiD1chqhNM6EaNxn9jqhNz1Q2PybKyIZglpdsW8QEMEcdwqx6:nkajAAPFRthqHMen9WxQ2PyosnECwqx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771994493, "uuid": "7730f0c7-60b9-4d3a-b260-82faa6c30d81", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771994493, "uuid": "48bcd146-f28a-440a-bb74-b7f92ac72b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994493, "uuid": "d93c31ee-5f1c-4ee8-87c4-16adc290d921", "value": "d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d24a461-121b-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772004308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004308, "uuid": "5d2940de-c5de-4afd-912d-9ba4076db36d", "comment": "Malware payload (VIPKeylogger)", "value": "bf85b6866561c17b1ce56e8d1b2c80fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004308, "uuid": "24f4bf6c-e00d-461e-ae91-e85f0b82c25f", "comment": "Malware payload (VIPKeylogger)", "value": "d602128bef26396a9ce57e55bdfdd512b3f8e292cd7e7de5870e3ec81dcc884b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004308, "uuid": "4d9904f1-a071-4ca9-a01f-94085753636a", "comment": "Malware payload (VIPKeylogger)", "value": "e7c17fb5c644c39974b68d4a8ecea210c76c2e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772004308, "uuid": "4f941c15-4394-485d-8147-025fa23d13dd", "comment": "Malware payload (VIPKeylogger)", "value": "e6d8f0fb7aee3be99e3825399e4dda97ce152a825bbdf5257a6f0eabf292771cd13502d01854836e426203eace611d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004308, "uuid": "134bcb29-ac88-43ff-904b-e1a2ed5657f0", "value": "T12C15E0109D96AB64E9AD0FBCC12105A4A3F0CA476693E36F6FEC41F49D6BF99CF06401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004308, "uuid": "87dee2c9-3365-4e7c-a40d-4712ca8b2b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004308, "uuid": "ce2b3a68-a394-4d24-b568-de0fb5d7b264", "value": "12288:Sz7dFeE9z3IrmN0Nw1HBY7sOft8VHP2YI1Qsc6F3lrK/CDqZ:Wxz3saJ1a7bfusjF3lejZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772004308, "uuid": "f6c87baa-eec6-45a2-a4b4-941a5c4420fa", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772004308, "uuid": "94b1f25b-0d48-456d-9d33-8a1461dfcb76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772004308, "uuid": "432e3466-f4c9-4814-afa5-97b6d05fe0ce", "value": "PR1680 - TEKL\u0130F \u0130STE\u011e\u0130 - TUSA\u015e T\u00dcRK HAVACILIK UZAY SANAY\u0130\u0130 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309207f8-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045573, "uuid": "a6999562-a27a-4dcf-a288-fe4bb887dde6", "comment": "Malware payload (Mirai)", "value": "e6ae3e81e19dd52ebca4372769050af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045573, "uuid": "69b8069f-7266-423c-a71b-ad72b5b604c9", "comment": "Malware payload (Mirai)", "value": "d7834a20eb8cc68783a9ed2042d2c8abdf6ca648ba862071a51c4f30ec18e0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045573, "uuid": "9fe07b02-6744-4340-96e8-4b6e0ac6f81e", "comment": "Malware payload (Mirai)", "value": "7d3910132a179b51dc5fba95d16b590d5981e793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045573, "uuid": "b04f1429-5810-4c37-91aa-7912d6dfea64", "comment": "Malware payload (Mirai)", "value": "32f646560ed1dc75a3abc5584234bdd6d98dea1ede50d0b31f97544227c1e490c9f6ea55c5e87c9e0abf3216746220bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045573, "uuid": "cfe82083-3854-4227-ad26-57142da898cb", "value": "T16AE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045573, "uuid": "a115e68a-e24f-44fb-b403-9369e5d5c96c", "value": "3072:dgZc9h1jlnLA2PiXYeyCcnVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZnVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045573, "uuid": "7d982dcc-101f-4f51-b186-781ccd0c344e", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045573, "uuid": "e7684deb-c9ff-4b93-bbd4-c89a2574707a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045573, "uuid": "96278527-a2e0-4de3-a615-ca789e0b8f32", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84579d9d-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013071, "uuid": "ab111463-226d-49d2-a040-782ae17fa79f", "comment": "Malware payload (Rhadamanthys)", "value": "11fe93f9a3829d37408d28a81014b7e9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013071, "uuid": "7bc064bc-3e11-4e72-a16b-fd91dc2ad767", "comment": "Malware payload (Rhadamanthys)", "value": "d7ed2bf90520ca417ade0cb901da59017400a1e941fd5f092d31cc5745dccf8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013071, "uuid": "53a499d7-6b92-4b12-a63b-132779ceaed6", "comment": "Malware payload (Rhadamanthys)", "value": "c4583ece8e649abda0257f199d80b7d11d8559bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013071, "uuid": "1bfe3db1-e7a9-4464-af84-a9a7c57853f1", "comment": "Malware payload (Rhadamanthys)", "value": "a150f35eddd26572718e3a5f0564ea0d01f260a3a8c0529261a479437bc3242076accf3358abbdcec4dcf0aa4706cadf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013071, "uuid": "0e1cb835-a9ba-4b9f-b949-b222f80d1350", "value": "T15393D8C46F07CCF224A2F3756E8593A1DA5FE500C6B6D1921E5BE3A1802DF4721B6DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013071, "uuid": "2484735b-9091-474d-b27d-3715e2ab8e53", "value": "768:GDhd0i7J4sYKgY/CMNfWdpoV+f79rXfbrt4wzHuiA+MizSLAuAAroQW+FF+Ec+0G:GDB7eKg20nrTrt4wCiA+xz6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013071, "uuid": "107a7721-2f7e-4190-b363-6225c0766208", "value": 97422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013071, "uuid": "31f5d6cd-d68a-4d6a-a36e-49b2b7dab9e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013071, "uuid": "88d79387-6c63-4aed-be91-ec3ebc980a87", "value": "invoice-1637482117.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2a700-1285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772050165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050165, "uuid": "ee864fff-f4d9-4c3a-a3ab-f269c5177d8f", "comment": "Malware payload (Mirai)", "value": "96beff96f02692785e599b3110db31c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050165, "uuid": "dd027261-10e7-471b-b83f-ebbc4b8f82fc", "comment": "Malware payload (Mirai)", "value": "d8c940a195516fe377449615b603e12db43a3386da87c37947e1a7f2c0e02b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050165, "uuid": "22c888c8-f640-4ba4-ae2c-9ce547ffa686", "comment": "Malware payload (Mirai)", "value": "f3559237b124bcb2ce8691855824d028362fec12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050165, "uuid": "e8b8d726-f5c3-4b94-9b7b-ae31bbc3c7a0", "comment": "Malware payload (Mirai)", "value": "71c321235295038e2906ac9fb6071e14edbe536670e3952acd754c70fa02161cc248247084c124119cc9ad8f8dfd1ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050165, "uuid": "3d5cea22-9ce4-47e5-a780-fdc4f111a3a4", "value": "T17E533AC5F643D4F5EC070570217BEB339B32F1FA0229E907E7E99962EC52A029516ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050165, "uuid": "c731e56f-b697-437b-ae0f-9ff67da68592", "value": "1536:KEFWr1oIluwfBjovgehYYr0EVVNucGAKPHIMS53:KEFWr1oQuwfdooeuYr0QnuHnfIf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772050165, "uuid": "74e65130-d9ba-4ce3-93b2-499d7dc1cc00", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772050165, "uuid": "b335c2dc-3e3d-4b23-ab30-ac8425afe4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050165, "uuid": "3d1855b4-c28c-428b-8c6f-a2c6468e51cd", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4694e2-128a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772052112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052112, "uuid": "af731ce2-4e9b-41ce-87d7-0e648c8fc8a4", "comment": "Malware payload", "value": "cd17b6639545bc2111cc39ad43da79b5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052112, "uuid": "94b55827-33f0-43b9-a470-a3b7df29df8b", "comment": "Malware payload", "value": "d8ee314d855206a1736539d8f341ddd99962f284c328d0770b86cf642615c9a2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052112, "uuid": "5ba25f1c-6c5c-40a3-82e6-6a9782f7eee9", "comment": "Malware payload", "value": "79114153bc3d40963d9a9abf7c600cc5f6620aa7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772052112, "uuid": "f35ae861-1500-49b2-8362-53f8cd9157de", "comment": "Malware payload", "value": "f03a6f138cd731635d72592a591f43922fdbf5a71652d00b9b116bbceb5f6b4bf4dd8ef10f64a5ab9331ae763a8469ab", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052112, "uuid": "38fb63d1-8a2a-45bf-b4e1-ebd1430eef84", "value": "T182944A13658C6E9FE27647B01F6B7E0D3A2E7A29E0D0824E361EC3472770775990E61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052112, "uuid": "875bb544-2b45-4662-9598-32eafcce4115", "value": "6144:AbGzSo73LuoJ2oasu1VV9J753Z3tuapFlRgPX+:Ab+S43LZJBaNj9PhtuaLlRe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772052112, "uuid": "85e7d962-91d9-436d-b6b4-113b6fd19e22", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772052112, "uuid": "2286446b-7ab2-477b-b099-0a7547b4ecb1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772052112, "uuid": "c48df2a5-dc18-4d77-9c7e-07564b4a6310", "value": "documents.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbe03ad-124e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772026185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026185, "uuid": "46e669f0-e429-44a5-92e3-5d70d32784a3", "comment": "Malware payload", "value": "2d7bc2d012b4e90475965a7466dfa1d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026185, "uuid": "f02e8b2e-63d7-482a-a3dc-e681240fe4ec", "comment": "Malware payload", "value": "d921e4c59b048aa4085712054c1fa0cac28994f8857b519f27a297b8f2c5d77d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026185, "uuid": "0a95248f-84bb-4da3-9a90-811bbe386a33", "comment": "Malware payload", "value": "e5fd836bb8a3bc2f2fe4064afbd0e9fce5a76c3f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026185, "uuid": "4f9858a6-4dcf-4b81-aa80-b9b255962411", "comment": "Malware payload", "value": "333dc7f82afdcf2e4dbe1c17818166a8223426549126c5885c7d964c4f7e2dee44fb4f196be956214ef4b10f781115be", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026185, "uuid": "be767757-3c3d-4b94-b5e5-f18a28c0c368", "value": "T1A036E042F759A93EC8F7433646B607229136CD668B93C683595C323818F76EC1F1ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026185, "uuid": "93d4516f-f144-428c-ba9c-0146a1798f58", "value": "98304:hBzfroHSL+CiJrz8rGImPWOvRLlnCAB5YySa/+0wpaYfGPs:jipxIgTJLNCMxSa/+RNfGPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026185, "uuid": "dc4bef4a-ce7c-4a4a-9cd2-b31e800dc629", "value": 5212446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026185, "uuid": "f7d21c8e-b5bf-40e1-8bf3-0553aaf41aa8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026185, "uuid": "806b6e5e-6d23-4979-a86c-998718e843c0", "value": "Mp3.indir (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0567e180-1220-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772006416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006416, "uuid": "a2a9a761-b618-4b41-a681-fc204598dfce", "comment": "Malware payload (RemcosRAT)", "value": "26f4646b8986df97f0fe7bc6717b4a31", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006416, "uuid": "93cc363d-f8e0-4c26-b0da-f3e23e82251a", "comment": "Malware payload (RemcosRAT)", "value": "d99c4bdbc6bff2c483d76ce577030b1961a232a9d965898a6b914be9235d7328", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006416, "uuid": "18ce2c3f-b2f7-43a6-8932-a4702c9fdd87", "comment": "Malware payload (RemcosRAT)", "value": "e0e0472778dcaa8bf8955a1a6c88a4311f9553e5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006416, "uuid": "469c8ab0-6254-4623-b5e5-800b60d5f90e", "comment": "Malware payload (RemcosRAT)", "value": "e9a3a63abcf9cae3590124bc731cb2c2de2d9d703b90f2cbb6fef00aa2d1e384283e9d81acb086b90feedb3d1e713c6d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006416, "uuid": "671c7130-d286-4c98-9218-dbc8dd6e130b", "value": "T18745EDC4D4B31AF46DCCE90BA1D97C8CED5A2D98F6010E2D6440BAFEE1529D64078AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006416, "uuid": "6fb215dc-cf56-4305-898e-06ba861c5804", "value": "12288:QM6vPCAvGmZMaYiRnew82/+t7c3XgWNQTM:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772006416, "uuid": "3bdab8b3-2125-47e3-bb41-567022c0c58c", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772006416, "uuid": "4b4fdb3f-c0b6-47a5-8b1a-7023b25eb7cf", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006416, "uuid": "e1ab11e7-2c6b-4fa5-b2c1-8fd8355fed2d", "value": "nMachinery_products_Doc.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6008eb-1290-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772054828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772054828, "uuid": "3f5982fc-1946-4b5a-bfd9-64f278be701a", "comment": "Malware payload", "value": "6838ca2c1a1e21a551c6dc4d7695c0ce", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772054828, "uuid": "99b9cb8d-a846-4dec-aa1d-d6113295ea53", "comment": "Malware payload", "value": "db48dc163e8eaa906653b3e64b6aebe13b29e7e93d00aac5696234b5f3ba8f81", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772054828, "uuid": "717fb690-4a1e-4ca1-9028-748ecbb6b9e6", "comment": "Malware payload", "value": "272adf96a8887f5ec238474357c817142ff995ca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772054828, "uuid": "16af9f15-a12e-4661-aba6-4850e9be1f9d", "comment": "Malware payload", "value": "980832d085e85bd88f8c7389fd6a2d507ef8d7df35d1fdfd961ad28e76a2cb1e659fcc135b7e9de33a4e455c8e13da86", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772054828, "uuid": "b8890104-2537-4264-9d36-475ad6c6fd51", "value": "T1D37733F86D1C1DA7B01DE23343D82B63D37B611E539DE8AE0703079D68621ADA73B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772054828, "uuid": "62cc7e83-bb42-4da8-95f6-06cb2455cba5", "value": "786432:8YU7M1dGOymw8/LukCX9LfCRaHR8MyJCMIFLf1pMeS4yW4:8YUw1IOl/LuY3MyMMIFL7S4yW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772054828, "uuid": "10df71f1-b2d8-4ca9-87e0-a5a257f4b17c", "value": 32720180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772054828, "uuid": "354627a9-a9c0-4f6b-8a33-93f6c62101ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772054828, "uuid": "34305165-74b5-4595-990c-980c118cb783", "value": "loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d048c8-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035643, "uuid": "1ae43bca-bb71-47f3-a211-30814b728ae1", "comment": "Malware payload (Mirai)", "value": "9657202bd5c43cfdac85ae33359a766c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035643, "uuid": "f3d1819c-a099-4018-b0a3-9b03755396a1", "comment": "Malware payload (Mirai)", "value": "dbc096275262ce5d95b892da334cb4de8dd03e110e89baa5fa74d86ede95cbde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035643, "uuid": "7e7adffe-f702-4a58-b37b-8c9abac3f87c", "comment": "Malware payload (Mirai)", "value": "f54609ef82dad2cbd902e9b23cec253d6d64f221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035643, "uuid": "d9a21d6e-8065-4ac6-a1cd-85194709d617", "comment": "Malware payload (Mirai)", "value": "0373572c9bc480401c82bf8edd99b9722be59e5e735e27c94ddd35f0ada2d01355bbf2201e2708ed35c946c1d10c0be4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035643, "uuid": "4254af22-7570-4c69-bbef-270170097c64", "value": "T1E5861887B8C24986C5E43A77B8BD80C433631EBA8B9752566D05FE3C3ABE5D90E34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035643, "uuid": "3a960c74-b34b-4dcd-a4ff-2c7308b0a817", "value": "49152:lDW+9c3vHGv1qemkul+Rh496IaNUDXDUYga+QBqtT6pjld0Q7mcRTpIFwyG5Ej:9WDfsqe7uEPfIhBFjld36cVpI6Ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035643, "uuid": "f57337a9-3394-434c-a3d1-84ad1ee00eca", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035643, "uuid": "96d9f88c-08c4-4dae-a308-6519b02d9c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035643, "uuid": "2de04e47-d817-4ff8-b858-1807ec1f20f5", "value": "ARM6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc4b37e-1250-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772027259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027259, "uuid": "3e6d6e1b-fd42-4d41-9752-7107f65116c5", "comment": "Malware payload (NetSupport)", "value": "201351412e893f1292a60ad593371aad", "object_relation": "md5", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027259, "uuid": "e1dfc94c-5b8f-477b-9030-40a54d87fdc5", "comment": "Malware payload (NetSupport)", "value": "dd164d18a4a99d1093608402931f06903e96f6aa30841ef60dc3be335946d0a6", "object_relation": "sha256", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027259, "uuid": "ac285dfa-28ac-4817-b089-0fa32a7684e6", "comment": "Malware payload (NetSupport)", "value": "af6a20876d6eb0d2b32197a23b45f58907e36580", "object_relation": "sha1", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027259, "uuid": "7a57e060-0a4b-4c57-9345-172028c070fe", "comment": "Malware payload (NetSupport)", "value": "a9fe604647eff9cf7fc0bae1dd393ff68c872d1ec17c1041ca4e27392287775c7d610f3a46bb093abef98eecf8e9acf7", "object_relation": "sha3-384", "Tag": [ { "name": "213-176-79-252", "colour": "#E4F213", "exportable": true, "hide_tag": false }, { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027259, "uuid": "9fdf5a35-2e6e-483f-aaf5-929e34bbd884", "value": "T1BED633A0A6E815FBF9EE933DCD529992C99676662B49C193C3F8D0B02C733C4653E305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027259, "uuid": "0dda3fe4-15f5-4fc2-b0b8-602e1fbca97a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027259, "uuid": "8cd0b193-f1e5-41c5-b622-37eb82f3e4f7", "value": "196608:M14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuor7G6JCurH/P/XRLSq2KKeF:M14FSsFl7dCR1C99/LkuUJCuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027259, "uuid": "a3cc3771-4101-461b-b53f-2df804d41662", "value": 13414054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027259, "uuid": "2c4fbe8d-654c-41f1-b680-820bbb8dcf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027259, "uuid": "0053df4d-bd5c-4d29-8b48-dab6f22e0c09", "value": "RateConfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416b6fba-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045601, "uuid": "ed29b388-4eb7-4212-b1fc-769002504389", "comment": "Malware payload (Mirai)", "value": "7f6298c63861b1df6882c5ba34ad42c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045601, "uuid": "100e26ee-bf86-4b62-aa85-288c9ee9d6e5", "comment": "Malware payload (Mirai)", "value": "dd4f0c9c6acea5a60a83b84f7b30352351af85d7bbff45f9d0b831251631d6af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045601, "uuid": "11731d97-ce48-4840-b2a7-26a7e7152fca", "comment": "Malware payload (Mirai)", "value": "5e127823073a6857aa3a4cad4582218adf45878d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045601, "uuid": "9515e09f-27b0-4485-aba8-d76d711a0737", "comment": "Malware payload (Mirai)", "value": "d323e65a3a03f4f41892e70c9b3c85746c0a24978a1a9b4c3e284d6b18200abda5b0ee632e773c06b654a018bfd20e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045601, "uuid": "e9c7e512-b62a-40d6-99e9-3854b3c0f06d", "value": "T1D804D71AAF660FBBDCAFDD3702E91B0139CC544722A47B763674D528F50A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045601, "uuid": "2599bfe7-d2c8-418a-85ef-00bf40d7e295", "value": "3072:KEDlQ362+jjN/xs6moCi1diHw0Ck/deIHROb12y:KEW362+jjNz1diJCkMkG12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045601, "uuid": "c00cb9b3-bb63-4e59-ade0-64e8d6e356a3", "value": 189944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045601, "uuid": "83e67a21-1609-4a99-9f75-f0f6d6e3c814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045601, "uuid": "8b23718e-a925-4b41-ab08-e974d354a995", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf77b17-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017433, "uuid": "d44fafa0-58ce-47be-b405-9ca0a037fcce", "comment": "Malware payload (Mirai)", "value": "85f9d7de88ab1951a0a44e74d93d958b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017433, "uuid": "6e1fa21f-ad69-48c5-af7a-6fb89114dfa4", "comment": "Malware payload (Mirai)", "value": "dd7bf35283e6d5b1fe22a8a28e951a32ab438689f80d91c4e339a4e9423472d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017433, "uuid": "4efe9112-354a-4b72-a1c9-9aa92b512f15", "comment": "Malware payload (Mirai)", "value": "9cf0fbe085f8ce112bcf6efbbed3d2329d949b48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017433, "uuid": "0d4ddcad-d2ed-4e31-8617-18d0d3119ceb", "comment": "Malware payload (Mirai)", "value": "167eca688601258473d1792d6f7882a2a2a753b7f7af74a9e61bd436c9faf8090790679c7bfe9bbe5c6b9794efbe56ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017433, "uuid": "ed58dd75-bb13-4af5-a62f-0b1c64ddc3bf", "value": "T1FDC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017433, "uuid": "1b71def3-6197-4822-aa35-bb0f9dc24719", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoYrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIYrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017433, "uuid": "a3643dff-ee67-4835-8764-393e7f932112", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017433, "uuid": "d5a70d33-37f4-4a04-8596-0833f75d101a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017433, "uuid": "610c2f24-8075-4a8a-922c-fcf2887a939c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457cab0e-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045608, "uuid": "c04a4ee4-67f1-4bec-accf-1221fb90c038", "comment": "Malware payload (Mirai)", "value": "4bac103d26a560d9725c1409491893ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045608, "uuid": "8175f345-f3e9-4388-b90a-e73b886ea225", "comment": "Malware payload (Mirai)", "value": "deac67016555e26f43638b47f0eddb61337a33583555e1b4e0f4aa91202988a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045608, "uuid": "6111efc5-b80e-4950-a50a-323210f4ef08", "comment": "Malware payload (Mirai)", "value": "9b138d4920e2f84f067dd1ee203d6231a74ed550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045608, "uuid": "00e42016-1318-4319-a5f8-a65a4b0add11", "comment": "Malware payload (Mirai)", "value": "c4def547b69d2797297e88fc3aa662d63349a557618817d7e14f50191864a91b75e3ae62fb90908fe3220a0cb0d491c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045608, "uuid": "ca65a007-89b5-4ad1-9edc-b3e5e7f06bb5", "value": "T12FA35CC4F643E4F5E85305B1103BE7365B32E0B9112AF643D379AE32AC92652DB16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045608, "uuid": "56ec3af7-5460-46f6-9719-9d54a828c7ca", "value": "3072:YqRrQraDHgi2NVsgH+EaBtZ9XDPpEWYJ:YqhfDgi2NmNxEbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045608, "uuid": "14cced46-504f-4b87-b872-7b3b5ee6ff14", "value": 99432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045608, "uuid": "087fe821-9ad8-4787-a512-ac179e204f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045608, "uuid": "16717091-50c4-42b6-a4a7-b499b8717529", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad0473-124e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772026255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026255, "uuid": "c978b690-c034-4253-9ee0-2a13a7364b93", "comment": "Malware payload", "value": "db85a7d154e9967625c3e43d950b81f8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026255, "uuid": "ee855b87-870a-4f46-a76c-eb953106f2df", "comment": "Malware payload", "value": "decf0f2e6d42f5da6ef5f77954115e5cbbb8d68edab7151cf34d28a6d49cb9f8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026255, "uuid": "a371784e-f182-4f97-b66b-fa1e2cc10c8b", "comment": "Malware payload", "value": "9041e09bd753ecd395ba25666097e61c27b98747", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026255, "uuid": "1fc84d3e-7466-4978-8767-dad144bb6304", "comment": "Malware payload", "value": "7ec4bb3919675673e125a9e31a6abb5cc3ae553c7948c58fc2bd608a57481580cfb549a00b38da0688a9897332dee84d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026255, "uuid": "ed2f1e14-48df-45ce-bc7a-2b460418a518", "value": "T15436F046FB56AA7BC4F7433246769266613BCC668B83D6871C1C323C09B75D80F5AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026255, "uuid": "511853bc-dc54-4b15-964b-40e9abd63874", "value": "98304:t309Q1H+YGB8tuuvt0vvoslHBThJUeDbVV0R3ZRdwzfrEPIjSuyTDf4G:poTzuvqvv5FjJTD5V0RzXrPfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026255, "uuid": "11e3b153-273d-4518-bdc3-7efbdedea913", "value": 5053600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026255, "uuid": "d5d447f8-76a5-4d57-9684-670f3cd3f24e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026255, "uuid": "75c126da-bd45-4b53-8f02-a5277040024b", "value": "Mp3.indir.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba043745-1264-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772035925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035925, "uuid": "23a2fc9c-9079-4285-ae63-20f82533ea02", "comment": "Malware payload", "value": "b8a04bd450a0e75ef46c11ba49a5f354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035925, "uuid": "e06ca227-c070-4b15-8096-d2b7521d950f", "comment": "Malware payload", "value": "df1765629fd2968e5dab6530712477ed728a56a59310ad225d25eb046fdf357c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035925, "uuid": "0570ef3d-f402-4ce4-800e-f22ad037aca9", "comment": "Malware payload", "value": "e037a6e5f2e010f396932a0496549322f8d6ec3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035925, "uuid": "5564f0c2-4aca-4a1b-90c8-ada234dd7e00", "comment": "Malware payload", "value": "349c2983bffacf445e6e4e52647c886fecbb27b64cc16f0812cdbb82967a4a56abf35bf56111ec4924d38c32ee0dd6d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035925, "uuid": "589926e3-4fce-4a51-933a-bf94e4b5d15f", "value": "T199B533341E0131ABEF3F704A6A2E86DA7A45FEC3345CAA38484317AF5105B914ED5FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035925, "uuid": "da35e010-acef-4414-b7c9-aa0cf902432e", "value": "49152:kvPZwgMyltjd0cxCGz3vq9QceT7UbsDxFdrs6+RGz:kvqgTTjNkyTHDxbr9rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035925, "uuid": "46cdeb5d-ea55-47ba-abf4-766f99ca2eaa", "value": 2450924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035925, "uuid": "105d24dc-4c61-4c47-82af-920b9a06a645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035925, "uuid": "fc6c4889-9edd-4ae7-8d84-1b3c2d98fe24", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3865e39a-1214-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772001348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001348, "uuid": "dd3a6877-88f3-47f5-a4d4-d554246b8105", "comment": "Malware payload (Smoke Loader)", "value": "53cf1abfd7a879d4e07c0206a7e07cff", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001348, "uuid": "21d34e52-10d0-4f6e-a5cd-1a5c070db957", "comment": "Malware payload (Smoke Loader)", "value": "df439619042ff7816aecc863f5f7e7bc5f317fd53f2c2a16cfb3b058e2bb4160", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001348, "uuid": "8bb5e750-e834-4eb4-979b-2726fc7689fc", "comment": "Malware payload (Smoke Loader)", "value": "d9e77525bd213c443387a6af78ca294b5688921d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001348, "uuid": "5347649f-dd3d-42a0-bbd8-d8f5c7ac5e81", "comment": "Malware payload (Smoke Loader)", "value": "a4bbefa7855dcd7792559704e0608cd54f040293ae3b8475c8e19e48b96b7ed7ec3830c39df5b421f28a8fb4ed6d6445", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001348, "uuid": "749e6335-1344-44e1-ae5d-d2ea13539599", "value": "T11AA5060A6D87C8E1D06A9239E9A251FD7E30BC3D8B3263C71B407E783E726C65975718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001348, "uuid": "d23af9d3-a5d9-49b5-be02-2a7f048433f0", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001348, "uuid": "ead7e054-895c-4677-aceb-109bb09220b6", "value": "24576:Yr0ATXqsNYaF4PpHCdkeo65m9fOoAXtwx9AvRWMQYyiauPgSqvOWtP4XKe/Imskn:Yr0ALqsNYaF48dkep5m9fzvOgeQ5cy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001348, "uuid": "31c1e183-88ef-464f-822d-7a3d8449e6e3", "value": 2254336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001348, "uuid": "73bf2d8b-371c-42f2-90e7-5073ea58fee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001348, "uuid": "123bbb0f-07a4-41f3-8842-6aeb8c6697fa", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97abd52-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001108, "uuid": "07b6f1b1-4626-49a3-ba48-b6c60fdbbe31", "comment": "Malware payload (Mirai)", "value": "cd858ef9299eae60dde1e0965f74bf06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001108, "uuid": "028f1246-efda-433f-8111-eeed1c4ed568", "comment": "Malware payload (Mirai)", "value": "e08aacd394091643252d6d17d55caf86155edc34409d638ed149f63f4beec148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001108, "uuid": "09a037ca-28cc-4397-ada5-ea38f0d68c6c", "comment": "Malware payload (Mirai)", "value": "6672b288efdadb7c171dabfb03717c2a715575fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001108, "uuid": "82dbb7b5-1748-4b7b-a076-fe08a8a85b96", "comment": "Malware payload (Mirai)", "value": "bc4410b036469398a89b85cc821b9b3b7a4eb58eadeb83ee9303028b87f2d88327fdf9d31713f4395469f01f4d2a70cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001108, "uuid": "6775c13b-ef2c-4bf8-afbd-4f93c2c38f68", "value": "T141C35C1775D180FDC8DAC1B49FEAE226EA33B4295138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001108, "uuid": "366acfce-b4c9-47d5-bf53-7359c31f422c", "value": "1536:UHAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK36:UgFmSmviqS1Bs0+Nd6lAqktNMxSNbm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001108, "uuid": "dd5b5be2-b23b-4fba-b2d0-2b310b047fd6", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001108, "uuid": "2a9c8709-fe00-4ddb-b59d-496578228dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001108, "uuid": "bbca3bfd-2356-406b-9e10-f88970cd9b28", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf543b1-126c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772039096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772039096, "uuid": "637c02e2-44c8-4629-ac5e-67800c397aa3", "comment": "Malware payload", "value": "95a4e786dcd084b0be5f6f4e30b82129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shrt", "colour": "#127C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772039096, "uuid": "f4323c5b-71d2-4f4f-b0e1-117d242721db", "comment": "Malware payload", "value": "e1201ab8925e3a89bf842ecaab68c3faba5d85b113b42fb05aae687d9dbfb251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shrt", "colour": "#127C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772039096, "uuid": "8a671a6c-22dd-4609-ac82-633a236b97bf", "comment": "Malware payload", "value": "020ef7b1aca1e8d2bf49d4da5700a0cbc5be7a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shrt", "colour": "#127C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772039096, "uuid": "a278038a-3424-406a-b6ea-0d2e5aa9a938", "comment": "Malware payload", "value": "eac1ed2c31cdda3980796bfac1cc8a42f6ff8a092a6ec1d2c67dc99b02b1ef5e4a5bec402d51679145e1c28970ffc5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shrt", "colour": "#127C36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772039096, "uuid": "fa8befdf-e3bc-4534-a546-016ca639415f", "value": "T146747D19FBA504F9D567C578C8524907EA727C4E07A0EACF23944EA61F236E0AF3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772039096, "uuid": "6885aa26-9ab7-4515-a886-d0a420c5eef7", "value": "dbdeaa31012826f10f1b58903873f1c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772039096, "uuid": "30c1e0c8-0abe-4338-82ba-ccf9b38cadb5", "value": "6144:Axgqxi2Ah+xe5T8fO05JX2Qk4yELfo0jnxzY:3miSxeZ8GGXfk4rLfoMnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772039096, "uuid": "a73f60a4-360c-41bf-82b1-14ebe1397c6a", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772039096, "uuid": "7d715a5f-242a-43a0-a610-96ca2c7fcc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772039096, "uuid": "c80626a8-9c47-423e-b9e3-52ac2e04296f", "value": "Encrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85e1490-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034633, "uuid": "c0040f3f-4e4a-4bf6-9035-8aea303cc854", "comment": "Malware payload (Mirai)", "value": "624cdea9d4039b2357f5f0f9c9ccc90b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034633, "uuid": "e8015492-c08b-442e-b2ab-84864b56fc13", "comment": "Malware payload (Mirai)", "value": "e16bf3a40902e28dc7822ab3b16371dbc9b2177dfa5218b0c1be694711a722e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034633, "uuid": "cc13f9bf-41a8-4a8d-95a6-6c5aebed8063", "comment": "Malware payload (Mirai)", "value": "fd8e6429f47f8f00b842053a86b16446bfa2795f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034633, "uuid": "184f7caa-9a8c-42e8-9f9a-0c1b98b96625", "comment": "Malware payload (Mirai)", "value": "1b8b388e876d38e398756b4316733ae9f7a757217a0ef5dc4ecdc7826e6e28fd712564ecb7cfe1702082d372b7dd52a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034633, "uuid": "87fba0fb-50c2-4cc3-a9d4-a48a75eb8be4", "value": "T1E363B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034633, "uuid": "79cbd90a-5923-41a7-8d2f-ad4c41583912", "value": "768:bPWek0n4CjdGQKKWxmg0EhFkFkeYA+Qo1dXyApGqFDjOZ2uyyQ5NeNTP4wnbIZ:bj/hSmmjAo1Fym2Uu6eBPZnbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034633, "uuid": "9b3191e7-8a0a-4a46-8999-993306ee8331", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034633, "uuid": "16aefe95-bfdc-4818-96cd-e8bd311f58ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034633, "uuid": "2f558dc2-1292-4c33-80cb-cfd554e738f5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a25176-1231-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772013954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013954, "uuid": "c597b075-471d-4836-833a-7b53fba2e8f1", "comment": "Malware payload", "value": "e53c4410d8c4eab255f0ad4c8fc2bca7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013954, "uuid": "4fb41a3d-ecf9-4275-b62c-7b47c5276a60", "comment": "Malware payload", "value": "e1764a57275e778eb5f0fcf06c325de639fa8baf47f46ffb23c56e93dd985047", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013954, "uuid": "722145f7-1083-4a27-8579-7360dd552e5a", "comment": "Malware payload", "value": "e7ef7740ed9ff8c9bda83ceb25a3539529edcfe6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013954, "uuid": "848204de-8135-4e09-81ea-4d5681c0b559", "comment": "Malware payload", "value": "3ad678ee045031a70dfe5428c76f353f77354ac188e3809e9a06934fc8ae85e2d4a893757475d9a03a4924ab44f82fdd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013954, "uuid": "04e3b169-8761-44e3-a837-804c3d2bc6bc", "value": "T117069E16A2B500ECD0BBC27889469607D77278550335EBEF56E08EA22F23EE15B7F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013954, "uuid": "ea988cbf-3a43-4c06-a220-af8213997263", "value": "af0c845503178cb230674faadcc961fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013954, "uuid": "030139a8-56a5-4333-8e12-f1ad3e518275", "value": "24576:Coij9wqn7meRNGKda9Lrc5p8JruwnFHtR7XI:CoowqnfN/grc5ppqr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013954, "uuid": "5f912c74-cd08-4d1b-9e91-43c727f7290e", "value": 3757568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013954, "uuid": "89796884-113b-40eb-be49-1b761b8eeaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013954, "uuid": "5ec121bf-5ef7-4d77-8c9e-b613cbec1426", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900d408e-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013091, "uuid": "c1ef7fb2-8999-48c0-b821-dfa08d2f9e2d", "comment": "Malware payload (Rhadamanthys)", "value": "bfb8ff2b45084bfab6322ec57a947bc9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013091, "uuid": "20cd4963-2a77-4241-ad5b-4d0f0b6c844b", "comment": "Malware payload (Rhadamanthys)", "value": "e17e15d980d539aa4987e492a382fdefaab5bd7893f69b9b144aad2986dccc92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013091, "uuid": "c85d9756-06ec-45b5-80d0-8d61965b01d9", "comment": "Malware payload (Rhadamanthys)", "value": "c86860492bc4c65185838a0870c80dfc404e013c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013091, "uuid": "dba56dfa-8c04-4834-bab3-a43a288da178", "comment": "Malware payload (Rhadamanthys)", "value": "8fd25d4a47c88f21e86f942b14a37cfdd19d3929ff70060b9f044d2f798ad86ec4f4d6815a9ab0165186417fb2150201", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013091, "uuid": "c4bc5f40-9760-4dc7-bbd4-667e4b214eec", "value": "T1D4A31B08FD3F29B071DAA0A54E8660F78F0F4D9F80AFAE051962BB00E359F5D5D491DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013091, "uuid": "0a9e55cf-ef93-4885-87ab-06167f13ccca", "value": "1536:GDB7eKg20DgJjitSBtYGSyBhkais5BdbAd8x3X1cO1hSwBv5KkrJM5SRrc0l/maR:GDB7b0DgJjitSBtYGSyBhkais5BdbAdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013091, "uuid": "c9f3ed71-cfdb-4326-be4d-85af0a2fd836", "value": 98183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013091, "uuid": "77e76d45-1470-400d-bba3-98e6d10b4100", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013091, "uuid": "3875815d-7121-43d9-ac6e-6948fcbe45b4", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd0d9f0-1261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772034639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034639, "uuid": "d3e99a18-f6ac-4fb5-bb35-7690059f3773", "comment": "Malware payload (Mirai)", "value": "322d913c1791fc36f592f338f6405762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034639, "uuid": "b1a48fd6-b585-47ef-801b-f26696f3e635", "comment": "Malware payload (Mirai)", "value": "e19bf7bfc98173716d48e3d1c5c5a0e1cf9800ef545ff56f83936072a36bfc37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034639, "uuid": "e77f3215-fc37-46d5-9ee8-4071cc41a674", "comment": "Malware payload (Mirai)", "value": "bef10b07643fba9568271a7457c183ac0c52008f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772034639, "uuid": "83f76fe8-80da-457b-af17-470bddb3205d", "comment": "Malware payload (Mirai)", "value": "b6f3b6bc1292c1c991ff7396fc04389032364797575ffa71dc399394851ac722df99bcc2efec6d1fa07849bd41c4f542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034639, "uuid": "e8899382-712a-4f46-8fa0-4b948a05cca6", "value": "T14F630856F8818B22C5D5027AF92E118E332357FCE3DEB2229D206B2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034639, "uuid": "7d8aba22-32fb-4e64-822b-f1a8d47a7d50", "value": "1536:tpnqh/sOR5YbAP+uppI4NEgeaanA1z2ITiE8p2+lhyS5bYona:K/9R5MEffam8p2+lhySRBna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772034639, "uuid": "49ae205e-e912-4e70-bf39-dd2c947cc313", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772034639, "uuid": "d0c584c4-679d-4247-ab35-8a6aa007e3c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772034639, "uuid": "4b46db05-2f5a-458f-a26f-2707530577e9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6df756f-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012753, "uuid": "be842be4-e05f-4ce0-a19e-ff1de3f0ec03", "comment": "Malware payload (Rhadamanthys)", "value": "5912e57ef33eb273d2c29dec968373d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012753, "uuid": "ab7b67b1-e9b2-47f7-9062-bda6706592db", "comment": "Malware payload (Rhadamanthys)", "value": "e2d59ef2af1eaf5e0bb776fc8f5b7a65192d379e4d2b3efd2979bf0286998e60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012753, "uuid": "5e8f083b-eba1-4e78-b64e-5e8339c8933e", "comment": "Malware payload (Rhadamanthys)", "value": "bdd29bbbed0b977761c83fef658fa7c513546856", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012753, "uuid": "b8778a7f-19fd-4db1-a29a-9403f105c803", "comment": "Malware payload (Rhadamanthys)", "value": "ae6f65ec207f13bf43e924c09158640b483423e280e26d57cb328236f6c64a0e48358e92e8397fe59494dfcd4eceba9b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012753, "uuid": "9df39f8a-39a6-4e61-87e8-871b0ed1486d", "value": "T182A3E9087E33EEF13915F6F182450DB4A896CA5A14EE48EE039973E37539A5F1490ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012753, "uuid": "99aeb5a1-7484-45e6-a913-9dfe2f731034", "value": "3072:GDB7b0cbG3BEB4S+NYWL2Zn4IXULYwUXONqQsLWvoWL7fLLAePiOsX46BkQWkp:0lCV/FgWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012753, "uuid": "7f125c1a-7316-4438-9ddb-74e02d12ed5f", "value": 102630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012753, "uuid": "758d9ea8-9eae-4119-b334-52692ea5e992", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012753, "uuid": "84c24315-b365-4b68-a45c-68e2d8406864", "value": "invoice-1637482117.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07361756-1236-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015868, "uuid": "d23c973f-94ef-4d58-9f18-f96b803b6683", "comment": "Malware payload", "value": "458874956ee0a556cc0f78d7c99bc06e", "object_relation": "md5", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015868, "uuid": "17df481d-ddc0-420e-b73c-d6e0497802b6", "comment": "Malware payload", "value": "e30375148a96c4a0524e6a5ccc315bbc20f0e3700dcbf1b2ec27bc243169aac0", "object_relation": "sha256", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015868, "uuid": "d491a1b4-8eb2-4c4f-be98-87d4d1a5ad8d", "comment": "Malware payload", "value": "392ea70aa199461eef24f31090875b0e55649d96", "object_relation": "sha1", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015868, "uuid": "d8a76da3-598b-4b58-8bf0-c2678e0fd589", "comment": "Malware payload", "value": "bb85ecf9b3e5358a51d2f024231d1fa2820b692faf8a3e9748de0bf2bd1a09c8303d7ec87a33a29b2f950d5910a5ac1a", "object_relation": "sha3-384", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015868, "uuid": "dd18f884-6a16-49f7-ae23-484ddc81dfd9", "value": "T1F8511E3F6D26C220B311E26D417E892C8692F11B30029851B45CB88DFFFDA258A702F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015868, "uuid": "57d8b70a-6028-4c1e-89c5-3dad420f1192", "value": "48:3KO6hEsUtjwatfum4AWSiiV6L8Dwxrj5lRImiBOAum:3K+D8m4X6SZxLAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015868, "uuid": "83427209-7f99-400a-89c0-53caa1eb1846", "value": 2487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015868, "uuid": "44c8b0a7-ea16-4a12-870f-5a4d283674fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015868, "uuid": "a43960de-3a1b-491f-83e1-e896387b40ef", "value": "update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd19ad-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003071, "uuid": "8cd59a88-abee-4e25-a27e-e9933989e9b5", "comment": "Malware payload (Mirai)", "value": "ba5b00bad9a8bc5a20ca00f9567715ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003071, "uuid": "86f7af5c-d38e-4a7d-8374-8fccb61fd1f3", "comment": "Malware payload (Mirai)", "value": "e3140cc9dc1348c3d4d7f0e76211d5411083cf649c9ffd88dc2969e55d9f7b6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003071, "uuid": "0f87cf8d-509f-45f9-bb4f-772998e6d3bb", "comment": "Malware payload (Mirai)", "value": "347091a445038130c6a623852fc0cfc5139d5824", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003071, "uuid": "48556401-f87d-4c35-8e88-796da2b14b85", "comment": "Malware payload (Mirai)", "value": "8360ce67e1fc848fc57aff700a8370d1a4356ffe29bec3384100a00e73618e0c564fa8f55422a403b319fb4b39e1f1d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003071, "uuid": "8f3ada55-3842-42cb-9ef1-ba8cdb1f3489", "value": "T1F7512AC541D40FB41C636B77EAB6416C33C6B6678CE1ABD5D9E4BBE0824EE5039407A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003071, "uuid": "2d21ef43-0046-4a5b-9aa3-323241ebf128", "value": "48:vt7u7N7htX6GtgfzPtHKWtZoUt7Z7o7Utf83bt+9Rt1cgtSpVtfSOtD+CtMfTtUm:vt7u7N7htX6GtgfzPtHKWtZoUt7Z7o74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003071, "uuid": "a6704116-09ff-46ee-82ed-2c21255bb294", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003071, "uuid": "f0536698-73b4-4a6f-85bd-380f938c7141", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003071, "uuid": "3c93a4e8-974a-4062-9627-c1324408e58c", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd2208f-1288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772051497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051497, "uuid": "68dc19c4-a6cb-45be-af4b-3eace23b0053", "comment": "Malware payload (Mirai)", "value": "7ba4a051265556c937fb2a608307de2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051497, "uuid": "459d5d41-7a1a-41f3-b5b5-bf4bfb748f16", "comment": "Malware payload (Mirai)", "value": "e395388f10b8a59f543148d2f437fe5a5bede0dc466ecb6b49c67e52e6a2ba44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051497, "uuid": "4570e312-c3b7-4fd7-ad67-8c9319b30163", "comment": "Malware payload (Mirai)", "value": "32eac20744635fb035ff5e12664ced6f2dca3bcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051497, "uuid": "6bc95e08-b501-405b-b88c-6852e0bdc1b5", "comment": "Malware payload (Mirai)", "value": "522f1dc8ff6c2b5dc3d94076519d26db521b1c6ddf958cb89261e192e5132d5d9e190f69edd4eca51eec40ed1fe321ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051497, "uuid": "9c9acff3-9608-4c77-849a-0ff5fb4a1909", "value": "T160B339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051497, "uuid": "feee2665-7157-4dbf-92d5-ce534e168f91", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wezSr9bMFflD:Pbj4doYGFB0/45gdu9ulD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051497, "uuid": "9b000d1b-a1fb-4a3e-9fed-e1066eeddf07", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051497, "uuid": "18bec122-94dc-4cdf-9ec6-6f1e763efed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051497, "uuid": "ce1bd0b7-f97a-406f-9f57-72da9c1e40e1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0d329f-124e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772026533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026533, "uuid": "e739ddcd-bf8f-493a-995a-e41ebd2976df", "comment": "Malware payload (NetSupport)", "value": "3cddcb5275114088c9f23f41526cea1c", "object_relation": "md5", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026533, "uuid": "5ffa0ddc-c490-4312-93ce-7ceddaa735ee", "comment": "Malware payload (NetSupport)", "value": "e435c890f0f102a307617b52d46e1870f2a1667b97390ca9b4cf3cbc20ff3ba1", "object_relation": "sha256", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026533, "uuid": "29bf35c6-d95d-4fd1-8daf-9a0d1b1b0974", "comment": "Malware payload (NetSupport)", "value": "25ef21654fa9c71441b54e132af39a2d627de00c", "object_relation": "sha1", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772026533, "uuid": "cbd01876-52c7-48d1-8d02-8fe248151c3a", "comment": "Malware payload (NetSupport)", "value": "bfdc562a68a518e0aa4039e5c41a4d374e320972bcef952cd9d05c03fd526a56b99ef0904fb05bee5e23dd5f442bf9f0", "object_relation": "sha3-384", "Tag": [ { "name": "85-90-199-11", "colour": "#AE5D30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktoto-xyz", "colour": "#7391B1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026533, "uuid": "cd3ec936-93c3-4f9f-9df7-c91a9362d2f6", "value": "T1D0D633A0A6E815FBFAEAD33DC85194A1C89A75673B49C193C3F8C5A12C733C4693E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026533, "uuid": "41d290ea-4f40-497c-9c88-c6f5267a6b29", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026533, "uuid": "37adeb37-9e39-4fe1-83b8-88885aa800f6", "value": "196608:s14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorMPNurH/P/XRLSq2KKeF:s14FSsFl7dCR1C99/LkuxFuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772026533, "uuid": "713af5e0-9faa-497f-b298-c3aab57de391", "value": 13415160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772026533, "uuid": "00a099c7-e7aa-467c-bd42-25df07598e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772026533, "uuid": "fbdbc2cb-22a3-44ce-bbc9-bd3f146b8988", "value": "e435c890f0f102a307617b52d46e1870f2a1667b97390ca9b4cf3cbc20ff3ba1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bca009-1256-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772029933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029933, "uuid": "fbf09af4-e645-4c3d-a07d-14a0b9e87383", "comment": "Malware payload (GuLoader)", "value": "5d972d569d60abf2f2b64e411b8ebb4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029933, "uuid": "30a9bb8c-03b2-4d32-9c80-64f1104da048", "comment": "Malware payload (GuLoader)", "value": "e4f54ff410d7e80030d2343b32c13a1e25b7c1049824b2d0c3b34c0370651232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029933, "uuid": "b5d5a8aa-7592-42d7-abeb-5c67f30524f2", "comment": "Malware payload (GuLoader)", "value": "1d6a16c7295dd3a2cd6310efa3eb94d8770e8707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772029933, "uuid": "b905f991-7f7f-4ae9-af8e-0c1a4579541d", "comment": "Malware payload (GuLoader)", "value": "efe2a4d533e690d496c377f4f46076d59c9afad224b3b30efe70f0d921953b0b543bc7dfdf591f5c270b07b656739a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029933, "uuid": "5f7ee5da-599a-4aad-bef4-cac30345c256", "value": "T1C4C4234427F0D007DD160DB192F627A2EEF4E72629B0CB5FBB51D61C3E122E2651E399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029933, "uuid": "6dafb7fd-ec63-45db-9854-b834ec5081d1", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029933, "uuid": "75eadac6-66cd-4a45-a396-96b958c8c6a6", "value": "12288:c1yDJv8xC9DnfZSN0RQvvSpmCKnzxyxlaA0O:c1yDJv8o9jfZvq7xyxlaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772029933, "uuid": "2390ae2f-13d9-48c3-a60b-631ddd84b53c", "value": 550320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772029933, "uuid": "1a6bc429-8153-4695-9228-ffa955bd051b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772029933, "uuid": "cc214d73-2212-436a-8057-c0edd933c8f5", "value": "\uc8fc\ubb38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4d3ce0-1235-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015531, "uuid": "0dba0aa5-d9b9-4ca2-a729-22dfada38c45", "comment": "Malware payload", "value": "31a6c0b72a20087b76cbeed4a30aa66d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015531, "uuid": "1ca8a224-4211-4586-8189-7a73ab71968f", "comment": "Malware payload", "value": "e56d048452fe8c93810650d582296c597c6c942cac7003ca3223319b3d1ba79a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015531, "uuid": "c42e92fc-58d0-4cba-bb56-52b57c4c8ead", "comment": "Malware payload", "value": "fc026f670a8a3bd5fc327a373d5be356ac873c11", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015531, "uuid": "cbfc593a-dce1-476a-859f-e7462bb5985a", "comment": "Malware payload", "value": "44b761c098e4bc7df540e574c69e303fb87fe92d7673b84ae34df420f2a304131f2dc944c64cbe11812cf14339abd0c0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015531, "uuid": "a26c270c-4ca6-4fac-83be-755c56bfbf53", "value": "T1F8D02B7786725618CA71C045A16943D7B5DA102B40AEAD2501F9041476B1AB21B5483B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015531, "uuid": "b6c290da-366a-4c24-b9f4-2a7466d64d8a", "value": "6:IPeGgdEYxDOr6RLh8JScMGixkRIMUsaApylwDOrPrOMFswDOrPrv:ISu2OWGRMGiexUNfl0ODrOMy0ODrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015531, "uuid": "48d376d8-5025-457a-949f-35dfb2fd355d", "value": 281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015531, "uuid": "ade62d7c-354d-47b9-8824-2ffa0dc46df1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015531, "uuid": "cb0a2fc9-77d8-4282-a086-d4a2d06666bd", "value": "setup.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1745c3-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772013061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013061, "uuid": "36fb990e-c3be-4688-bd48-1e45969dbe99", "comment": "Malware payload (Rhadamanthys)", "value": "4e3284e1089bf827701eb1c2d0eff626", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013061, "uuid": "62db25b3-7062-41ae-bb73-d7ce1bc627ad", "comment": "Malware payload (Rhadamanthys)", "value": "e592c6f612272769c98bf4cbe711b23150ba93ce575a466bececfdce3ab3fbce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013061, "uuid": "2e08222c-1cc2-44a1-873f-cb427289a313", "comment": "Malware payload (Rhadamanthys)", "value": "022ee377e8a9985d1935c1ce943e7f84ba9d1b01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772013061, "uuid": "ee58ad49-8fc4-4360-bb15-f946298dc869", "comment": "Malware payload (Rhadamanthys)", "value": "f64cb44bf4cfcbfc4e7caa03f8f335b07f8f5ef5104768539ce43088de38b40646fc175f32bed35ca32c2288a4dae031", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013061, "uuid": "52bcf335-9f72-4b5c-a84c-c0032d808c09", "value": "T1B4A309287E314E7B2384F3D07E2679F09F367D08EC49A5BBC05A376359023614975AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013061, "uuid": "fd030b92-1ef2-401c-bbd0-e4d68c474fde", "value": "768:GDhd0i7J4sYKgY/CMNfWdIZrXC+rU444HufAF1UfTY1SLAuAAroQW+FF+Ec+0FO1:GDB7eKg206rjrU44/fAFqc6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772013061, "uuid": "9a95de46-e228-4ce8-aaaf-ed52311457f4", "value": 99435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772013061, "uuid": "4d075f4f-27cd-4a56-8fd0-d55eecc19c87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772013061, "uuid": "7fa86396-fe5f-4352-8f8c-54c0f9023383", "value": "invoice-1637482117.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a0f49c-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001101, "uuid": "3e337165-b82a-41a9-87b6-e9bcbdae8831", "comment": "Malware payload (Mirai)", "value": "698dbe462a841b6f26d60bac4d5fb256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001101, "uuid": "9e78a596-7a2a-458c-8bde-7af35d3b40fb", "comment": "Malware payload (Mirai)", "value": "e62fb431f629a2237769068064f7d01c932a3b467581b2dc99ac807f3542f999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001101, "uuid": "24a20d66-a020-400a-9b1a-759c0b04e369", "comment": "Malware payload (Mirai)", "value": "fe155608ed1594f75afe8a4a8789a9c3fb781545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001101, "uuid": "a3f9e657-c333-411b-bf0a-977a5e5a7f24", "comment": "Malware payload (Mirai)", "value": "ec27399dccb162e0bea6785bcf9f0b00a6e7392565195bdb5779b733208c0cbf0a7b91264c95529aefb595becf845ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001101, "uuid": "c6255d10-25ab-481c-b82a-c6059e68a072", "value": "T1CBB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001101, "uuid": "a9006302-1668-4274-ac8f-98e13f32519b", "value": "1536:p7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCx2:lzPqF41OUBljSIxecUtCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001101, "uuid": "afcba18e-3f2b-4438-a3c3-53fe65d9fd99", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001101, "uuid": "03210eb5-abaa-4241-b822-05d57d2759f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001101, "uuid": "c9db03bc-2c7c-474e-a965-ad9b58fac966", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2375430f-120d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771998306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998306, "uuid": "9e5c0a4b-9bc3-4a90-aa8b-6927faf1d338", "comment": "Malware payload", "value": "355d6c898d25a33b132d46707f88e48d", "object_relation": "md5", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998306, "uuid": "5a28fd43-7046-4212-ade7-6c1c1322a12d", "comment": "Malware payload", "value": "e64ea07de3fd1b995c122287c1107eb44d0f887b08f21d8dfa84ecccbfc57295", "object_relation": "sha256", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998306, "uuid": "b447aca9-349e-4848-8adc-06cf425e8239", "comment": "Malware payload", "value": "dc785be0c4430bfc5b507255f892bf30134a02b6", "object_relation": "sha1", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771998306, "uuid": "ab0201df-c68f-4efc-9710-a4467e5ec965", "comment": "Malware payload", "value": "490ffb7678acc2c086586e49b54a0a9c5a90ba98311aa470658c130956ef36fbdb073ca10ba9e87f917dcaa90417fe42", "object_relation": "sha3-384", "Tag": [ { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998306, "uuid": "a3199478-84f0-4018-9846-cbba9ff81355", "value": "T1EF1602A0D55A8B92F063D4BC61D4B9D204353E136AD80CE1E37F2A089FBF8B66655F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998306, "uuid": "6dd2db93-3839-4ca9-99bc-2761be7fcd23", "value": "49152:+Ce8URnPYHY43saSkleDFvCH1pjPh4ScRbI0/JP38Gw4jMXhku8Wx0y+tOonhBWV:+CePRffvlEFJ4ZbIoJADxMFlhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771998306, "uuid": "b0a920cf-3eec-4296-bf39-e86805e1aa81", "value": 4042752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771998306, "uuid": "6ac4ccb0-f21f-4223-8463-80b6d428256e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771998306, "uuid": "8f3f1335-610d-4b21-bdea-e02f51678395", "value": "e64ea07de3fd1b995c122287c1107eb44d0f887b08f21d8dfa84ecccbfc57295.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744c4e15-121f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772006172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006172, "uuid": "c251bdc9-5fb8-45ea-be63-611c439b1c95", "comment": "Malware payload (Mirai)", "value": "5ff850ead43180ed141e28745e2c427e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006172, "uuid": "b3be4370-3299-4e7d-86b3-30ef82439aac", "comment": "Malware payload (Mirai)", "value": "e7c427b7a4164bda25f899fc73d482dc3e80612812fd78975af3291aa351a399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006172, "uuid": "c9b6a4a8-b913-4aef-9a85-de8c17b9de1f", "comment": "Malware payload (Mirai)", "value": "3644c084b987691c76b771ff827246223c52063c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772006172, "uuid": "8de9aef9-eb97-46e2-aa8a-29fd5c6c6afe", "comment": "Malware payload (Mirai)", "value": "ca5173d98c92484c6c4167db80824387d779848476b556840ddc03358057e8841c74b43c1ba651233cf12bb20ab7ae60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006172, "uuid": "e8aa0b1b-2f2b-4e79-84f3-b513c70491f5", "value": "T16334B70AAF610EBBDC6FDD3706E90B0625CCA50722A83B753674D518F55A90F8AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006172, "uuid": "0098af89-7b7c-47d5-abd6-f601347553a0", "value": "3072:QfY8QzQ66Mrbe6W+eFdksJYr1XZMIpX5qAmtxVFY8:cY8QSMraT+eFd+pMIzuPVFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772006172, "uuid": "f93baeed-416d-4be5-8ee5-2c45306b3fd6", "value": 240908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772006172, "uuid": "8c1ed4f8-19a5-4a46-99d2-9f4b2af37f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772006172, "uuid": "c0caaa87-7a4f-4204-bb95-af366dc424c1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6239c-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012778, "uuid": "341ad4a2-508f-45aa-8d7f-42f5cb8dbfc9", "comment": "Malware payload (Rhadamanthys)", "value": "411bd847299d6520a49eaaac920b1d08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012778, "uuid": "3538faaf-5e74-4143-b047-882045a3393b", "comment": "Malware payload (Rhadamanthys)", "value": "e881bb3f407c05adfceef1d8434223f853f28f7fe8213970927faac1c40f529f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012778, "uuid": "df89405d-ca86-49fd-abc3-81c553418ec4", "comment": "Malware payload (Rhadamanthys)", "value": "c246ff3aa958640872aa1e8541d57df12d80478f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012778, "uuid": "22920924-5cd6-4379-a7f2-56de2b62b1c9", "comment": "Malware payload (Rhadamanthys)", "value": "b514fe5a5c1f3234bf2c6efbe61c21ae349fa35e8e65205c65d3655e1f92dbfe0ee4db792e35635e355b2e6edf249aa4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012778, "uuid": "48fe0455-4a4f-408d-a78a-986b50977b82", "value": "T17AA3F9849C96CCF8380D19545E9516A4B462AFFE6027C248DD8FFFB13286A5DB9D00EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012778, "uuid": "40705ac7-036a-44e1-929f-1c69e6e20a08", "value": "768:GDhd0i7J4sYKgY/CMNfWdrI++piuYXAFWXAR0aE0JATTu0i5iods7DFLzEzHEY0+:GDB7eKg20YrFrmK7OxA0GM6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012778, "uuid": "a541c631-4aba-4dc2-b8af-31b7577482ba", "value": 98124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012778, "uuid": "3bfec92f-eed9-4763-8823-cef0d521cb61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012778, "uuid": "43f26337-9f13-491b-8f78-60d7191432eb", "value": "invoice-1637482117.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9f3f10-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1772017405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017405, "uuid": "79be807b-3e9f-411d-86c7-f2c95a55a657", "comment": "Malware payload (SimpleHelp)", "value": "fb6eacf544740ee359cb647e62cc4842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017405, "uuid": "f1b09e64-95e7-499c-8802-720bb4ed5499", "comment": "Malware payload (SimpleHelp)", "value": "e9431c3deecc137d04c87b1308a0ec2cb9bf35eddf862c6cd207b0fe7b5b1388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017405, "uuid": "310d269c-3df8-41b4-84ad-50331a57e643", "comment": "Malware payload (SimpleHelp)", "value": "b0f97074570e389abec7b6e2958a7eafddd95970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017405, "uuid": "4c22aa44-0104-4905-8be9-eb5678a3f094", "comment": "Malware payload (SimpleHelp)", "value": "c9b7aabcd9ec1b2211829bb21e09135bc1192ff26ad558cfe01b553849751ad1ebaf0020813fb304d5a9e53117373465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017405, "uuid": "9c5eae84-5074-43be-89f6-bef7f8463dfa", "value": "T13987331AF39599FBDE33D0FCC0854447EA9678E54381422717F085EA4E606E98A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017405, "uuid": "f6eacb36-f82b-4958-9c2c-9eb714f3859d", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017405, "uuid": "1602a151-def2-4bcd-ad88-0748d2b34fb1", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bV:/uRf+nAu2FuQd73XyFeDMnKTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017405, "uuid": "0325ed6e-3fcd-4a2e-bdb5-09c1aa052393", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017405, "uuid": "e11d04b8-99d9-4e08-ae9c-897e8f2023c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017405, "uuid": "c0cc62ea-2319-4e5b-83f6-a7b604a30648", "value": "doc389l47.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fbe7b6-1288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772051494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051494, "uuid": "40cbb32b-f589-4d7c-a2f5-4dddc503e5bc", "comment": "Malware payload (Mirai)", "value": "bf71fba11680b96b155420c86f96f2ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051494, "uuid": "5ff7c307-bbd6-4e64-b3ee-bcf4dac55595", "comment": "Malware payload (Mirai)", "value": "e9d5e51b1359ed88bc183e1992c85e5b8cb38ed30de377e1fd9e5e2257d2dc29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051494, "uuid": "ac0d5887-77c7-40dc-a755-a98c7c786954", "comment": "Malware payload (Mirai)", "value": "1c882f28d3d7bb47d2ef46ee5fa98454b032a4b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051494, "uuid": "3ca3c480-11d5-4a2a-8def-ed0e7955920f", "comment": "Malware payload (Mirai)", "value": "7f6453406a37a8e221857cb48db5e3ab6aa4c4feb99064045f999492c0cc4e67fb56b32f36a0d7063267a14641317ad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051494, "uuid": "c034894b-b3c5-4f00-985a-041e63842aec", "value": "T1B7040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051494, "uuid": "15ab9032-e434-4756-8022-a68a93659abe", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKFLYV0fCtZ1SD39rsJzjM9fx49SY2p:t3nEr5dfHPq7UTo7FsvR9X0l6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051494, "uuid": "777cee83-8825-4d20-8cd8-482eb51089cd", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051494, "uuid": "48620fd3-55cd-4852-bbd1-b0ccbd6fb126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051494, "uuid": "60883f09-3ed4-4555-8373-0f8969016bdb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ee4474-122f-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012918, "uuid": "7a0aa790-b05a-49cf-9c39-845515ca998b", "comment": "Malware payload (Rhadamanthys)", "value": "9e1078ba7e6c98430d6b559d3f645c4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012918, "uuid": "24f0b8c8-f1af-4d34-b4f8-b9e37eadd214", "comment": "Malware payload (Rhadamanthys)", "value": "eb4c2da543e4709a63ecf689ff15e84c910706e7fb1a948e163b5e77cdb04888", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012918, "uuid": "bc0b5196-05df-4473-a0d3-249855d58c6f", "comment": "Malware payload (Rhadamanthys)", "value": "a791569f058f6f7e3459164d3fa8844f204535e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012918, "uuid": "1a3ea839-4a38-43cc-977a-dc771cd5c35d", "comment": "Malware payload (Rhadamanthys)", "value": "4b3e229b70326c7d6f8ab7278faaeb97818bd80cf7ab28ea865ddee60273ac856eb81ef950f84cefa06adbb0e6e64320", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012918, "uuid": "2aa6e317-8200-4ced-b460-e6f1253062d9", "value": "T123A3FACC8726DEE30716159D3C841DFCCC0394B4865084F46A9EBBAF779CE657AA4E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012918, "uuid": "d335788c-f3a9-4422-a415-93beb1cd70e1", "value": "768:GDhd0i7J4sYKgY/CMNfWdcHk/nkd1TvEiQt9BXDBjwrIi8vY84u5KRd6V2H/fIHX:GDB7eKg208rzrCE6fQAH4J6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012918, "uuid": "c21b308f-526e-455c-a1f3-6b50a0fb7f48", "value": 99498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012918, "uuid": "51fe1f3f-d841-41de-ac58-e0e04bd55f89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012918, "uuid": "8ffac6f5-6cbd-4639-b81c-b3ad050a6ea7", "value": "invoice-1637482117.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7db9a9-1213-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772001083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001083, "uuid": "2f0e9289-3f41-4bdd-8737-0037219264ee", "comment": "Malware payload (Mirai)", "value": "c7b7dba462351fba0ca312aefa8de29e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001083, "uuid": "65200d4f-77dd-4206-9a96-faee2d4df61d", "comment": "Malware payload (Mirai)", "value": "ebd0f4b199ef35e23850d170d92436058e7beb3fd4a37291e0c4304dcd96564d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001083, "uuid": "157469cf-2a18-4794-bdaf-cf1720151588", "comment": "Malware payload (Mirai)", "value": "ec1b254ac9a2ef39d152dec881b7592b88938187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772001083, "uuid": "1b77573e-83ae-4176-841e-00fd2c02d540", "comment": "Malware payload (Mirai)", "value": "658fd376e317d10669b21e91e8406bf12a050491eeac6c06522bc9837bbb6fadaf82f26a0d74377cfb8836ad914b51b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001083, "uuid": "0837e317-f853-4129-843e-0d4b7b36a2d8", "value": "T103A328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001083, "uuid": "3378a49f-0b16-4d64-a9de-9d029898f51a", "value": "1536:7NufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAO:YbU2RC4kPCtSzWu3/3L1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772001083, "uuid": "64736ead-6ea8-4275-a39c-18c17e15f94a", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772001083, "uuid": "210ec949-4b01-4fc8-a4aa-39a50f7eaee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772001083, "uuid": "160cbc44-d53a-4777-b138-7d0df6d55bae", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09c644a-1239-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772017414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017414, "uuid": "70b1aaf6-9cc3-4666-be76-2110ba5264b0", "comment": "Malware payload", "value": "ff0eb16768e7ecde4c7407f68a1f9b95", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017414, "uuid": "64275341-1a8a-4074-8b26-e5ad798853ec", "comment": "Malware payload", "value": "ebeef831c52b7e930a6456caedf7849814b8d4def2bc0e70a0e7a357621ef6bc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017414, "uuid": "7f8e0ad7-c2a1-436d-98ca-214973691b36", "comment": "Malware payload", "value": "0ee438ff255787e841581e5c23d340dfee8265b9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017414, "uuid": "1ef6b274-bf61-4862-ab08-9fa93084c9c8", "comment": "Malware payload", "value": "72cd9ebde2a9901c628315c48c1bf174031570f3668df1cc5952049b972486f4926b019607fd44c06e2c0d3f3b1df617", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017414, "uuid": "f1de1785-922f-42c7-9ab4-3f46c860cd63", "value": "T19A3120FF9906C061886281D9CAF5E61EFAC3287B6425D42C3C05C9C75B36D39DAA009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017414, "uuid": "3d426aa1-82f4-4533-9edd-5c50dd93c98b", "value": "48:n14t1Ge7zje0TAVzDrqnqzfF/aa8quE/fwNJw6rj:n882zje0TAVzDrqnQ1aaGAB6rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017414, "uuid": "11bda5eb-8eca-4d81-8228-e85187bd5dd1", "value": 1876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017414, "uuid": "2f9255ee-4ee4-490b-b67e-dd33b922ec50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017414, "uuid": "8bf76869-9b21-4aee-89f2-2c0377e8dd42", "value": "zcgo1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59ab168-1204-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771994712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994712, "uuid": "2a39d8a5-611b-4a69-bf19-a664b46a55d2", "comment": "Malware payload", "value": "ffd9c0245e68939549ce0e3a1e15fdb4", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994712, "uuid": "93946612-032f-4061-ae8c-f78fbfe1881f", "comment": "Malware payload", "value": "ec97bace89ad8e09a44d22e148730c95bcb7212fcd5b7382730af00b4c38ab9e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994712, "uuid": "ca9a82f2-e5c4-48d1-ae17-ee9d44812b52", "comment": "Malware payload", "value": "2993b0ab9786ddc29eb9cf1ace4a28c6e34ea4fb", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771994712, "uuid": "41d809e5-c44e-4468-b4a9-8b656416d378", "comment": "Malware payload", "value": "7c4a7138194c0add08442ce5543a354eeb2803e28e2b4c4c4792608a3eb3d65af83196b119d0b19a666cd07fbce8d4fc", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994712, "uuid": "eafec48a-cb87-4498-95d6-fb0e3b75cf91", "value": "T16F85D7A0CA854F82E566A4AC60C1F9D308363F27ADE80DF1937B2F0C5BBF4665565E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994712, "uuid": "9e6406fc-24ce-4b83-909a-468a155c1c2c", "value": "12288:woa7JtkcqN/mllqw2pczc01kMIoIBmJJDJ3uXFg98gnh4w9WleBgCk7yqK+EoX9K:w97DkXCl6Ic01kkSXFg9aCk4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771994712, "uuid": "0d9aecdb-7773-41f2-bc0c-c5170d3b36a5", "value": 1856512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771994712, "uuid": "36f4372e-31a8-4e92-9d01-29ead44c3e11", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771994712, "uuid": "5dc6206e-7489-4e5b-962f-7eb7a23400bc", "value": "ec97bace89ad8e09a44d22e148730c95bcb7212fcd5b7382730af00b4c38ab9e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2ff4af-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035662, "uuid": "863e9807-4556-44ee-985e-ff54950634f2", "comment": "Malware payload (Mirai)", "value": "1bdad7cd0fd1c5559adbe5abf9bb1965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035662, "uuid": "c936a0a3-8ed2-41d8-b3e9-90fc6d45807a", "comment": "Malware payload (Mirai)", "value": "ecaaefc7170b2e0f9d44ab4b43715d1a8ae1444dcd3cbfcb44a85ca40127a8e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035662, "uuid": "7d89eb57-9692-44fa-a912-f14fab82014e", "comment": "Malware payload (Mirai)", "value": "b29f847316911c5c97a3338459e5920af50c0f0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035662, "uuid": "ed13cf20-33de-4702-92a6-8f0502ffcd09", "comment": "Malware payload (Mirai)", "value": "cd6f5ac1eb23c536c54b4f8ef9d9a3d9611a7b4845b0655684e2a8c0fb830bdd085754b94a7ab065a2542a45075c27e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035662, "uuid": "f120967a-362d-41a2-ba33-8a2e6bc2785a", "value": "T171867C45FC1D7862DAC8B6352FA25294723DBC098F41C7272614B77CEAF63688F63660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035662, "uuid": "e01d313b-9173-4836-8c7f-b24b2202d717", "value": "49152:0lnqgBKmZk545/hWYLgxaG1YWcXUlc8etPNksH8kyCTNLhuC4P6yd5ER:0tqgBKTq/hWQgxaG1YtXUl5et1bcJER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035662, "uuid": "7c48aa94-33ad-4d6a-b73b-7178ede64999", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035662, "uuid": "9ebf8d15-837e-45d0-9463-e07d25d0f8e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035662, "uuid": "282c442d-6bd0-47cf-8a07-ec11d6df1b5a", "value": "ARM64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ce72fe-127b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772045846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045846, "uuid": "5473e965-8a14-4ab4-b90a-b6a7527e8e18", "comment": "Malware payload (Mirai)", "value": "0bc6085cfefcb5d5f620d5b132d66e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045846, "uuid": "cd9b9994-c7d0-4ae4-8d04-cfc8609eac1a", "comment": "Malware payload (Mirai)", "value": "ed112189cb2e02f1913f9a15ce55d4498c304c760219a0a9677a5dd21e26ed08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045846, "uuid": "1b534bb0-f79f-4a8e-b5ea-99bf8a930b70", "comment": "Malware payload (Mirai)", "value": "b8d03ca68e3245b17656cb79356d5f58ddade03f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045846, "uuid": "b25a9e16-fc84-4bb8-8c60-1fd0b6642946", "comment": "Malware payload (Mirai)", "value": "ce1850b9531b2610a71fb9b16210768241a918fa65b55edf7ce80753696e589b8d74d3b5bc7b0111b32cf20dca3b44f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045846, "uuid": "a4654ff2-172a-420f-a8d5-245060206ce6", "value": "T1DDB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045846, "uuid": "302a1940-da07-41b7-a803-60ce77e084a9", "value": "3072:pC/4rdZHsXsZwwR9jNk5mm/QcuLmHniPNb:pCwrvHwsZwY9jOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045846, "uuid": "c3565330-366f-43d5-906f-9016d4261564", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045846, "uuid": "566e71c0-6bf7-4da9-943e-b51110f12381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045846, "uuid": "7f10f063-0280-4285-b387-71d2dcfb7690", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf44d5f-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051524, "uuid": "bfff538a-6f6f-4e13-bf3b-c697f5aa4835", "comment": "Malware payload (Kaiji)", "value": "e3b586993ae6bafa4776d4c04dc7c62c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051524, "uuid": "367b5be5-deb5-433c-b287-222e7842fedf", "comment": "Malware payload (Kaiji)", "value": "ed2ac6cee0bc4c9e6b31c5b81f27c6c8d543536eb29769f5d17ff771a161616d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051524, "uuid": "d5746e67-237f-4421-97e2-080aed14ceb8", "comment": "Malware payload (Kaiji)", "value": "b69e943643a1e4c8c4bf32cd224555642cc7c363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051524, "uuid": "ed13516d-2d81-44c8-a5ce-de6fa86911f1", "comment": "Malware payload (Kaiji)", "value": "2e80a45dac99f5377b8a8fbfba8e78ea9cf61b35f330fe9fc22575f91ed637f18691823ff950d465eb3c1f9da42475bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051524, "uuid": "1836c5c7-5374-4a5d-9838-b85fd14d547a", "value": "T174560902EEC26E66C5CC037485FE979672507E085B951B2313A8EBA8397773DEF4684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051524, "uuid": "70492767-4adf-40d8-94f4-6a4624d8b9ea", "value": "98304:Z9mVusEEQ4kVIb0IamIIkmrIGDeII8jOSP0o:bu8VIb0IamIIkmrIGDeII8H0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051524, "uuid": "2997c3cc-8049-46f4-9eb4-4ca14e03bf3e", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051524, "uuid": "f2b33f37-8765-4a06-a237-b212efd658c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051524, "uuid": "7c972746-c915-4aed-b3f3-125f857db4ab", "value": "linux_mips64el_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462b5945-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003089, "uuid": "3abc2eb4-7933-41ba-80bb-b8b4847e4c47", "comment": "Malware payload (Mirai)", "value": "ed419dc67fb306504414b110e9a17f47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003089, "uuid": "c9c786cb-5067-46a9-97fd-abbe90561a79", "comment": "Malware payload (Mirai)", "value": "ed3f5b9fd6aade86001cde876544672d67c658e534858cc4b48c221b5eaa4697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003089, "uuid": "82ec600f-df2c-408a-bdd8-eec3dd7dd2e6", "comment": "Malware payload (Mirai)", "value": "da14572a90e49e7d1774506a1283bb79e4376fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003089, "uuid": "e4af8831-2fd4-43c1-9d77-60b8bf0acfbb", "comment": "Malware payload (Mirai)", "value": "96d6ff83a6cafc353e2bdac2434625b967fa234923ac1e03787bf60523f54120037057acbcc4d6a349576b4ed856dc9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003089, "uuid": "e1020dbb-6882-4fdc-b006-ce88f39ebd91", "value": "T173A3B85E6E218FBDF76C833007B74A31A79933D62BE1D681E1ADD5011F6024E245FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003089, "uuid": "d6a4b2f0-dd31-4d44-b0c6-6838420b190d", "value": "1536:ytjRz5rsx/rXS3ZOZdC/wVfSWvuuZaXH0jAxN6+eT+U9N3Z7:QFZY/TssQ/EdvuuZaXHlN67N3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003089, "uuid": "efbafe49-8eaa-4839-a778-c6c25843cb01", "value": 106176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003089, "uuid": "3615f628-6053-416f-a4ec-86c3478dab18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003089, "uuid": "d39d62f8-52ff-4be0-87f5-8ec22b72da75", "value": "ez_nigger.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685d9bba-11fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771991979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991979, "uuid": "3d1c99c9-60e8-4f13-bc81-489735ce1a72", "comment": "Malware payload (Mirai)", "value": "4b92229c5feca749b2e5f324ba60957e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991979, "uuid": "a36dc80d-9829-4190-891d-4fa2ca382c5f", "comment": "Malware payload (Mirai)", "value": "ee9601a9fd62c30100be9538933cc13c5f0cbb27ca4094d5a39cbe7cc4911bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991979, "uuid": "a32fe6a9-821f-4a7c-bff4-d30a369acaa0", "comment": "Malware payload (Mirai)", "value": "09cd3a115105fff63e6d674d21d08d5e33192516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771991979, "uuid": "81422ee4-2c70-41cd-975c-743d1d3bcc8c", "comment": "Malware payload (Mirai)", "value": "d7fa4331a08050bce304de5869124dc4ecab3a9785e7dc20a4a278723f55f552b4e03ec81a89b3bb04a8d3eed8c892f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991979, "uuid": "eed89c02-7da9-4248-a32b-ead26af4bc7e", "value": "T172A30874F9445B1BC2D362F6E75C828E3E2A1FEB93F630114A34BF9067F26D215A5428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991979, "uuid": "9c0a28ff-3971-44b2-9ec9-aac8051d043e", "value": "3072:Nz2o6Xu1S1vmz459FOr/gBFHnXOUe0zL:UXhvOBaFHnXre0zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771991979, "uuid": "2aa0137c-c412-44ee-ac9d-70a50ae36527", "value": 107120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771991979, "uuid": "be340602-08f2-45c2-a5ef-873e1f728844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771991979, "uuid": "ef5c03cb-d273-4e6c-acd5-730b77b0049e", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790442e2-1205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771995013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771995013, "uuid": "c53f758e-ac98-4a64-950f-daaaa9fcb6b6", "comment": "Malware payload", "value": "c6160e69af601077892cbc669bc00926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771995013, "uuid": "2a5cd03c-4762-4c89-bb1c-e8ed93d39051", "comment": "Malware payload", "value": "ef22f16d56334c01032bba80144e98a5dfb2eb87ce839411ea82d1e3ee4d0cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771995013, "uuid": "6ed1e203-e81d-4281-a742-36da38ef3199", "comment": "Malware payload", "value": "e3cc95ca6e271ddf04cd88c85051b2cc9ce04e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771995013, "uuid": "8d972036-7756-4fed-80fe-ec427eef69fa", "comment": "Malware payload", "value": "f47aa0f9c313425b18ba43d774abd7ece6f6da12393f1380a71c45a7a03108d461974576378446060540d5ca9f1dd362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Resocks", "colour": "#C4BF28", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771995013, "uuid": "509e8b7a-7607-4baf-9257-a89fbb043fbc", "value": "T1F8863A03ECA145E9C4AAD23589669152BB71BC490B3127D73BA4F7383F76BD06EB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771995013, "uuid": "0c22d033-20a3-4ed0-a563-66984b659b49", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771995013, "uuid": "9082af88-6d4f-403e-aade-2d80613db5f7", "value": "49152:TAN/m5UXI8xQYthJmh6nmi73WzpEnOjoklwdh+STbZRBJ5NfPMXk5wnzCjtBpsZw:TAoSFmTqhdHBJ0o5hxlykf0ZHLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771995013, "uuid": "301e5da8-4225-4e41-9cf4-c70f6e14c72d", "value": 8033792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771995013, "uuid": "a2842449-7518-4815-b8d3-8280a7793c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771995013, "uuid": "68bb3616-7efc-48d2-b566-c50891917117", "value": "ef22f16d56334c01032bba80144e98a5dfb2eb87ce839411ea82d1e3ee4d0cef.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8036206e-1250-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772027238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027238, "uuid": "6bebde6c-f411-4014-9398-7de87f9b372f", "comment": "Malware payload (NetSupport)", "value": "92a7af63722cb3465e68fb84e4e799e1", "object_relation": "md5", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027238, "uuid": "3e301193-7977-4fcc-a0ac-939d0b87a286", "comment": "Malware payload (NetSupport)", "value": "f1727b9da4055014e15f70f3b4c36029cd3ef02cc42a39ada315255493323758", "object_relation": "sha256", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027238, "uuid": "63d881d4-1c3b-42cd-993f-0b0b06ae1afd", "comment": "Malware payload (NetSupport)", "value": "5c5777a0749379e20bdbcd1b275dc1a382efdb40", "object_relation": "sha1", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772027238, "uuid": "8fd0156b-9e1e-4a9e-9f27-8b1064e488d9", "comment": "Malware payload (NetSupport)", "value": "2d07ac6af347d2850fbdb18d537e3b4dd125e3b23f98e02cb19ddc509bf881e61f6851fb5794bc4f697cd7a6685eec1a", "object_relation": "sha3-384", "Tag": [ { "name": "213.176.79.188", "colour": "#4A7446", "exportable": true, "hide_tag": false }, { "name": "95-85-239-4", "colour": "#BCA620", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "surosuro-xyz", "colour": "#52A154", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027238, "uuid": "ecc090d8-b9e9-4e8d-9dd2-e9a3653897db", "value": "T1F3D633A0A6E811FFF9EE933DC86295A1C89675663B49C183C3F8C5A12C733C4697E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027238, "uuid": "eaa764f4-2e56-41c1-8ffd-8acdebeb69d4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027238, "uuid": "c834d235-0f4a-4205-a116-75ffa6bc0300", "value": "196608:gB14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorAz2urH/P/XRLSq2KKeF:gB14FSsFl7dCR1C99/LkueuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772027238, "uuid": "7d50381c-52b0-4a84-bb61-e90fb92977de", "value": 13413705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772027238, "uuid": "e383267a-77c3-489c-b5e8-c6ed85ce1659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772027238, "uuid": "e2dc6f21-3f58-4ded-ad25-e59630978282", "value": "RateConfirm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7887ce-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003097, "uuid": "8981bc47-560e-48fb-99d7-8242c9cfac9e", "comment": "Malware payload (Mirai)", "value": "cc6ef4bf3cdc3f798d802610034ed045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003097, "uuid": "e59a25cd-32a6-413f-8ad1-7b682aeba47f", "comment": "Malware payload (Mirai)", "value": "f22293977dc2303d9fcffc252cb3feecda2cb15c3602e1c829f0629cb82ec071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003097, "uuid": "84b75480-b066-45bd-9206-cba5468b4f45", "comment": "Malware payload (Mirai)", "value": "855b1c8595994b766642a4dfdaae1a0714b90ba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003097, "uuid": "30fce67d-6e2f-42a9-a99c-5b8fd47ed101", "comment": "Malware payload (Mirai)", "value": "92f2baa95a9f21a970a6b80fc079e7f48661db650bfaa922f44456bf6e1f6f08c9cb709b8167654e7f1cf56c93a4987d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003097, "uuid": "7c1fcd65-68a5-4a2d-a5e7-acdae4ca406a", "value": "T16D833A85FC819622CAC5167BFB5E028D3B2717A8D2EE7203DD25AF21338B96B0D77541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003097, "uuid": "d50ce43b-b420-4d0d-9fac-08a0c8b8002a", "value": "1536:/oUE3+RL1Nkkwnpf3wpZn3dIvpX7eZzyYCHNreAvBLyvL:gUE3WL/qJwpZn3dIvpXqZz7AyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003097, "uuid": "6a9a9c7d-4ee0-4bd4-9335-b3929fbeefed", "value": 83880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003097, "uuid": "71f0c17f-6b72-4a40-80e2-6bece79712ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003097, "uuid": "61f5064f-421d-4589-9a40-274d7a58dc28", "value": "ez_nigger.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db1cefb-1239-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772017382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017382, "uuid": "2a6a1d1d-2641-4375-acbf-13fa0df60da9", "comment": "Malware payload (Mirai)", "value": "ff48f72815eca43373bcedfcd84d4826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017382, "uuid": "caf7af64-d382-48ee-a385-83eab3b24555", "comment": "Malware payload (Mirai)", "value": "f2d106119cf094bab39955c564eaa924ff7e0888d9e225c69fd0123cda5f43e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017382, "uuid": "3cc848fc-5b3e-4acb-87c3-6886baeb3693", "comment": "Malware payload (Mirai)", "value": "9c6f9caa0443614661a5c2beea5cb7c7cbcd213c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772017382, "uuid": "0fe3d0fd-f35c-4cab-850d-b686a01c449d", "comment": "Malware payload (Mirai)", "value": "098fb9b450edf42c9957ef0359c7d3b679262a187c662a643c421a369ec6a448aa4fefd0537abc38ddfa4c5f19423590", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017382, "uuid": "84b70639-f273-45c3-b498-4c67eebb4b64", "value": "T17E336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017382, "uuid": "2c2376a2-4367-4834-9cd8-849fc575ebd4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772017382, "uuid": "1f6becc1-aab3-4bc1-a2d1-1d0894b30caf", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772017382, "uuid": "51c594fb-0038-4ca1-bdf8-6877b91241fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772017382, "uuid": "18722d48-bf8d-4057-9b39-c395d1a48f85", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e54bd82-1289-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772051528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051528, "uuid": "2395cda2-8574-4a9f-91ee-0b3fd7b73610", "comment": "Malware payload (Kaiji)", "value": "2aa634e66009959a44ad4350f816051b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051528, "uuid": "94adcd41-11dc-4fb0-a3f5-9ada1fcc2ef4", "comment": "Malware payload (Kaiji)", "value": "f379e71df3f5c1a39afe732ae8ae99d0c6f9ff0c407e8c839e1d0e4f254f5f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051528, "uuid": "52342a2e-1014-4fde-a24e-b3559412fab6", "comment": "Malware payload (Kaiji)", "value": "be7434569fa5930355b42587922c649a15482999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051528, "uuid": "0fe3ce59-ba6d-4f59-a483-d5c98dbb05ec", "comment": "Malware payload (Kaiji)", "value": "d167d55927d3e84c25a3a13376416d23abbbfacdc77c07cbddf4de07b636923da61ec1bbe6b1e110e13976c973d4253b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051528, "uuid": "293d1b78-58d9-4f67-af8b-6f18443517ac", "value": "T148364A10FECB54F6D5031D3044ABE2AF67316D064B25EB83EA047F6AF97B6A51D32209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051528, "uuid": "381235f3-954f-4f3c-a8a3-d88ed65a555d", "value": "49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uNHp9hW16klbU6V:E33GlbU8FwmzzRDZ9mYqRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051528, "uuid": "d3d79f71-7fae-4234-843e-81cf7759b88f", "value": 5251072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051528, "uuid": "90678dec-0789-4f44-8d59-c9c22c4e6848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051528, "uuid": "ea119a97-87d4-44bb-b274-ea0a860ae2f5", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a34388-128a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772051997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051997, "uuid": "4abf7739-e765-4aff-a500-35fa94abdf37", "comment": "Malware payload (Mirai)", "value": "f4436f7f9f5b5408e99f42bb696cdf2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051997, "uuid": "f0585e36-c4d6-45cd-b6cc-a257c038ed18", "comment": "Malware payload (Mirai)", "value": "f3b21a61d2524a83bbc2ca25f5745ba8a40cb30bf605f02f7c5b122b35a3de31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051997, "uuid": "644c9c03-ca9b-4816-907b-cb97c33b7d0d", "comment": "Malware payload (Mirai)", "value": "b5bd965810900cb05e1edb9ea0f5afc973ea7778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772051997, "uuid": "6dd9ff82-f6b6-4554-88d2-a1d610643f72", "comment": "Malware payload (Mirai)", "value": "e7c7bbcebf79c02820402fec32e94e1cdfe17b5ec633b4d0091abd2054652d4a42af7ddd32fa45e8ab18983aaf4b8c62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051997, "uuid": "18b8089f-13ab-4d64-a20f-de70f9ead532", "value": "T145D3D094F0809A73C3D522BAF74A264873631768D7EA3305A9258E3077D7A6B4F36D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051997, "uuid": "ff3c6d5e-2d13-4907-aca3-ace475996002", "value": "3072:7D0ownSrawpb01GEy8ojm4GYk3c2QR5dOYVlT:7xwSuw2dokGR5dOilT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772051997, "uuid": "97c1c952-dd8f-40e9-b6ba-a4ae96b6e765", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772051997, "uuid": "4d2ce9a1-9738-4f57-9c97-b7bd35311240", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772051997, "uuid": "1804f518-8507-44e4-a448-aab0b7bd96ca", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f35d0d-1264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035948, "uuid": "82a46010-ef05-4ce6-857e-69595a118585", "comment": "Malware payload (Mirai)", "value": "a1081b75c46c604f6ddd60f717f89193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035948, "uuid": "dcaf6016-7a14-4315-8e77-72f1baa99ac3", "comment": "Malware payload (Mirai)", "value": "f5407c4ca46a9ae10ade4ade365d0850c01ae6ea3dcd1a816e5cbbb2eb95342f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035948, "uuid": "da0d024c-8c9b-49d4-9d02-2001e109458e", "comment": "Malware payload (Mirai)", "value": "d6733afe1ec7ffeca127b7b26daf404fa7a03216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035948, "uuid": "7554d1c4-4f96-42c0-9d20-e98a92d72991", "comment": "Malware payload (Mirai)", "value": "9a0798810b45ffbb520c510b21066e161d39866e8b57d35838fceafd1f287b31a368cc3d29d85df811ef8fa5e5152fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035948, "uuid": "9aac80ab-c186-4f43-ad95-7b9ea38dc79d", "value": "T1A6865C0EFE558B62C6A4067789F911982331AD026FCB4707A324F73CFCB66D4EE46691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035948, "uuid": "67cf693e-2e2f-41f7-8902-6449c18095c4", "value": "98304:LMa/nEjNNdsybk9gP4xxJPKET/x3YgMYEG:Aa/ANNdsf6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035948, "uuid": "6d456cf8-c4b1-464b-899b-820ea9c8167c", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035948, "uuid": "102d7226-0f16-4330-95ea-fc6c53b1273f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035948, "uuid": "36ca945f-f4e6-4ea9-8db8-407074d71d15", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34848d25-12a1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772061900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061900, "uuid": "323ab7cf-bd21-40f8-ada3-0633c45cdd3d", "comment": "Malware payload (SalatStealer)", "value": "3c0f1af9b2b44915159b9a3ab47b0204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061900, "uuid": "c1f3d8f1-5fce-4a8f-85a4-bdbfe9470788", "comment": "Malware payload (SalatStealer)", "value": "f548317d339c7471a285f901d723ee12cea76e40e59954075a721153cb51a89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061900, "uuid": "8dd7c5fa-cc1a-4cf8-b5d1-635d1cfe4ae4", "comment": "Malware payload (SalatStealer)", "value": "c678a35e65e40da8d6237c5fd92bd1a1cdc8aa54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772061900, "uuid": "44d6818e-f3ac-4ff2-95df-d5a62bb5dcee", "comment": "Malware payload (SalatStealer)", "value": "d0658788168ea90451890e39f73c30160e613ff1648d5f38fba7629d40492a5d0efc29967c68ec6456c79814140681ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061900, "uuid": "84fe5786-cacc-40c5-9022-89c95b8f464b", "value": "T179E533543ECE2D73D9CC0DBD3F13D6A6922690108D1A9E4C6F8CABD127CDDC26690A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061900, "uuid": "cadbbe98-6f26-4944-9903-c775050896fa", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061900, "uuid": "703980cd-2aa7-4b1b-972c-4db80d46546b", "value": "49152:ZmsGO40MfrQIObHfsUlu7x5jycxbQ/UVxzvvVQt8yQEGr8F+YLXn1E2RUEXl/:ZSX6kU87x5jycxbtDv9gNUYS27F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772061900, "uuid": "97633850-7547-474d-8690-7ae3442512ee", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772061900, "uuid": "8b544266-3899-4622-812d-df5103b20800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772061900, "uuid": "c32395bb-7816-4f67-97e4-3e1b985ca919", "value": "valonity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4000aa36-127b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772045598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045598, "uuid": "50e15022-67b4-4504-8893-68e12050bb52", "comment": "Malware payload", "value": "9fb9ec403b4ef2f8ab7e5c57f78fbf6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045598, "uuid": "27e92ef9-833b-49a0-90a0-9b47fe6170f1", "comment": "Malware payload", "value": "f6100a591568c2a0c68c8cd9b9d62481e391407feea416de19abd63926dc37ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045598, "uuid": "9219d572-40b1-4532-b826-e2ffa31acb3a", "comment": "Malware payload", "value": "f5a25ecce2ca09a921312651b29cd0ea0e78c755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772045598, "uuid": "5569a37a-2f32-408c-8217-e527a4178b8a", "comment": "Malware payload", "value": "6c160f1c1c6d50153a450dca1b3084b017497fc725e4f613460f6d69eb0974a80cba72d4ee69325254fb3076d1d5bcee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045598, "uuid": "a5a962e3-f1fe-4aa9-b418-e1cf11b948f2", "value": "T1CFD32902B31C0947D1A32EB03A3F27E193EFAAC121E8F641755F9A8A9271D375585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045598, "uuid": "fd6a18c1-de30-4254-8de4-e0c01e8669f9", "value": "1536:l6efD0MC6+RoB8Bwwx7b3mxFVkRFuwuZ3i6oAj/Z+dvADdZGaVKjp+qDIy+uB1Lh:AGwI+RoBm7CxIuRi6b/1DOl1Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772045598, "uuid": "a2a71341-decd-480e-9b48-0c7416574aef", "value": 142040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772045598, "uuid": "8c5ca793-2990-4786-b257-cbbce526c151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772045598, "uuid": "2a7f6853-370b-42fa-ac86-caf2213f2074", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e747ab16-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012808, "uuid": "cea0363a-4748-4c0c-9244-21e3be6c1d00", "comment": "Malware payload (Rhadamanthys)", "value": "4c9ca0a052899eaf99b1c55c72fe3411", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012808, "uuid": "7c602354-4c51-4496-a05b-7c9b04b7c87a", "comment": "Malware payload (Rhadamanthys)", "value": "f657dd031cf1f03bea1200b4b3d91ec538b3d7371de661d93a5717dbb2661848", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012808, "uuid": "3eacc8b2-2e90-43f4-9a8f-360167de29da", "comment": "Malware payload (Rhadamanthys)", "value": "6b88ed3f59432f5597a6d748739070752c2fe69a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012808, "uuid": "fcd11bba-adf5-4330-8e62-7c7806c89073", "comment": "Malware payload (Rhadamanthys)", "value": "e288d3a528407cf8c1a4de7b909fabe8f7feb254b64b959f9e1def63c71545d22ebe953003d9301bb84fc2db23ed7dc9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012808, "uuid": "60e5acca-b5b8-40a8-a95b-6b3d85450afc", "value": "T1E3A32BE39D96EAE615F0A0937FA92298FF0A99D288325505CC57BDB04441DC21BB33F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012808, "uuid": "f08018ff-6eb0-4c23-8ced-f672d9380308", "value": "768:GDhd0i7J4sYKgY/CMNfWd6+85EgerXKmrS4eeykH+QG90A2Wt8VShSLAuAAroQWK:GDB7eKg20XrzrS4d04Aw0h6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012808, "uuid": "4a689184-c61c-4056-b52b-f95203d8a676", "value": 102067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012808, "uuid": "d1453512-3e09-4ffd-988c-c2fc4fecbdfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012808, "uuid": "94c4e644-181b-4ac8-8f00-183283b23757", "value": "invoice-1637482117.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4670a7-1237-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772016655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772016655, "uuid": "e7c57fc6-c480-447e-bf6a-ff9619451e1c", "comment": "Malware payload (SantaStealer)", "value": "eb2071951089153d11efaca21a19fd79", "object_relation": "md5", "Tag": [ { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772016655, "uuid": "f1075d5a-868c-4f4f-b459-9450e1d4f12c", "comment": "Malware payload (SantaStealer)", "value": "f65b4f2c1eb104b54eecf17d0d838c8e7409844e2424fc93ddd6b5ea9ac7cdcd", "object_relation": "sha256", "Tag": [ { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772016655, "uuid": "b153c739-1b79-44e6-9fcf-bafc577b3f81", "comment": "Malware payload (SantaStealer)", "value": "44ba1632514ae9d9536f3617c6431b7fef828b22", "object_relation": "sha1", "Tag": [ { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772016655, "uuid": "b3da29b8-7acf-4263-8bb1-b5c3d054e5d1", "comment": "Malware payload (SantaStealer)", "value": "7874a5543a0bbbca65de569a6a5f7fb6628eb1a0fe327519081727a8b6d526445368e558e9a3952b4c7e66460ab59b69", "object_relation": "sha3-384", "Tag": [ { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772016655, "uuid": "835e5a5c-aad5-417d-9750-5d9ab494ecd0", "value": "T1898633CDC30AB6E959644450F1752F26A40B62F43719F62A1BFE30AC70AFCBB561291E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772016655, "uuid": "8b5db381-eb3f-4c75-a6b3-e0147db14138", "value": "196608:pKVJPH7Z9azGOzuezSRaP6+aMEIaT4cX/9Np:pGPbIzfmRaP64g4Erp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772016655, "uuid": "c6a6dee7-dd22-4e23-baad-2a646432346b", "value": 8082696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772016655, "uuid": "d6b3090b-794f-4c9a-920f-2c2bb11cc06f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772016655, "uuid": "eb69274e-5353-411b-bb11-2eb2bc73ccf4", "value": "ProtonVPN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2b3d63-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003102, "uuid": "464e25e4-3ff9-4db6-98f9-ea7a559e625b", "comment": "Malware payload (Mirai)", "value": "b858727ee4edbb246528fcec9ad7ae05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003102, "uuid": "60d529c6-7d31-4a5c-8e63-9db7e99a928b", "comment": "Malware payload (Mirai)", "value": "f66f1bec086eedd6d20104987628b2ce6bc23a057d7ee563cab47c2ae353cd8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003102, "uuid": "0320dff6-1db3-4236-9050-13d262c4e695", "comment": "Malware payload (Mirai)", "value": "8287a3561d2faccca1ba2f06c038d18bba49be9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003102, "uuid": "f802409e-9fbd-49d2-894a-4debf109e73d", "comment": "Malware payload (Mirai)", "value": "ac2d1632fe971fd2fca1e8429db0a088efb5c07f79a61dbe3e8b312d3136885ca71e475565f5978babb06785fbee832b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003102, "uuid": "9b47c95d-590c-4beb-b0ee-9252bd96070e", "value": "T1F7B39E9BF28724A1C86787F007C71BAD2E1332018F57E9F77C1D2A3A197A1DB051A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003102, "uuid": "8557236b-c335-4872-aa7b-f5adf5c5fad5", "value": "1536:ZlbE6JHcTckcbA2axCrPBetfPc4YFlzPR/ewkx4Thqgs5I/LWY:3wYcXcU26WgtXbYFFR/eIqgPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003102, "uuid": "fb02151d-a145-473d-a93f-334cb71d79fc", "value": 116068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003102, "uuid": "8d6126ca-bc20-4ce2-aaae-ac2757f8daa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003102, "uuid": "44a90f2e-6787-4c56-8f3c-c65a47292115", "value": "ez_nigger.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c44064-1263-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772035587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035587, "uuid": "08d77a84-da52-4188-a257-4be409be81d7", "comment": "Malware payload (Mirai)", "value": "68b4f152889ba02f2674748c56e3e7b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035587, "uuid": "d9d94b57-a592-46f1-a879-66a5a7fcbfaa", "comment": "Malware payload (Mirai)", "value": "f9e43bdcfa7d2abf93680403026e13ad0a15a35a5191dc4a94c5565245e3e417", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035587, "uuid": "b92870d3-4c4c-4b3f-b900-db06c3e270ef", "comment": "Malware payload (Mirai)", "value": "572e1c00e9c10d98da5173b3808ba50c8a895a60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772035587, "uuid": "439bf3b7-7a77-49c8-b2e7-e113e5477c76", "comment": "Malware payload (Mirai)", "value": "f18b0f703c13d9d8ce9abf47465b8289599031b645ade954635604525bccb755420c025eeeaa89f9a44d282ca1184615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035587, "uuid": "1e73ff43-9f8e-4ac8-b96d-3c2d328caaf9", "value": "T18EA53304BD6684DD98010EC8F70EDAD7A5081B8EC3E04DAB4CB64E4FB18EA572DD7D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035587, "uuid": "8cf87e36-8981-4d7d-bb1e-baae1710173c", "value": "49152:MAT9QObu21iDRky5OXmAq/1UfCvAFmW+om///x8aky:MARQObbCLqmAq/eqvypm3/xky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772035587, "uuid": "25a3f4b6-bad1-4ac6-93f7-66f71a2f8ee8", "value": 2128464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772035587, "uuid": "fd29bfa8-a208-4016-a7b0-a11f2d76f887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772035587, "uuid": "f133a0e2-336a-490d-86b3-13bf23a2069a", "value": "ARM6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc07e1f9-122e-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1772012735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012735, "uuid": "36f3050d-7333-4290-824e-97a07b4ba0b3", "comment": "Malware payload (Rhadamanthys)", "value": "e31c4b7e225de6f37815e05e43a170e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012735, "uuid": "23ced81d-859d-4a37-a963-dc537576b083", "comment": "Malware payload (Rhadamanthys)", "value": "fa383b24ae230478d3e16e3637582873ab37a8841586e9ee0c620516a4babd17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012735, "uuid": "a029d103-d395-49f7-bdd8-f640bf9a164e", "comment": "Malware payload (Rhadamanthys)", "value": "cfdb1c1f73cab93b5b96ecc3398b2895767d147a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772012735, "uuid": "49da4d11-1a35-45a1-96ac-cc89f28886c3", "comment": "Malware payload (Rhadamanthys)", "value": "9a3021b96b403e3f82593184902170bbdeb2d89c2860404c6df1f8a022046dbc422cd73a33552eb96a9b9586e3e0295c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012735, "uuid": "78fd95d3-682a-4f17-9504-1ff6495ccb06", "value": "T1F8A3391B1E15F5E40D63F16ACCD9076F628FC7A42CC243E0F55AF7642E9990B06622AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012735, "uuid": "dbd0e603-1c25-4ed9-9b7a-a2d00fb93b43", "value": "768:GDhd0i7J4sYKgY/CMNfWdK7zeGWVuhuEcMsrsCe3Qzu8PQ144LVe13tVzpfzrj9s:GDB7eKg20CrorspdAQAguL6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772012735, "uuid": "eb2d4352-8b74-4d71-8cb4-a26651f6de6f", "value": 98792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772012735, "uuid": "0de4a154-475f-434b-8332-529b3d69b878", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772012735, "uuid": "eeffb9a0-d63f-45d4-8839-4908ff3f0941", "value": "invoice-1637482117.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5191816a-1216-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772002249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002249, "uuid": "8cb85591-f615-4ac2-af20-125269e3883d", "comment": "Malware payload (Mirai)", "value": "66447a94d754ed6b3c8f9888ae8a589d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002249, "uuid": "722cb9bd-fdd2-429c-893b-a76f0512e091", "comment": "Malware payload (Mirai)", "value": "faf0dd87fc2872baa6f9786ffc3f14eb95178a02d3b922afb448e04196ccbe11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002249, "uuid": "4ea79c03-bea8-4c8b-ba75-08ea04539d4a", "comment": "Malware payload (Mirai)", "value": "cdd0570e21027831abbe3ce6ed70116a4c8f53bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772002249, "uuid": "bf4d45e9-2edd-45ec-8d77-5cc7339eb613", "comment": "Malware payload (Mirai)", "value": "6cfa8a2494f38d58015c5536de3fe20fba2aa764a2593038d7e956927f0d070cef037afb9734979f650eddb8e16ffc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002249, "uuid": "2b93731d-2b18-4e9b-a89c-244797fe0960", "value": "T13434A65E6E228F7EF668C73447F74A31976D33D623E1D684D1ACC1141E2428E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002249, "uuid": "c7fc1fdf-975b-49c1-ae99-e70941a08f67", "value": "3072:PTRWTc3J96bexzuUSJa0J1LMciWUKhwpus9TuHYxp0KbjvZN4ooeQtl6gjZte3:P9yfEzu/asucIKhwHD/vUo6tlljZt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772002249, "uuid": "e1246bf2-3851-41a0-9872-76d511fce0f7", "value": 238476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772002249, "uuid": "13443c46-132e-4fde-801e-de22bb64db25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772002249, "uuid": "dba7b7f2-fa7e-4bf8-b117-405853188356", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf52b3c6-1285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772050107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050107, "uuid": "72cc5003-d6ae-409b-b3a5-a908addf3ffc", "comment": "Malware payload (Mirai)", "value": "d0a94aa4a1a8089d0629912eff2d83fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050107, "uuid": "75129b15-668b-466f-a9d6-b9587f89c9c3", "comment": "Malware payload (Mirai)", "value": "fb7508c09f4c3f55dfba8f57de6e1cd3686de6babd75954fd9c43265a76e96a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050107, "uuid": "c7b1ec93-2644-4cad-93ab-f9de59e8c177", "comment": "Malware payload (Mirai)", "value": "57f2084fbf564ef4c3a13817eae755bc068a41c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772050107, "uuid": "f7c75d6f-ea29-4c50-bc7b-6c130ec83211", "comment": "Malware payload (Mirai)", "value": "dc441459459dc6e743dfa2337fb9837c053139a504484de99a1ac48e1f84b55d011b8ce35f542c68e3256ca5c709d98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050107, "uuid": "2ff49a15-e11f-41b5-a3c8-9fb6a0b91fe7", "value": "T178637DC9E283D8F6FC1705706036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050107, "uuid": "52b4541b-261f-4547-b313-ef144d1a4958", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAeTxpx97qJ7RvsuIr5bhh8l:pnUQJ7RlUXTQpwOaOA+xpn72+uWkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772050107, "uuid": "c8086316-fda8-4332-ac50-62c3b04345e3", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772050107, "uuid": "8ecf0364-532a-440b-89ce-a46cce4856bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772050107, "uuid": "77c3ff19-a22b-420b-b3df-2fff29d26fd5", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04333ee-1235-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772015829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015829, "uuid": "78fd200f-0aa6-4a66-9503-7bcce828c3ec", "comment": "Malware payload", "value": "d255df7792da718a7c0188f99f89ccca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015829, "uuid": "b4b06e03-c0a9-48c3-b23d-8330cb70e51f", "comment": "Malware payload", "value": "fc8693fb885da69008cdac48ebbb6f996322d027a4be87ca564b27b96eb5dc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015829, "uuid": "fe9238b9-065f-48c8-8522-e205288cf0fa", "comment": "Malware payload", "value": "e05f9f51da529fe894fd1ca6b562387acf7ac1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772015829, "uuid": "ad5dbb4d-2df0-48a6-a72f-86282f5503ab", "comment": "Malware payload", "value": "be5296f7dc93c8a7bc80ca21e08f7d2fdc45813420e9d00171b3e79c6dc3a71f820a5b3421203b080ed10e1aa7806705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015829, "uuid": "2df05faf-2178-4ce4-941b-c0df5f1908f4", "value": "T1668308C5BA81BC6FC929563584AF8329333CB6C81B82DB134D74653D0E177D06E9BA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015829, "uuid": "e2f6a37a-9adf-438b-b1f8-897b71201452", "value": "531c54a013bdd0ae3be4d703b6e2f29c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015829, "uuid": "85c14b88-a2c4-4a17-87e4-a9937032998b", "value": "1536:EDSOIV8DfU9gWJAOSRihfMXES/Q03L0ftLlar3:EDSO30c0FLE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772015829, "uuid": "7807e394-215f-4035-8c06-5d405cee8da5", "value": 87175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772015829, "uuid": "f92f1813-02d7-40fd-b330-5394fbcc860b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772015829, "uuid": "74d314cb-b1be-404d-86e2-f73a3f7db7d7", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e27a0d-1218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772003080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003080, "uuid": "5308b604-6adb-4eef-8b9b-0510952d2e4a", "comment": "Malware payload (Mirai)", "value": "528cf3f444fd3d3ee1344ec5edf70077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003080, "uuid": "b40fd944-c2e7-4fb6-b645-5201beccd1d1", "comment": "Malware payload (Mirai)", "value": "fd77c73a6619e384a8a62913377b59325351774dacf62584a2cdc030f0366355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003080, "uuid": "314cba3d-eb76-4ec8-bfe9-bbcd99561a5d", "comment": "Malware payload (Mirai)", "value": "b577511946d5e84f4189fed89ee296b82c916233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772003080, "uuid": "f97ece2e-211f-473d-aaec-3c24590b4647", "comment": "Malware payload (Mirai)", "value": "59013080088c097cce8359087a18ed55b557cdc68d3d655045f538cf0e5bf9a6c3d68cd1b0af2590d2564f1787321c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003080, "uuid": "f2bdc86a-f9ed-439c-bc0c-088ea9c6fdfa", "value": "T100639D63CE3A2E54E54888F071F48F7D1753D851828B1EFA199AC67A9043DEDB2463F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003080, "uuid": "73bc5b21-4689-415e-8860-3a67af6c33ab", "value": "1536:AxBGXIRNXwELFKvgYasjlUDKTtKj75kyBtVvCU2LsA6:AxaIRPYa0UmT6KyXVvKIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772003080, "uuid": "079d3dc8-bf2d-462b-94fe-76a8ca5613c0", "value": 73040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772003080, "uuid": "5f8b0c6e-e633-4b46-837a-fc40b3278cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772003080, "uuid": "684f089e-927d-4129-95e2-c951b0a0d888", "value": "ez_nigger.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }